step-security/Fetch Metadata from Dependabot PRs
Extract information from about the dependency being updated by a Dependabot-generated PR
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| alert-lookup | If true, then populate the `alert-state`, `ghsa-id` and `cvss` outputs | — | — |
| compat-lookup | If true, then populate the `compatibility-score` output | — | — |
| github-token | The GITHUB_TOKEN secret | — | ${{ github.token }} |
| skip-commit-verification | If true, the action will not expect Dependabot commits to be verified. This should be set as `true` in GHES environments | — | false |
| skip-verification | If true, the action will not validate the user or the commit verification status | — | false |
Outputs
| name | description |
|---|---|
| dependency-names | A comma-separated list of all package names updated. |
| dependency-type | The type of dependency has determined this PR to be, e.g. "direct:production". |
| update-type | The highest semver change being made by this PR, e.g. "version-update:semver-major" |
| updated-dependencies-json | A JSON string containing the full information about each updated Dependency. |
| directory | The `directory` configuration that was used by dependabot for this updated Dependency. |
| package-ecosystem | The `package-ecosystem` configuration that was used by dependabot for this updated Dependency. |
| target-branch | The `target-branch` configuration that was used by dependabot for this updated Dependency. |
| previous-version | The version that this PR updates the dependency from. |
| new-version | The version that this PR updates the dependency to. |
| alert-state | If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the current state of that alert (OPEN, FIXED or DISMISSED). |
| ghsa-id | If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the GHSA-ID of that alert. |
| cvss | If this PR is associated with a security alert and `alert-lookup` is `true`, this contains the CVSS value of that alert (otherwise it contains 0). |
| compatibility-score | If this PR has a known compatibility score and `compat-lookup` is `true`, this contains the compatibility score (otherwise it contains 0). |
| maintainer-changes | Whether or not the the body of this PR contains the phrase "Maintainer changes" which is an indicator of whether or not any maintainers have changed. |
| dependency-group | The dependency group that the PR is associated with (otherwise it is an empty string). |