pkgdiet/action.yml at main · om-tajne/pkgdiet · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: 'PkgDiet'
description: 'Dependency safety gate — ALLOW/WARN/BLOCK verdict on every new npm package added in a PR. Works with Claude, Cursor, Copilot, and all MCP agents.'
author: 'om-tajne'

branding:
  icon: 'shield'
  color: 'green'

inputs:
  base:
    description: 'Git ref to compare against'
    required: false
    default: 'HEAD~1'
  environment:
    description: 'Policy environment: ci | dev | prod'
    required: false
    default: 'ci'
  fail-on:
    description: 'Failure threshold: BLOCK or WARN'
    required: false
    default: 'BLOCK'
  dry-run:
    description: 'Print results without failing (true/false)'
    required: false
    default: 'false'
  working-directory:
    description: 'Subdirectory containing package.json'
    required: false
    default: '.'
  version:
    description: 'PkgDiet version to use'
    required: false
    default: '2.0.1'
  node-version:
    description: 'Node.js version'
    required: false
    default: '20'
  sarif-file:
    description: 'Optional path for a SARIF findings report'
    required: false
    default: ''

outputs:
  verdict:
    description: 'Overall verdict: PASS or FAIL'
    value: ${{ steps.pkgdiet.outputs.verdict }}
  summary:
    description: 'Human-readable results summary'
    value: ${{ steps.pkgdiet.outputs.summary }}
  sarif:
    description: 'SARIF report path when sarif-file is configured'
    value: ${{ steps.pkgdiet.outputs.sarif }}

runs:
  using: composite
  steps:
    - name: Set up Node.js
      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
      with:
        node-version: ${{ inputs.node-version }}

    - name: Run PkgDiet
      id: pkgdiet
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      env:
        PKGDIET_CI: 'true'
      run: |
        set +e
        ARGS=(ci --env "${{ inputs.environment }}" --base "${{ inputs.base }}")
        [ "${{ inputs.fail-on }}" = "WARN" ] && ARGS+=(--fail-on WARN)
        [ -n "${{ inputs.sarif-file }}" ] && ARGS+=(--sarif "${{ inputs.sarif-file }}")
        [ "${{ inputs.dry-run }}" = "true" ] && ARGS+=(--dry-run)
        npx -y "pkgdiet@${{ inputs.version }}" "${ARGS[@]}"
        CODE=$?
        [ $CODE -eq 0 ] && echo "verdict=PASS" >> $GITHUB_OUTPUT || echo "verdict=FAIL" >> $GITHUB_OUTPUT
        [ $CODE -eq 0 ] && echo "summary=All dependency checks passed." >> $GITHUB_OUTPUT || echo "summary=One or more dependencies failed the policy check." >> $GITHUB_OUTPUT
        echo "sarif=${{ inputs.sarif-file }}" >> $GITHUB_OUTPUT
        exit $CODE