telicent-oss/Merge Vex Action

This action merges together VEX statements using `vexctl` to produce a single merged VEX statements file that can been passed to security scanners that support OpenVEX statements.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
name	Specifies a name that will be used to prefix the various temporary files and directories used by this action.	yes	—
remote-vex	Specifies a new line separated list of remote repositories whose VEX statements should be retrieved via sparse checkout of their `.vex/` directory. These VEX statements will be used to augment any local VEX statements in the `.vex/` directory when scanning for vulnerabilities.	no	""
gh-token	A GitHub Token needed to checkout the `remote-vex` repositories (if any) Defaults to `github.token` which is the token for this build, can be overridden if this default token doesn't work for your build environment.	no	${{ github.token }}
gh-user	A GitHub User to use when cloning remote repositories to retrieve remote VEX statements. Defaults to `github.actor` which is the user running the build, can be overridden if this default user does not match the user who owns the `gh-token` input e.g. if providing a custom GitHub Token to retrieve VEX statements from private repositories.	no	${{ github.actor }}

Outputs

name	description
prepared	A boolean value indicating whether any VEX statements were found and merged.
vex-file	The full path to the resulting merged VEX file, will be empty if no VEX statements were found to merge. If present this will be located under the `RUNNER_TEMP` directory to avoid polluting your workspace.
vex-file-name	The filename of the merged VEX file as included in the uploaded artifact. If you download the artifact then this is the filename to use to access the file.
vex-artifact	The name of a GitHub Actions artifact that has been uploaded with the merged VEX statements.