redhat-actions/CodeReady Dependency Analytics
Analyse vulnerabilities in application dependencies
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
- Runtime
- Deprecated runtime
Inputs
| name | description | required | default |
|---|---|---|---|
| manifest_directory | Path to the directory containing the manifest_file. | no | — |
| manifest_file | Name (basename) of the manifest file to analyze. This file must exist in the manifest_directory. | no | — |
| deps_install_cmd | Command to use for dependencies installation instead of using the default commands. | no | — |
| analysis_report_name | Name of the file to save the analysis report | no | crda_analysis_report |
| snyk_token | Snyk token to be used to authenticate to the CRDA | no | — |
| crda_key | Existing CRDA key to identify the existing user | no | — |
| github_token | Github token to upload SARIF file to the GitHub | no | ${{ github.token }} |
| upload_sarif | Upload the generated SARIF file, by default it is set to "true". If you don't want to upload SARIF file set this input to "false" | no | true |
| upload_artifact | Upload the generated SARIF and JSON file as an artifact. | no | true |
| artifact_filename | File name of the artifact to upload. By default it is named as 'crda_report' | no | crda_report |
| consent_telemetry | CRDA collects anonymous usage data, and is disabled by default. If you want this behaviour set this to "true" | no | false |
| fail_on | Fail the workflow if vulnerability is found in the project. This will lead to workflow failure and SARIF file would not be uploaded. To set failure when vulnerability severity level is either "error" or "warning" set this input to "warning". By default it is set to fail when severity level is "error", or if you don't want to fail the action set this input to "never" | no | error |
Outputs
| name | description |
|---|---|
| crda_report_json | Generated CRDA Analysis Report in JSON format |
| crda_report_sarif | Generated CRDA Analysis Report in SARIF format |
| report_link | CRDA analysis report link |
| artifact_name | Name of the uploaded artifact |