cisagov/action-lineage

Change the design of this Action to target a single (using) repository

Opened this issue · 0 comments

💡 Summary

Currently this Action has a workflow that runs this Action against our organization on a regularly basis. This is in line with the Action's current design to scan based on a provided query. This issue proposes changing the functionality of this Action to instead be used in a workflow in individual repositories that will scan on their own schedule.

Motivation and context

This change would align this project with the general way that GitHub Actions are used. It would also provide more configuration in downstream repositories and would simplify the logic of this project.

Implementation notes

Important design consideration (in my mind):

  • Use the default Actions permissions by default, but allow configuration to provide specific credentials if desired.
  • Use the calling repository by default, but allow this to be overridden with a provided value. This would allow a public repository to host a workflow that would update a private repository which is functionality provided by the current implementation. This ties into the above point for allowing external runs to access other repositories.

Acceptance criteria

  • The project is redesigned to run as an Action called from a workflow in individual repositories.