Bump minimatch

Bumps  and [minimatch](https://github.com/isaacs/minimatch). These dependencies needed to be updated together.

Updates `minimatch` from 3.1.2 to 3.1.5
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5)

Updates `minimatch` from 5.1.6 to 5.1.9
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 3.1.5
  dependency-type: indirect
- dependency-name: minimatch
  dependency-version: 5.1.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

.github/workflows/codeql.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript-typescript' ]
+        language: [ 'javascript-typescript', 'actions', 'go' ]
 
     steps:
     - name: Checkout repository

.github/workflows/go-dependency-submission.yml

@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
-      - uses: actions/setup-go@v3
+      - uses: actions/setup-go@v5
         with:
           go-version: ">=1.18.0"
 

.github/workflows/test.yml

@@ -8,7 +8,10 @@ on: # rebuild any PRs and main branch changes
     branches:
       - main
       - 'releases/*'
-
+      
+permissions:
+  contents: read
+  
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -28,5 +31,10 @@ jobs:
         run: npm rebuild && npm run all
 
       - name: Verify no uncommitted files
-        run: '[ -z "$(git status --porcelain=v1 2>/dev/null)" ]'
+        run: |
+          if [ -n "$(git status --porcelain=v1 2>/dev/null)" ]; then
+            echo "There are uncommitted changes!"
+            git status --porcelain=v1
+            exit 1
+          fi
         shell: bash

README.md

@@ -1,7 +1,7 @@
 # Go Dependency Submission
 
 This GitHub Action calculates dependencies for a Go build-target (a Go file with a
-`main` function) and submits the list to the [Dependency submission API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api). Dependencies then appear in your repository's dependency graph, and you'll receive Dependabot alerts and updates for vulnerable or out-of-date dependencies. 
+`main` function) and submits the list to the [Dependency submission API](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api). Dependencies then appear in your repository's dependency graph, and you'll receive Dependabot alerts and updates for vulnerable or out-of-date dependencies.
 
 ### Running locally
 
@@ -53,3 +53,81 @@ jobs:
             # include Go dependencies used by tests and tooling.
             go-build-target: go-example/cmd/octocat.go
 ```
+
+### Accessing Private Go Modules
+
+This action will fail if your `go.mod` contains private Go modules.
+To access private Go modules the action requires an extra step to access your
+private module registry.
+
+See official Go documentation for more information at https://go.dev/doc/faq#git_https
+
+#### Accessing Private Go Modules Hosted on GitHub
+
+If your private Go modules are hosted on GitHub, there are various ways for the action to
+access them. You can use either HTTPS authentication with a Personal Access Token (PAT) or SSH authentication with deploy keys or SSH keys.
+
+#### Authentication Methods
+
+**HTTPS with Personal Access Token**: Uses a GitHub Personal Access Token to authenticate with private repositories. This method requires storing the token as a repository secret. See [Creating a personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) for setup instructions.
+
+**SSH Authentication**: Uses SSH keys or deploy keys for authentication. This method doesn't require storing tokens and can be more secure for some use cases. See the [GitHub documentation on SSH authentication](https://docs.github.com/en/authentication/connecting-to-github-with-ssh) for setup instructions.
+
+#### Additional Environment Variables
+
+- **`GONOPROXY`**: Set this to bypass the module proxy entirely for specific modules
+- **`GOSUMDB`**: Set to `off` or configure to skip checksum verification for private modules
+- **`GOPROXY`**: Can be set to `direct` to bypass proxies completely
+
+#### Example: HTTPS Authentication with Personal Access Token
+
+This example adds a step to the workflow which uses a GitHub
+[Personal Access Token (PAT)](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens)
+which has repo permissions. The PAT is saved as a repo [actions secret](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions) `GH_ACCESS_TOKEN`.
+
+The env variable `GOPRIVATE` has also been set so that the GitHub org `foo` is considered private.
+
+```yaml
+name: Go Dependency Submission
+on:
+  push:
+    branches:
+      - main
+
+# The API requires write permission on the repository to submit dependencies
+permissions:
+  contents: write
+
+# Environment variables to configure Go and Go modules. Customize as necessary
+env:
+  GOPROXY: 'https://proxy.golang.org,direct' # To add a private proxy, place it between the public golang proxy and direct
+  GOPRIVATE: 'github.com/foo/*' # repositories in organization foo are considered private
+
+jobs:
+  go-action-detection:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v3
+        with:
+          go-version: ">=1.18.0"
+
+      # Authentication step
+      - name: Authenticate with GitHub
+        run: git config --global url.https://${{ secrets.GH_ACCESS_TOKEN }}@github.com/.insteadOf https://github.com/
+
+      - name: Run snapshot action
+        uses: actions/go-dependency-submission@v2
+        with:
+            # Required: Define the repo path to the go.mod file used by the
+            # build target
+            go-mod-path: go-example/go.mod
+            #
+            # Optional: Define the path of a build target (a file with a
+            # `main()` function) If not defined, this Action will collect all
+            # dependencies used by all build targets for the module, which may
+            # include Go dependencies used by tests and tooling.
+            go-build-target: go-example/cmd/octocat.go
+```

action.yml

@@ -17,6 +17,34 @@ inputs:
     required: true
     description: 'Build target to detect build dependencies. If unspecified, will use "all", with will detect all dependencies used in all build targets (including tests and tools).'
     default: 'all'
+  snapshot-sha:
+    description: The SHA that the results will be linked to in the dependency snapshot
+    type: string
+    required: false
+    default: ''
+  snapshot-ref:
+    description: The ref that the results will be linked to in the dependency snapshot
+    type: string
+    required: false
+    default: ''
+
+  # If any of detector-name, detector-version, or detector-url are provided, they all have to be provided.  
+  # Defaults will be used if none are not provided.  If only one or two are provided, the action will fail.
+  detector-name:
+    description: The name of the detector that generated the dependency snapshot
+    type: string
+    required: false
+    default: ''
+  detector-version:
+    description: The version of the detector that generated the dependency snapshot
+    type: string
+    required: false
+    default: ''
+  detector-url:
+    description: The URL to the detector that generated the dependency snapshot
+    type: string
+    required: false
+    default: ''
 runs:
-  using: 'node20'
+  using: 'node24'
   main: 'dist/index.js'

dist/index.js

@@ -94,15 +94,49 @@ function main() {
             }
             manifest.addIndirectDependency(dep);
         });
-        const snapshot = new dependency_submission_toolkit_1.Snapshot({
-            name: 'actions/go-dependency-submission',
-            url: 'https://github.com/actions/go-dependency-submission',
-            version: '0.0.1'
-        }, github.context, {
+        let snapshotDetector;
+        const detectorName = core.getInput('detector-name');
+        const detectorUrl = core.getInput('detector-url');
+        const detectorVersion = core.getInput('detector-version');
+        if (detectorName === '' && detectorUrl === '' && detectorVersion === '') {
+            // use defaults if none are specified
+            snapshotDetector = {
+                name: 'actions/go-dependency-submission',
+                url: 'https://github.com/actions/go-dependency-submission',
+                version: '0.0.1'
+            };
+        }
+        else if (detectorName === '' ||
+            detectorUrl === '' ||
+            detectorVersion === '') {
+            // if any of detectorName, detectorUrl, or detectorVersion have value, then they are all required
+            throw new Error("Invalid input: if any of 'detector-name', 'detector-url', or 'detector-version' have value, then thay are all required.");
+        }
+        else {
+            // use inputs since all are specified
+            snapshotDetector = {
+                name: detectorName,
+                url: core.getInput('detector-url', { required: true }),
+                version: core.getInput('detector-version', { required: true })
+            };
+        }
+        const snapshot = new dependency_submission_toolkit_1.Snapshot(snapshotDetector, github.context, {
             correlator: `${github.context.job}-${goBuildTarget}`,
             id: github.context.runId.toString()
         });
         snapshot.addManifest(manifest);
+        // only override the sha if the input has a value
+        // otherwise, continue to use the sha set from the context in the Snapshot constructor
+        const inputSHA = core.getInput('sha');
+        if (inputSHA !== '') {
+            snapshot.sha = inputSHA;
+        }
+        // only override the ref if the input has a value
+        // otherwise, continue to use the ref set from the context in the Snapshot constructor
+        const inputRef = core.getInput('ref');
+        if (inputRef !== '') {
+            snapshot.ref = inputRef;
+        }
         (0, dependency_submission_toolkit_1.submitSnapshot)(snapshot);
     });
 }
@@ -13846,7 +13880,7 @@ module.exports = {
 
 
 const { parseSetCookie } = __nccwpck_require__(4408)
-const { stringify, getHeadersList } = __nccwpck_require__(3121)
+const { stringify } = __nccwpck_require__(3121)
 const { webidl } = __nccwpck_require__(1744)
 const { Headers } = __nccwpck_require__(554)
 
@@ -13922,14 +13956,13 @@ function getSetCookies (headers) {
 
   webidl.brandCheck(headers, Headers, { strict: false })
 
-  const cookies = getHeadersList(headers).cookies
+  const cookies = headers.getSetCookie()
 
   if (!cookies) {
     return []
   }
 
-  // In older versions of undici, cookies is a list of name:value.
-  return cookies.map((pair) => parseSetCookie(Array.isArray(pair) ? pair[1] : pair))
+  return cookies.map((pair) => parseSetCookie(pair))
 }
 
 /**
@@ -14357,14 +14390,15 @@ module.exports = {
 /***/ }),
 
 /***/ 3121:
-/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
+/***/ ((module) => {
 
 "use strict";
 
 
-const assert = __nccwpck_require__(9491)
-const { kHeadersList } = __nccwpck_require__(2785)
-
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
 function isCTLExcludingHtab (value) {
   if (value.length === 0) {
     return false
@@ -14625,31 +14659,13 @@ function stringify (cookie) {
   return out.join('; ')
 }
 
-let kHeadersListNode
-
-function getHeadersList (headers) {
-  if (headers[kHeadersList]) {
-    return headers[kHeadersList]
-  }
-
-  if (!kHeadersListNode) {
-    kHeadersListNode = Object.getOwnPropertySymbols(headers).find(
-      (symbol) => symbol.description === 'headers list'
-    )
-
-    assert(kHeadersListNode, 'Headers cannot be parsed')
-  }
-
-  const headersList = headers[kHeadersListNode]
-  assert(headersList)
-
-  return headersList
-}
-
 module.exports = {
   isCTLExcludingHtab,
-  stringify,
-  getHeadersList
+  validateCookieName,
+  validateCookiePath,
+  validateCookieValue,
+  toIMFDate,
+  stringify
 }
 
 
@@ -18653,6 +18669,7 @@ const {
   isValidHeaderName,
   isValidHeaderValue
 } = __nccwpck_require__(2538)
+const util = __nccwpck_require__(3837)
 const { webidl } = __nccwpck_require__(1744)
 const assert = __nccwpck_require__(9491)
 
@@ -19206,6 +19223,9 @@ Object.defineProperties(Headers.prototype, {
   [Symbol.toStringTag]: {
     value: 'Headers',
     configurable: true
+  },
+  [util.inspect.custom]: {
+    enumerable: false
   }
 })
 
@@ -28382,6 +28402,20 @@ class Pool extends PoolBase {
       ? { ...options.interceptors }
       : undefined
     this[kFactory] = factory
+
+    this.on('connectionError', (origin, targets, error) => {
+      // If a connection error occurs, we remove the client from the pool,
+      // and emit a connectionError event. They will not be re-used.
+      // Fixes https://github.com/nodejs/undici/issues/3895
+      for (const target of targets) {
+        // Do not use kRemoveClient here, as it will close the client,
+        // but the client cannot be closed in this state.
+        const idx = this[kClients].indexOf(target)
+        if (idx !== -1) {
+          this[kClients].splice(idx, 1)
+        }
+      }
+    })
   }
 
   [kGetDispatcher] () {

package-lock.json

@@ -33,6 +33,9 @@
         "prettier": "^3.5.3",
         "ts-jest": "^29.0.0",
         "typescript": "^4.6.4"
+      },
+      "engines": {
+        "node": ">=24"
       }
     },
     "node_modules/@actions/core": {
@@ -1945,9 +1948,9 @@
       }
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-      "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+      "version": "3.14.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
       "dev": true,
       "dependencies": {
         "argparse": "^1.0.7",
@@ -4450,9 +4453,9 @@
       }
     },
     "node_modules/filelist/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "dependencies": {
         "brace-expansion": "^2.0.1"
@@ -5856,9 +5859,9 @@
       "dev": true
     },
     "node_modules/js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "dependencies": {
         "argparse": "^2.0.1"
@@ -6051,9 +6054,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -7225,9 +7228,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "5.28.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
-      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
       "license": "MIT",
       "dependencies": {
         "@fastify/busboy": "^2.0.0"
@@ -8824,9 +8827,9 @@
           }
         },
         "js-yaml": {
-          "version": "3.14.1",
-          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.1.tgz",
-          "integrity": "sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==",
+          "version": "3.14.2",
+          "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
+          "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
           "dev": true,
           "requires": {
             "argparse": "^1.0.7",
@@ -10699,9 +10702,9 @@
           }
         },
         "minimatch": {
-          "version": "5.1.6",
-          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-          "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+          "version": "5.1.9",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+          "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
           "dev": true,
           "requires": {
             "brace-expansion": "^2.0.1"
@@ -11738,9 +11741,9 @@
       "dev": true
     },
     "js-yaml": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
-      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "requires": {
         "argparse": "^2.0.1"
@@ -11894,9 +11897,9 @@
       "peer": true
     },
     "minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "requires": {
         "brace-expansion": "^1.1.7"
@@ -12721,9 +12724,9 @@
       }
     },
     "undici": {
-      "version": "5.28.5",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.5.tgz",
-      "integrity": "sha512-zICwjrDrcrUE0pyyJc1I2QzBkLM8FINsgOrt6WjA+BgajVq9Nxu2PbFFXUrAggLfDXlZGZBVZYw7WNV5KiBiBA==",
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
       "requires": {
         "@fastify/busboy": "^2.0.0"
       }

package.json

@@ -3,6 +3,9 @@
   "version": "2.0.3",
   "description": "Go Dependency Submission",
   "main": "dist/index.js",
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "build": "tsc",
     "format": "npx prettier --write '**/*.ts'",

src/index.ts

@@ -77,19 +77,62 @@ async function main () {
     manifest.addIndirectDependency(dep)
   })
 
-  const snapshot = new Snapshot(
-    {
+  type SnapshotDetector = {
+    name: string
+    url: string
+    version: string
+  }
+  let snapshotDetector: SnapshotDetector
+
+  const detectorName = core.getInput('detector-name')
+  const detectorUrl = core.getInput('detector-url')
+  const detectorVersion = core.getInput('detector-version')
+
+  if (detectorName === '' && detectorUrl === '' && detectorVersion === '') {
+    // use defaults if none are specified
+    snapshotDetector = {
       name: 'actions/go-dependency-submission',
       url: 'https://github.com/actions/go-dependency-submission',
       version: '0.0.1'
-    },
-    github.context,
-    {
-      correlator: `${github.context.job}-${goBuildTarget}`,
-      id: github.context.runId.toString()
     }
-  )
+  } else if (
+    detectorName === '' ||
+    detectorUrl === '' ||
+    detectorVersion === ''
+  ) {
+    // if any of detectorName, detectorUrl, or detectorVersion have value, then they are all required
+    throw new Error(
+      "Invalid input: if any of 'detector-name', 'detector-url', or 'detector-version' have value, then thay are all required."
+    )
+  } else {
+    // use inputs since all are specified
+    snapshotDetector = {
+      name: detectorName,
+      url: core.getInput('detector-url', { required: true }),
+      version: core.getInput('detector-version', { required: true })
+    }
+  }
+
+  const snapshot = new Snapshot(snapshotDetector, github.context, {
+    correlator: `${github.context.job}-${goBuildTarget}`,
+    id: github.context.runId.toString()
+  })
   snapshot.addManifest(manifest)
+
+  // only override the sha if the input has a value
+  // otherwise, continue to use the sha set from the context in the Snapshot constructor
+  const inputSHA = core.getInput('sha')
+  if (inputSHA !== '') {
+    snapshot.sha = inputSHA
+  }
+
+  // only override the ref if the input has a value
+  // otherwise, continue to use the ref set from the context in the Snapshot constructor
+  const inputRef = core.getInput('ref')
+  if (inputRef !== '') {
+    snapshot.ref = inputRef
+  }
+
   submitSnapshot(snapshot)
 }