{"id":51646672,"url":"https://github.com/roman-pinchuk/dependency-security-matrix-action","last_synced_at":"2026-07-13T23:32:44.581Z","repository":{"id":370718536,"uuid":"1296465842","full_name":"roman-pinchuk/dependency-security-matrix-action","owner":"roman-pinchuk","description":"Generate README dependency matrices with optional scanner-backed security status.","archived":false,"fork":false,"pushed_at":"2026-07-10T12:45:20.000Z","size":542,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-10T14:12:36.477Z","etag":null,"topics":["dependencies","github-action","npm","readme","security","snyk"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/roman-pinchuk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-10T12:14:27.000Z","updated_at":"2026-07-10T12:45:37.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/roman-pinchuk/dependency-security-matrix-action","commit_stats":null,"previous_names":["roman-pinchuk/dependency-security-matrix-action"],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/roman-pinchuk/dependency-security-matrix-action","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/roman-pinchuk%2Fdependency-security-matrix-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/roman-pinchuk%2Fdependency-security-matrix-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/roman-pinchuk%2Fdependency-security-matrix-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/roman-pinchuk%2Fdependency-security-matrix-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/roman-pinchuk","download_url":"https://codeload.github.com/roman-pinchuk/dependency-security-matrix-action/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/roman-pinchuk%2Fdependency-security-matrix-action/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35440511,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-13T02:00:06.543Z","response_time":119,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dependencies","github-action","npm","readme","security","snyk"],"created_at":"2026-07-13T23:32:43.216Z","updated_at":"2026-07-13T23:32:44.571Z","avatar_url":"https://github.com/roman-pinchuk.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Dependency Security Matrix Action\n\n[![CI](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/ci.yml/badge.svg)](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/ci.yml)\n[![Check dist](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/check-dist.yml/badge.svg)](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/check-dist.yml)\n[![Integration](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/integration.yml/badge.svg)](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/integration.yml)\n[![Release](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/release.yml/badge.svg)](https://github.com/roman-pinchuk/dependency-security-matrix-action/actions/workflows/release.yml)\n\nGenerate a README dependency matrix from a package manifest, with optional scanner-backed security status.\n\nThe first supported scanner is Snyk. If the scanner report is missing or invalid, the action can still generate a dependency inventory table with current and latest npm versions.\n\n## Usage\n\nAdd markers to your README:\n\n```md\n\u003c!-- START_MATRIX_TABLE --\u003e\n\u003c!-- END_MATRIX_TABLE --\u003e\n```\n\nRun Snyk when a token is available, but let the matrix fall back when Snyk cannot produce a report:\n\n```yaml\nname: Dependency Security Matrix\n\non:\n  push:\n    branches: [main]\n  pull_request:\n  workflow_dispatch:\n\npermissions:\n  contents: write\n\njobs:\n  matrix:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v7\n\n      - uses: actions/setup-node@v6\n        with:\n          node-version: 22\n          cache: npm\n\n      - run: npm ci\n\n      - name: Run Snyk\n        continue-on-error: true\n        uses: snyk/actions/node@v1\n        env:\n          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}\n        with:\n          args: --dev --json --json-file-output=snyk-results.json\n\n      - name: Generate dependency security matrix\n        id: matrix\n        uses: roman-pinchuk/dependency-security-matrix-action@v1\n        with:\n          scanner: snyk\n          scanner-report: snyk-results.json\n          manifest: package.json\n          manifest-type: npm\n          readme: README.md\n\n      - name: Commit matrix update\n        if: github.event_name != 'pull_request' \u0026\u0026 steps.matrix.outputs.updated == 'true'\n        run: |\n          git config user.name \"github-actions[bot]\"\n          git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\"\n          git add README.md\n          git commit -m \"chore: update dependency security matrix\"\n          git push\n```\n\n## Generated Output\n\nWith scanner data:\n\n```md\n| Dependency | Type | Current Version | Security Status | Latest npm Version |\n| :--- | :--- | :--- | :--- | :--- |\n| **pino** | dependencies | `^10.0.0` | No known issues | `10.3.1` |\n| **typescript** | devDependencies | `^5.7.3` | 1 high | `5.9.3` |\n```\n\nWithout scanner data:\n\n```md\n| Dependency | Type | Current Version | Latest npm Version |\n| :--- | :--- | :--- | :--- |\n| **pino** | dependencies | `^10.0.0` | `10.3.1` |\n| **typescript** | devDependencies | `^5.7.3` | `5.9.3` |\n\n\u003e Security status unavailable because no scanner report was provided or parsed.\n```\n\n## Commit Behavior\n\nThis action only modifies the markdown file in the runner workspace. Commit and push behavior belongs in the calling workflow.\n\nMinimal commit step:\n\n```yaml\n- name: Commit Matrix Updates\n  if: github.event_name != 'pull_request' \u0026\u0026 steps.matrix.outputs.updated == 'true'\n  run: |\n    git config user.name \"github-actions[bot]\"\n    git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\"\n    git add README.md\n    git commit -m \"chore: update dependency security matrix\"\n    git push\n```\n\n## Fallback Behavior\n\nBy default, the action does not fail when `scanner-report` is missing or invalid. It warns and generates a table without the `Security Status` column.\n\nSet this when scanner data must be present:\n\n```yaml\nwith:\n  scanner-report-required: 'true'\n```\n\n## Inputs\n\n| Input | Default | Description |\n| :--- | :--- | :--- |\n| `scanner` | `snyk` | Security scanner report format. Currently supports `snyk`. |\n| `scanner-report` | empty | Path to scanner JSON report. |\n| `scanner-report-required` | `false` | Fail when scanner report is missing or invalid. |\n| `fallback-without-scanner` | `true` | Generate inventory table when scanner data is unavailable. |\n| `manifest` | `package.json` | Path to dependency manifest. |\n| `manifest-type` | `npm` | Manifest ecosystem. Currently supports `npm`. |\n| `readme` | `README.md` | Markdown file to update. |\n| `start-marker` | `\u003c!-- START_MATRIX_TABLE --\u003e` | Start marker for generated region. |\n| `end-marker` | `\u003c!-- END_MATRIX_TABLE --\u003e` | End marker for generated region. |\n| `include-dependencies` | `true` | Include `dependencies`. |\n| `include-dev-dependencies` | `true` | Include `devDependencies`. |\n| `include-latest-version` | `true` | Fetch latest versions from npm registry. |\n| `include-status-note` | `true` | Add a fallback note when security status is unavailable. |\n| `heading` | `## Dynamic Dependency \u0026 Security Matrix` | Generated table heading. |\n| `fail-on-missing-markers` | `true` | Fail if README markers are missing. |\n\n## Outputs\n\n| Output | Description |\n| :--- | :--- |\n| `updated` | Whether the markdown file changed. |\n| `dependency-count` | Number of dependencies rendered. |\n| `latest-version-count` | Number of latest versions resolved. |\n| `scanner-used` | Scanner adapter used, or `none`. |\n| `security-status-available` | Whether security status was included. |\n| `issue-count` | Total scanner findings included. |\n\n## Scope\n\nThis action updates markdown only. It does not run scanners, upload SARIF, commit files, or push branches. Keep those responsibilities in the calling workflow.\n\n## Versioning\n\nUse the moving major tag for compatible updates:\n\n```yaml\nuses: roman-pinchuk/dependency-security-matrix-action@v1\n```\n\nPin to a patch release when you need maximum repeatability:\n\n```yaml\nuses: roman-pinchuk/dependency-security-matrix-action@v1.0.3\n```\n\n## Development\n\n```bash\nnpm ci\nnpm run check\n```\n\nJavaScript actions execute the bundled file in `dist/`, so source changes must be followed by:\n\n```bash\nnpm run build\n```\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Froman-pinchuk%2Fdependency-security-matrix-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Froman-pinchuk%2Fdependency-security-matrix-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Froman-pinchuk%2Fdependency-security-matrix-action/lists"}