DependencyReviewActionInputs0.0.7

Token for the repository. Can be passed in using {{ secrets.GITHUB_TOKEN }}.

Don't block PRs below this severity. Possible values are low, moderate, high, critical.

Dependency scopes to block PRs on. Comma-separated list. Possible values are 'unknown', 'runtime', and 'development' (e.g. "runtime, development")

The base git ref to be used for this check. Has a default value when the workflow event is pull_request or pull_request_target. Must be provided otherwise.

The head git ref to be used for this check. Has a default value when the workflow event is pull_request or pull_request_target. Must be provided otherwise.

A path to the configuration file for the action.

Comma-separated list of allowed licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")

Comma-separated list of forbidden licenses (e.g. "MIT, GPL 3.0, BSD 2 Clause")

Comma-separated list of dependencies in purl format (e.g. "pkg:npm/express, pkg:pypi/pycrypto"). These dependencies will be permitted to use any license, no matter what license policy...

Comma-separated list of allowed GitHub Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")

A token for fetching external configuration file if it lives in another repository. It is required if the repository is private

A boolean to determine if license checks should be performed

A boolean to determine if vulnerability checks should be performed

Determines if the summary is posted as a comment in the PR itself. Setting this to always or on-failure requires you to give the workflow the write permissions for pull-requests

A comma-separated list of package URLs to deny (e.g. "pkg:npm/express, pkg:pypi/pycrypto"). If version specified, only deny matching packages and version; else, deny all regardless of...

A comma-separated list of package URLs for group(s)/namespace(s) to deny (e.g. "pkg:npm/express/, pkg:pypi/pycrypto/"). Please note that the group name must be followed by a /.

Whether to retry on snapshot warnings

Number of seconds to wait before stopping snapshot retries.

When set to true this action will always complete with success, overriding the fail-on-severity parameter.

Show a summary of the OpenSSF Scorecard scores.

Numeric threshold for the OpenSSF Scorecard score. If the score is below this threshold, the action will warn you.