| manifest_directory | Path to the directory containing the manifest_file. | no | — |
| manifest_file | Name (basename) of the manifest file to analyze. This file must exist in the manifest_directory. | no | — |
| rhda_report_name | Name of the file where the Red Hat Dependency Analytics report will be saved. | no | redhat-dependency-analytics-report |
| github_token | Github token to upload SARIF file to the GitHub | no | ${{ github.token }} |
| upload_sarif | Upload the generated SARIF file, by default it is set to "true".
If you don't want to upload SARIF file set this input to "false".
| no | true |
| upload_artifact | Upload the generated RHDA report JSON file and SARIF file as an artifact.
| no | true |
| artifact_filename | File name of the artifact to upload.
By default it is named as 'redhat-dependency-analytics-report'
| no | redhat-dependency-analytics-report |
| fail_on | Fail the workflow if vulnerability is found in the project.
To set failure when vulnerability severity level is either "error" or "warning" set this input to "warning".
By default it is set to fail when severity level is "error",
or if you don't want to fail the action set this input to "never"
| no | error |
| use_python_virtual_environment | Automates the installation of missing packages in a Python virtual environment when set to true. | no | false |
| use_go_mvs | Use the Minimal Version Selection (MVS) algorithm to select a set of module versions to use when building Go packages. | no | false |
| enable_python_best_efforts_installation | Installs Python packages tailored to the Python version in use, disregarding declared versions. Note: Requires settings Match Manifest Versions to be set to false and Use Python Virtual Environment to be set to true. | no | false |
| use_pip_dep_tree | Use lightweight pipdeptree command line tool as the data source for building the Python dependency tree. This may significantly enhance analysis time. | no | false |
| match_manifest_version | Restricts RHDA from performing analysis on dependency tags that do not match the tags requested within the manifest files. | yes | false |
| mvn_executable_path | Specifies absolute path of mvn executable. | no | mvn |
| gradle_executable_path | Specifies absolute path of gradle executable. | no | gradle |
| npm_executable_path | Specifies absolute path of npm executable. | no | npm |
| go_executable_path | Specifies absolute path of go executable. | no | go |
| python3_executable_path | Specifies absolute path of python3 executable, python3 takes precedence over python. | no | python3 |
| pip3_executable_path | Specifies absolute path of pip3 executable, pip3 takes precedence over pip. | no | pip3 |
| python_executable_path | Specifies absolute path of python executable, python3 takes precedence over python. | no | python |
| pip_executable_path | Specifies absolute path of pip executable, pip3 takes precedence over pip. | no | pip |
| syft_executable_path | Specifies absolute path of syft executable. | no | syft |
| syft_config_path | Specifies absolute path to the syft configuration file. | no | "" |
| skopeo_executable_path | Specifies absolute path of skopeo executable. | no | skopeo |
| skopeo_config_path | Specifies absolute path to the authentication file used by 'skopeo inspect'. | no | "" |
| docker_executable_path | Specifies absolute path of docker executable. | no | docker |
| podman_executable_path | Specifies absolute path of podman executable. | no | podman |
| image_platform | Specifies platform used for multi-arch images. | no | "" |