name: npmscan Dependency Check
description: Scans package.json / lockfile changes in a pull request with npmscan.com and flags vulnerable or risky packages.
author: npmscan
branding:
  icon: search
  color: red

inputs:
  file:
    description: Dependency file to diff (package.json, package-lock.json, npm-shrinkwrap.json, yarn.lock or pnpm-lock.yaml), relative to the repository root
    default: package-lock.json
  files:
    description: Several dependency files to diff, one per line or comma-separated (e.g. for monorepos). Overrides `file` when set.
    default: ''
  mode:
    description: "`block` fails the check on findings that meet the fail-on-* thresholds; `warn` only reports them"
    default: block
  fail-on-severity:
    description: Lowest vulnerability severity that blocks — low, moderate, high, critical, or none to never block on vulnerabilities. Known malware blocks regardless.
    default: low
  fail-on-install-script:
    description: Block when a dependency gains a preinstall/install/postinstall script, a new dependency has one, or a root lifecycle script (preinstall/install/postinstall/prepare) is added or changed
    default: 'true'
  fail-on-source-change:
    description: Block when a lockfile entry's tarball URL or integrity hash changes, its tarball is a different package or version than declared, or an override/resolution is added or changed
    default: 'true'
  fail-on-error:
    description: Fail the check when the scan itself cannot run (npmscan API unreachable, file too large). When false, errors are reported as warnings.
    default: 'false'
  fail-on-flagged:
    description: "Deprecated — use `mode`. Setting this to false is the same as `mode: warn`."
    default: 'true'
  github-token:
    description: Token used to post the PR comment
    default: ${{ github.token }}

outputs:
  flagged-count:
    description: Number of findings npmscan flagged across all scanned files (empty if nothing was scanned)
    value: ${{ steps.scan.outputs.flagged-count }}
  blocking-count:
    description: "Number of findings that meet the fail-on-* thresholds (they fail the check in `mode: block`)"
    value: ${{ steps.scan.outputs.blocking-count }}
  error-count:
    description: Number of files that could not be scanned
    value: ${{ steps.scan.outputs.error-count }}

runs:
  using: composite
  steps:
    - id: scan
      shell: bash
      env:
        INPUT_FILE: ${{ inputs.file }}
        INPUT_FILES: ${{ inputs.files }}
        INPUT_MODE: ${{ inputs.mode }}
        INPUT_FAIL_ON_SEVERITY: ${{ inputs.fail-on-severity }}
        INPUT_FAIL_ON_INSTALL_SCRIPT: ${{ inputs.fail-on-install-script }}
        INPUT_FAIL_ON_SOURCE_CHANGE: ${{ inputs.fail-on-source-change }}
        INPUT_FAIL_ON_ERROR: ${{ inputs.fail-on-error }}
        INPUT_FAIL_ON_FLAGGED: ${{ inputs.fail-on-flagged }}
        GH_TOKEN: ${{ inputs.github-token }}
        PR: ${{ github.event.pull_request.number }}
        BASE_SHA: ${{ github.event.pull_request.base.sha }}
        HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
        PR_AUTHOR: ${{ github.event.pull_request.user.login }}
      run: bash "$GITHUB_ACTION_PATH/scripts/scan.sh"