Vulnetix/cli/license action

The Vulnetix/cli/license GitHub Action: inputs, outputs, permissions and a complete workflow with artifact upload and attestation.

Installs the CLI and runs vulnetix license on path, evaluating dependency licences against the licence policy. It writes .vulnetix/license.sarif.

steps:
  - uses: actions/checkout@v5
  - uses: Vulnetix/cli/license@v4
    with:
      org-id: ${{ secrets.VULNETIX_ORG_ID }}
      api-key: ${{ secrets.VULNETIX_API_KEY }}

Runs vulnetix license --path <path>. Credentials are optional: without org-id and a credential the CLI runs in community mode. They reach the CLI only as environment variables; see Credentials.

Inputs

Input	Description	Default
`version`	Release of the Vulnetix CLI to install: an exact tag (v4.0.0), a major channel (v4, the newest v4 release) or latest	`v4`
`binary-path`	Path to an already-built vulnetix binary to use instead of downloading a release	-
`org-id`	Vulnetix organization ID (UUID), used with api-key. Optional: without credentials the CLI runs in community mode	-
`api-key`	Vulnetix API key. Passed to the CLI as VULNETIX_API_KEY, never on the command line	-
`api-token`	Vulnetix API token; the server resolves the organization. Passed as VULNETIX_API_TOKEN	-
`path`	Directory to scan	`.`
`args`	Extra arguments for the command, separated by spaces or newlines (no shell quoting is applied)	-
`artifact-name`	Upload every file the command wrote as a workflow artifact with this name	-
`fail-on-findings`	Fail the step when the command exits non-zero (findings over a gate, a breach, an error): true or false. The artifact, attestation and publish steps run either way	`true`
`github-code-scanning`	Upload SARIF to GitHub code scanning (needs security-events: write): true or false	`false`
`github-token`	Token for GitHub publishing, release assets and pull request comments	`${{ github.token }}`
`attest`	Attest the written files with GitHub artifact attestations (needs id-token: write and attestations: write): true or false	`false`
`release-tag`	Attach every file the command wrote to the GitHub release with this tag (needs contents: write)	-

args is split on spaces and newlines. No shell quoting is applied, and nothing is evaluated.

Outputs

Output	Description
`files`	Every file the command wrote, one per line
`sarif`	The SARIF files it wrote, one per line
`sbom`	The CycloneDX SBOM it wrote, if any
`manifest`	The artifact manifest (JSON Lines) listing what it wrote
`exit-code`	The command’s exit code
`result`	success or failure
`summary`	One line saying what ran and how it ended

Permissions

contents: read to check out the repository
security-events: write with github-code-scanning: true (plus actions: read on private repositories)
id-token: write and attestations: write with attest: true
contents: write with release-tag

Example workflow

name: Vulnetix licences
on:
  push:
    branches: [main]
  pull_request:
jobs:
  license:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read            # private repository
      id-token: write
      attestations: write
    steps:
      - uses: actions/checkout@v5
      - uses: Vulnetix/cli/license@v4
        with:
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}
          github-code-scanning: true
          artifact-name: vulnetix-license
          attest: true

artifact-name uploads every file the command wrote as one workflow artifact. attest: true attests those files with GitHub artifact attestations.

Behaviour

license does not publish to GitHub itself. With github-code-scanning: true the action runs vulnetix gha publish code-scanning after the command, with the SARIF files the command recorded in its artifact manifest. A failed publish is a warning, never a failure.
license.sarif is written even when every licence passes, so the next upload closes alerts that were fixed. The category is vulnetix/license/. A result sits on the manifest line that declares the package.
The policy and exceptions are read from .vulnetix/license-policy.yaml and .vulnetix/license-exceptions.yaml. See Platform IaC files.
files lists the paths of everything the command wrote, one per line. sarif and sbom narrow that to the SARIF files and the CycloneDX SBOM.

Upload and attest in your own steps

The built-in artifact-name and attest inputs are the short form. To control those steps yourself, use the outputs. The action’s last step fails the job with the command’s exit code, so later steps need if: ${{ !cancelled() }}; the example turns the failure off and re-raises it at the end.

      - uses: Vulnetix/cli/license@v4
        id: vulnetix
        with:
          org-id: ${{ secrets.VULNETIX_ORG_ID }}
          api-key: ${{ secrets.VULNETIX_API_KEY }}
          fail-on-findings: false
      - uses: actions/upload-artifact@v7
        if: ${{ !cancelled() }}
        with:
          name: vulnetix-license
          path: ${{ steps.vulnetix.outputs.files }}
          include-hidden-files: true
      - uses: actions/attest-build-provenance@v4
        if: ${{ !cancelled() }}
        with:
          subject-path: ${{ steps.vulnetix.outputs.files }}
      - name: Fail on the command's exit code
        if: ${{ steps.vulnetix.outputs.exit-code != '0' }}
        env:
          EXIT_CODE: ${{ steps.vulnetix.outputs.exit-code }}
        run: exit "$EXIT_CODE"

Verify an attestation made this way with gh attestation verify <file> --repo <owner>/<repo>.