safedep/SafeDep
Protect against vulnerable and malicious Open Source Software (OSS) dependencies using policy as code based guardrails.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| policy | Path to policy file, default policy will be used when not given policy or policy-v2 | no | — |
| policy-v2 | Path to policy-v2 file | no | — |
| cloud | Synchronize configuration, policy and report with SafeDep cloud | no | false |
| cloud-key | API key to use for synchronizing report with SafeDep cloud | no | — |
| cloud-tenant | Tenant ID to use for synchronizing report with SafeDep cloud | no | — |
| version | vet version to use for the scan. Defaults to using latest release | no | — |
| exception-file | Path to exception file | no | — |
| exclude | Comma separated list path patterns to exclude from the scan | no | — |
| trusted-registries | Comma separated list of trusted registry base URLs | no | — |
| timeout | Timeout in seconds for vet to wait for external service results to be available. For malicious package analysis, this set the maximum time to wait for the analysis results to be available. | no | 300 |
| upload-sarif | Upload SARIF report as an artifact associated with the workflow run. This is used only during full scan on push or schedule. | no | true |
| add-step-summary | Add a summary of the vet scan as a step in the workflow run. This is used only during full scan on push or schedule. | no | true |
| paranoid | Enable paranoid mode to fail PR workflow on any risk. | no | false |
| enable-comments-proxy | Enable Comments Proxy Server to create comments on GitHub PRs. This is required when the action is invoked in a PR from a forked repository. | no | false |
Outputs
| name | description |
|---|---|
| report | Path to SARIF report for uploading to Github Security tab |