action.yml

# ______ _           _                    ___              _                ____________
# | ___ \ |         | |                  / _ \            | |               | ___ \ ___ \
# | |_/ / |__  _   _| |_   _ _ __ ___   / /_\ \_ __   __ _| |_   _ _______  | |_/ / |_/ /
# |  __/| '_ \| | | | | | | | '_ ` _ \  |  _  | '_ \ / _` | | | | |_  / _ \ |  __/|    /
# | |   | | | | |_| | | |_| | | | | | | | | | | | | | (_| | | |_| |/ /  __/ | |   | |\ \
# \_|   |_| |_|\__, |_|\__,_|_| |_| |_| \_| |_/_| |_|\__,_|_|\__, /___\___| \_|   \_| \_|
#               __/ |                                         __/ |
#              |___/                                         |___/
---
name: Phylum Analyze PR
author: Phylum, Inc. <engineering@phylum.io>
description: Scan dependencies with Phylum to block software supply chain attacks
branding:
  icon:  check-circle
  color: blue
inputs:
  github_token:
    description: GITHUB_TOKEN with at least write access to pull-requests scope or a repo scoped PAT
    required: true
    default: ${{ github.token }}
  phylum_token:
    description: Phylum token
    required: true
  cmd:
    description: The phylum-ci command line to pass to the Docker container's entrypoint
    required: true
    default: phylum-ci -vv
runs:
  using: docker
  image: docker://ghcr.io/phylum-dev/phylum-ci:latest
  entrypoint: entrypoint.sh
  env:
    GITHUB_TOKEN: ${{ inputs.github_token }}
    PHYLUM_API_KEY: ${{ inputs.phylum_token }}
  args:
    - ${{ inputs.cmd }}