rhecosystemappeng/Red Hat Dependency Analytics (RHDA)

Analyze vulnerabilities in application dependencies

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Stale
License
None
namedescriptionrequireddefault
manifest_directoryPath to the directory containing the manifest_file.no
manifest_fileName (basename) of the manifest file to analyze. This file must exist in the manifest_directory.no
rhda_report_nameName of the file where the Red Hat Dependency Analytics report will be saved.noredhat-dependency-analytics-report
github_tokenGithub token to upload SARIF file to the GitHubno${{ github.token }}
upload_sarifUpload the generated SARIF file, by default it is set to "true". If you don't want to upload SARIF file set this input to "false". notrue
upload_artifactUpload the generated RHDA report JSON file and SARIF file as an artifact. notrue
artifact_filenameFile name of the artifact to upload. By default it is named as 'redhat-dependency-analytics-report' noredhat-dependency-analytics-report
fail_onFail the workflow if vulnerability is found in the project. To set failure when vulnerability severity level is either "error" or "warning" set this input to "warning". By default it is set to fail when severity level is "error", or if you don't want to fail the action set this input to "never" noerror
use_python_virtual_environmentAutomates the installation of missing packages in a Python virtual environment when set to true.nofalse
use_go_mvsUse the Minimal Version Selection (MVS) algorithm to select a set of module versions to use when building Go packages.nofalse
enable_python_best_efforts_installationInstalls Python packages tailored to the Python version in use, disregarding declared versions. Note: Requires settings Match Manifest Versions to be set to false and Use Python Virtual Environment to be set to true.nofalse
use_pip_dep_treeUse lightweight pipdeptree command line tool as the data source for building the Python dependency tree. This may significantly enhance analysis time.nofalse
match_manifest_versionRestricts RHDA from performing analysis on dependency tags that do not match the tags requested within the manifest files.yesfalse
mvn_executable_pathSpecifies absolute path of mvn executable.nomvn
gradle_executable_pathSpecifies absolute path of gradle executable.nogradle
npm_executable_pathSpecifies absolute path of npm executable.nonpm
go_executable_pathSpecifies absolute path of go executable.nogo
python3_executable_pathSpecifies absolute path of python3 executable, python3 takes precedence over python.nopython3
pip3_executable_pathSpecifies absolute path of pip3 executable, pip3 takes precedence over pip.nopip3
python_executable_pathSpecifies absolute path of python executable, python3 takes precedence over python.nopython
pip_executable_pathSpecifies absolute path of pip executable, pip3 takes precedence over pip.nopip
syft_executable_pathSpecifies absolute path of syft executable.nosyft
syft_config_pathSpecifies absolute path to the syft configuration file.no""
skopeo_executable_pathSpecifies absolute path of skopeo executable.noskopeo
skopeo_config_pathSpecifies absolute path to the authentication file used by 'skopeo inspect'.no""
docker_executable_pathSpecifies absolute path of docker executable.nodocker
podman_executable_pathSpecifies absolute path of podman executable.nopodman
image_platformSpecifies platform used for multi-arch images.no""
namedescription
rhda_report_jsonPath to generated Red Hat Dependency Analytics Report in JSON format.
rhda_report_sarifPath to generated Red Hat Dependency Analytics Report in SARIF format.
artifact_idID of the uploaded artifact.