Adding README and action.yml for external config files.

README.md

@@ -71,13 +71,22 @@ or by inlining these options in your workflow file.
 
 ### config-file
 
-A string representing the path to an external configuraton file. By
-default external configuration files are not used.
+A string representing the path to a configuraton file. The
+configuration file can be local to the repo, or can be a file in an
+external repo. If you are referencing a configuration file located in an
+external repository, you can use the
+`OWNER/REPOSITORY/FILENAME@BRANCH` syntax.
 
-**Possible values**: A string representing the absolute path to the
-configuration file.
+If the configuration file is located in an external private
+repository, use the [external-repository-token](#external-repository-token) parameter of the
+action to specify a token that has read access to the repository.
+
+**Possible values**: A string representing an absolute path to a file,
+  or a file located in another repository:
+
+**Example**: `config-file: ./.github/dependency-review-config.yml  # local file`.
+**Example**: `config-file: github/octorepo/dependency-review-config.yml@main  # external repo`
 
-**Example**: `config-file: ./.github/dependency-review-config.yml`.
 
 ### fail-on-severity
 
@@ -171,6 +180,18 @@ base-ref: 8bb8a58d6a4028b6c2e314d5caaf273f57644896
 head-ref: 69af5638bf660cf218aad5709a4c100e42a2f37b
 ```
 
+### external-repository-token
+
+A token for fetching external configuration files if they live in
+another repository.
+
+# TODO Add a guide on how to get the token
+
+**Possible values**: Any GitHub token with read access to the external repository.
+
+**Example**: `external-repository-token: ghp_123456789abcdef...`
+
+
 ### Configuration File
 
 You can use an external configuration file to specify the settings for

action.yml

@@ -32,6 +32,9 @@ inputs:
   allow-ghsas:
     description: Comma-separated list of allowed Github Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")
     required: false
+  external-repository-token:
+    description: A token for fetching external configuration files if they live in another repository.
+    required: false
 runs:
   using: 'node16'
   main: 'dist/index.js'