From 74c047086c83fb1b8464fce772ec6e3d9753ef62 Mon Sep 17 00:00:00 2001
From: Federico Builes <febuiles@github.com>
Date: Fri, 21 Oct 2022 17:34:20 +0200
Subject: [PATCH] Adding README and action.yml for external config files.

---
 README.md  | 31 ++++++++++++++++++++++++++-----
 action.yml |  3 +++
 2 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 2cb2fc3..f632d21 100644
--- a/README.md
+++ b/README.md
@@ -71,13 +71,22 @@ or by inlining these options in your workflow file.
 
 ### config-file
 
-A string representing the path to an external configuraton file. By
-default external configuration files are not used.
+A string representing the path to a configuraton file. The
+configuration file can be local to the repo, or can be a file in an
+external repo. If you are referencing a configuration file located in an
+external repository, you can use the
+`OWNER/REPOSITORY/FILENAME@BRANCH` syntax.
 
-**Possible values**: A string representing the absolute path to the
-configuration file.
+If the configuration file is located in an external private
+repository, use the [external-repository-token](#external-repository-token) parameter of the
+action to specify a token that has read access to the repository.
+
+**Possible values**: A string representing an absolute path to a file,
+  or a file located in another repository:
+
+**Example**: `config-file: ./.github/dependency-review-config.yml  # local file`.
+**Example**: `config-file: github/octorepo/dependency-review-config.yml@main  # external repo`
 
-**Example**: `config-file: ./.github/dependency-review-config.yml`.
 
 ### fail-on-severity
 
@@ -171,6 +180,18 @@ base-ref: 8bb8a58d6a4028b6c2e314d5caaf273f57644896
 head-ref: 69af5638bf660cf218aad5709a4c100e42a2f37b
 ```
 
+### external-repository-token
+
+A token for fetching external configuration files if they live in
+another repository.
+
+# TODO Add a guide on how to get the token
+
+**Possible values**: Any GitHub token with read access to the external repository.
+
+**Example**: `external-repository-token: ghp_123456789abcdef...`
+
+
 ### Configuration File
 
 You can use an external configuration file to specify the settings for
diff --git a/action.yml b/action.yml
index cc5f080..57386af 100644
--- a/action.yml
+++ b/action.yml
@@ -32,6 +32,9 @@ inputs:
   allow-ghsas:
     description: Comma-separated list of allowed Github Advisory IDs (e.g. "GHSA-abcd-1234-5679, GHSA-efgh-1234-5679")
     required: false
+  external-repository-token:
+    description: A token for fetching external configuration files if they live in another repository.
+    required: false
 runs:
   using: 'node16'
   main: 'dist/index.js'