actionsx

Documentation

Overview

Package actionsx extracts GitHub Actions dependencies from workflow and action manifests.

It inventories:

• Step-level uses statements in .github/workflows/*.yml|yaml
• Job-level reusable workflow uses statements
• Local composite actions referenced via uses: ./path (recursively)
• Local reusable workflows referenced via jobs.<id>.uses: ./...yml
• Self-repository references (uses: $/path), resolved repo-root-relative
• Docker actions referenced via docker://... and runs.image docker://...

The extractor is offline and performs no network fetches; remote actions are represented as packages with PURL type "github" so downstream enrichment can query OSV and licenses.

Index

• Constants
• func New() filesystem.Extractor
• type Extractor
  • func (Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (inventory.Inventory, error)
  • func (Extractor) FileRequired(api filesystem.FileAPI) bool
  • func (Extractor) Name() string
  • func (Extractor) Requirements() *plugin.Capabilities
  • func (Extractor) Version() int
• type UsesMetadata
  • func (*UsesMetadata) IsProtoable()

Constants

const (
	// Name is the internal plugin identifier.
	Name = "github/actions"
)

Functions

func New

func New() filesystem.Extractor

New returns a new GitHub Actions extractor.

Types

type Extractor

type Extractor struct{}

Extractor implements an OSV-Scalibr filesystem extractor for GitHub Actions.

func (Extractor) Extract

func (Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (inventory.Inventory, error)

Extract parses a workflow YAML and returns discovered action dependencies.

func (Extractor) FileRequired

func (Extractor) FileRequired(api filesystem.FileAPI) bool

FileRequired limits extraction to workflow YAML files.

func (Extractor) Name

func (Extractor) Name() string

Name returns the plugin name as understood by Deputy.

func (Extractor) Requirements

func (Extractor) Requirements() *plugin.Capabilities

Requirements declares required capabilities; GitHub Actions scanning is filesystem-only.

func (Extractor) Version

func (Extractor) Version() int

Version returns the plugin version; Deputy uses 0 for internal plugins.

type UsesMetadata

type UsesMetadata struct {
	Raw     string
	Subpath string
}

UsesMetadata captures raw uses strings and any subpath.

func (*UsesMetadata) IsProtoable

func (*UsesMetadata) IsProtoable()

IsProtoable marks UsesMetadata as OSV-SCALIBR package metadata. Deputy attaches it to an extractor.Package but never converts it to a proto message, so the marker only satisfies the upstream metadata.Protoable interface.