search

actions / dependency-review-action

A GitHub Action for detecting vulnerable dependencies and invalid licenses in your PRs
MIT License
558 stars 94 forks source link

Why is this not named `dependency-review` #780

Closed jasonkarns closed 3 weeks ago

jasonkarns commented 3 weeks ago

Is your feature request related to a problem? Please describe.

As a first party action under the actions/ org, this is inconsistent with the normal naming of actions.

This is extra annoying when following the security practice of pinning to a full commit sha, combined with yaml linting that complains about line length. Not to mention that the action name is the default user-visible name for the step when reading logs.

Describe the solution you'd like

This should be named actions/dependency-review or actions/review-dependencies. (Would prefer the latter since most actions are named as a verb since they are consumed as steps.)

Describe alternatives you've considered

Additional context

There are dozens of actions under the actions org and almost every single one does not have an -action suffix. (checkout, setup-node, setup-python, attest, labeler, deploy-pages etc). The only ones which do have -action suffix are template repositories that are not usable actions themselves.

jonjanego commented 3 weeks ago

Thanks for the feedback, but we do not have any plans to change the name of this action at this time.