name: Legitify Analyze
on:
workflow_dispatch:
schedule:
- cron: '0 11 * * 1-5'
jobs:
analyze:
runs-on: ubuntu-latest
steps:
- name: Legitify Action
uses: Legit-Labs/legitify@main
with:
github_token: ${{ secrets.PAT_FOR_LEGITIFY }}
ignore-policies: |
non_admins_can_create_public_repositories
requires_status_checks
Legitify Action
Strengthen the security of your GitHub repositories with automated analysis.
Legitify Analyze GitHub Action automates the process of analyzing your repositories for misconfigurations, security, and compliance issues. It helps identify and remediate issues across all GitHub assets with ease, improving the overall security posture of your source-code management.#
How to Provide GitHub Token
The github_token input is required to authenticate the action with GitHub. It should be a Personal Access Token (PAT) stored in your repository secrets.
with:
github_token: ${{ secrets.PAT_FOR_LEGITIFY }}
How to Analyze Only the Current Repository
The analyze_self_only input, when set to true, limits the analysis to the repository from which the action is triggered.
with:
analyze_self_only: true
How to Specify Repositories for Analysis
The repositories input allows you to specify a comma-separated list of repositories (in owner/repo format) to be analyzed. If left empty, all accessible repositories will be analyzed.
with:
repositories: owner/repo1,owner/repo2
How to Set Legitify Base Version
The legitify_base_version input sets the base version of Legitify to use. Non-breaking changes will be auto-updated.
with:
legitify_base_version: 1.0
How to Enable Scorecard Analysis
The scorecard input allows you to enable the Scorecard tool as part of the Legitify analysis. Possible values are no, yes, or verbose.
with:
scorecard: yes
How to Upload Results to GitHub Code Scanning
The upload_code_scanning input determines whether the results of the analysis should be uploaded to GitHub Code Scanning. The default is true.
with:
upload_code_scanning: true
How to Compile Legitify from Source
The compile_legitify input, when set to true, compiles Legitify from source using the specified legitify_base_version.
with:
compile_legitify: true
How to Set Artifact Name for Private Repositories
The artifact_name input defines the name of the artifact under which the analysis report will be saved if the repository is private.
with:
artifact_name: legitify-report
How to Ignore Specific Policies
The ignore-policies input allows you to specify a list of policies (one per line) to ignore during the analysis.
with:
ignore-policies: |
non_admins_can_create_public_repositories
requires_status_checks
How to Pass Extra Arguments to Legitify
The extra input provides additional command-line arguments for Legitify that are not covered by other inputs.
with:
extra: "--verbose"
