dirty-waters-action

This action runs Dirty Waters on your repository to analyze dependencies for Software Supply Chain (SSC) issues. Add this workflow to your repository to analyze dependencies in your pull requests (change/add inputs as needed -- details in action.yml). An example of a workflow that uses this action is available in example_workflow.yml.

The action will:

1. Run on commits that modify dependency files
2. Analyze dependencies for software supply chain smells
3. Post results:
   1. If in a PR, will post the report as a comment by default if CI fails
   2. Otherwise, results are available in the action logs; if CI fails, the report may also be posted as a comment in the commit, if enabled
4. Break CI if high severity issues are found, if enabled

As an important note, the first time you run this action, it will take quite some time! However, after the first run, subsequent ones should be fast.

SSC issues currently checked for:

• No source code links (or invalid ones) for a dependency
• Provided release tag/commit SHA not found in a dependency's repository
• Dependency being a fork of another package
• Deprecated dependency
• Dependency without build attestation
• Dependency without code signature (or an invalid one)
• Aliased dependencies

Inputs

| Input | Description | Required | Default | | --------------------- | -------------------------------------------------------------------------------------------------- | -------- | -------------------------- | | githubtoken | | Yes | - | | projectrepo | Repository name (owner/repo) | No | {{ github.repository }} | | versionold | Base version/ref to analyze, | No | - | | versionnew | New version/ref for diff analysis | No | - | | differentialanalysis | Whether to perform differential analysis (true/false) | No | false | | packagemanager | Package manager (npm, yarn-classic, yarn-berry, pnpm, maven) | Yes | - | | namematch | Compare the package names with the name in the in the package.json file. Will slow down execution. | No | false | | specifiedsmells | Specify the smells to check for | No | all | | debug | Enable debug mode | No | false | | config | Path to the configuration file, relative to your project's root | No | - | | gradualreport | Enable gradual report functionality | No | true | | failonhighseverity | Fail CI on high severity issues | No | true | | xtofail | Percentage threshold to break CI on high or medium severity issues (per type of issue) | No | 5% of packages | | allowprcomment | Post analysis results as a PR comment if CI breaks | No | true | | commentoncommit | Post analysis results as a commit comment if CI breaks | No | false | | githubeventbefore | GitHub event before SHA, to retrieve the previous cache key | No | ${{ github.event.before }} | | ignore_cache | Ignore the repository cache for this run (true/false) | No | false |