38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
name: Dependency Guard
|
|
description: Verify npm dependencies before allowing lifecycle scripts
|
|
inputs:
|
|
path:
|
|
description: Path to the npm project
|
|
required: false
|
|
default: .
|
|
policy:
|
|
description: Path to the dependency-guard policy JSON
|
|
required: false
|
|
default: ""
|
|
report:
|
|
description: Path for the JSON evidence report
|
|
required: false
|
|
default: dependency-guard-report.json
|
|
skip-install:
|
|
description: Skip npm ci and npm audit commands
|
|
required: false
|
|
default: "false"
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Check Node.js version
|
|
shell: bash
|
|
run: node -e 'const major=Number(process.versions.node.split(".")[0]); if(major<20) throw new Error("dependency-guard requires Node.js 20 or newer")'
|
|
- name: Verify dependencies
|
|
shell: bash
|
|
env:
|
|
INPUT_PATH: ${{ inputs.path }}
|
|
INPUT_POLICY: ${{ inputs.policy }}
|
|
INPUT_REPORT: ${{ inputs.report }}
|
|
INPUT_SKIP_INSTALL: ${{ inputs.skip-install }}
|
|
run: |
|
|
args=(check --path "$INPUT_PATH" --report "$INPUT_REPORT")
|
|
if [[ -n "$INPUT_POLICY" ]]; then args+=(--policy "$INPUT_POLICY"); fi
|
|
if [[ "$INPUT_SKIP_INSTALL" == "true" ]]; then args+=(--skip-install); fi
|
|
node "$GITHUB_ACTION_PATH/bin/dependency-guard.js" "${args[@]}"
|