action.yml

name: 'Dependency Audit Crawler'
description: 'Crawls Sourcegraph to find dependents and generates a UDG Graph + SPDX Snippets'
author: 'SupplyChainBot'
inputs:
  root_repo:
    description: 'The root repository to audit'
    required: true
    default: ${{ github.repository }}
  project_name:
    description: 'The short name of the project'
    required: true
  sourcegraph_token:
    description: 'Your Sourcegraph Access Token (optional if depth=0)'
    required: false
  github_token:
    description: 'GitHub token to pull deep repository metrics'
    required: true
    default: ${{ github.token }}
  email:
    description: 'Email for OpenAlex and CrossRef API polite pools'
    required: false
    default: 'audit-bot@example.com'
  max_depth:
    description: 'How deep to crawl the dependency tree (0 evaluates root node only)'
    required: false
    default: '1'
  include_forks:
    description: 'Set to true to search forks'
    required: false
    default: 'false'
  include_archived:
    description: 'Set to true to include archived repositories as dependents'
    required: false
    default: 'false'
  include_vendored:
    description: 'Set to true to count vendored/third-party copies as dependents'
    required: false
    default: 'false'
  search_delay:
    description: 'Seconds to wait before each Sourcegraph streaming search (throttle)'
    required: false
    default: '0'
  search_count:
    description: "Max matches Sourcegraph collects per node (integer or 'all')"
    required: false
    default: '5000'
  disable_idf:
    description: 'Set to true to disable IDF specificity gating of generic tokens'
    required: false
    default: 'false'
  idf_cap:
    description: 'Frequency-probe cap; tokens at/above this are treated as generic'
    required: false
    default: '300'
  declared_sources:
    description: "Comma-separated registries to corroborate against (e.g. 'spack'); opt-in"
    required: false
    default: ''
  output_file:
    description: 'The name of the generated JSON file'
    required: false
    default: 'dependency_graph.json'
  upload_artifact:
    description: 'If true, uploads the results as build artifacts'
    required: false
    default: 'false'
  artifact_name:
    description: 'The base name of the artifact to upload'
    required: false
    default: 'dependency-graph'
  separate_artifacts:
    description: 'If true, uploads the JSON and SPDX snippets as two separate ZIPs'
    required: false
    default: 'false'
  custom_search_string:
    description: 'A custom regex or string to search for'
    required: false
  custom_filename:
    description: 'Limit search to this filename'
    required: false
  academic_keywords:
    description: 'Comma separated list of unique keywords to search in full-text publications (e.g. "dyninst")'
    required: false
  use_defaults:
    description: 'If false, disables standard C++ header/pragma searching'
    required: false
    default: 'true'
  verbose:
    description: 'Enable verbose JSON logging'
    required: false
    default: 'false'

runs:
  using: "composite"
  steps:
    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'

    - name: Install Dependencies
      shell: bash
      run: pip install requests argparse

    - name: Run Audit Script
      shell: bash
      run: |
        CMD="python ${{ github.action_path }}/audit_dependents.py \
          --repo '${{ inputs.root_repo }}' \
          --name '${{ inputs.project_name }}' \
          --depth ${{ inputs.max_depth }} \
          --out '${{ inputs.output_file }}' \
          --gh-token '${{ inputs.github_token }}' \
          --email '${{ inputs.email }}'"
        
        if [ -n "${{ inputs.sourcegraph_token }}" ]; then
          CMD="$CMD --sg-token '${{ inputs.sourcegraph_token }}'"
        fi
        if [ "${{ inputs.include_forks }}" == "true" ]; then
          CMD="$CMD --forks"
        fi
        if [ "${{ inputs.include_archived }}" == "true" ]; then
          CMD="$CMD --include-archived"
        fi
        if [ "${{ inputs.include_vendored }}" == "true" ]; then
          CMD="$CMD --include-vendored"
        fi
        if [ -n "${{ inputs.search_delay }}" ]; then
          CMD="$CMD --sg-delay '${{ inputs.search_delay }}'"
        fi
        if [ -n "${{ inputs.search_count }}" ]; then
          CMD="$CMD --sg-count '${{ inputs.search_count }}'"
        fi
        if [ "${{ inputs.disable_idf }}" == "true" ]; then
          CMD="$CMD --no-idf"
        fi
        if [ -n "${{ inputs.idf_cap }}" ]; then
          CMD="$CMD --idf-cap '${{ inputs.idf_cap }}'"
        fi
        if [ -n "${{ inputs.declared_sources }}" ]; then
          CMD="$CMD --declared-sources '${{ inputs.declared_sources }}'"
        fi
        if [ -n "${{ inputs.custom_search_string }}" ]; then
           CMD="$CMD --custom-string '${{ inputs.custom_search_string }}'"
        fi
        if [ -n "${{ inputs.custom_filename }}" ]; then
           CMD="$CMD --custom-file '${{ inputs.custom_filename }}'"
        fi
        if [ -n "${{ inputs.academic_keywords }}" ]; then
           CMD="$CMD --academic-keyword '${{ inputs.academic_keywords }}'"
        fi
        if [ "${{ inputs.use_defaults }}" == "false" ]; then
           CMD="$CMD --no-defaults"
        fi
        if [ "${{ inputs.verbose }}" == "true" ]; then
           CMD="$CMD --verbose"
        fi
        
        eval $CMD

    - name: Upload Combined Artifact
      if: inputs.upload_artifact == 'true' && inputs.separate_artifacts == 'false'
      uses: actions/upload-artifact@v4
      with:
        name: ${{ inputs.artifact_name }}
        path: |
          ${{ inputs.output_file }}
          spdx_snippets/

    - name: Upload JSON Graph (Separated)
      if: inputs.upload_artifact == 'true' && inputs.separate_artifacts == 'true'
      uses: actions/upload-artifact@v4
      with:
        name: ${{ inputs.artifact_name }}-json
        path: ${{ inputs.output_file }}

    - name: Upload SPDX Snippets (Separated)
      if: inputs.upload_artifact == 'true' && inputs.separate_artifacts == 'true'
      uses: actions/upload-artifact@v4
      with:
        name: ${{ inputs.artifact_name }}-spdx
        path: spdx_snippets/