pirikara/SBOM Dependency Diff
Generate SBOMs for base and head refs using Syft and output dependency diff (added/removed/changed) as JSON.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| base-ref | Base git ref to compare (e.g. PR base branch). Defaults to GITHUB_BASE_REF or origin/main. | no | — |
| head-ref | Head git ref to compare (e.g. PR head branch). Defaults to GITHUB_HEAD_REF or HEAD. | no | — |
| path | Target path to scan for SBOM generation (e.g. '.' or 'subdir'). | no | . |
| sbom-format | SBOM output format for Syft (e.g. cyclonedx-json). | no | cyclonedx-json |
| syft-args | Additional arguments passed to Syft when generating SBOM. | no | "" |
| working-directory | Working directory to run git and syft commands in. | no | . |
| fail-on-diff | If 'true', action exits with non-zero code when any diff is found. | no | false |
Outputs
| name | description |
|---|---|
| has_diff | true if there is any dependency difference between base and head. |
| added | JSON string array of added components. |
| removed | JSON string array of removed components. |
| changed | JSON string array of changed components (with old/new versions). |