Tidelift — package vulnerability check

arazzo: 1.0.1
info:
  title: Tidelift — package vulnerability check
  version: 1.0.0
  summary: Validate the API key, look up a package and a release, and pull the release's vulnerabilities.
  x-realizes-capability-ids:
  - BC-4200.60
  x-capability-derivation:
    method: 'deterministic join: sourceDescriptions -> per-tag OpenAPI -> tag/capability edge. No classification at this step.'
    min_confidence: 0.7
    sources:
    - capability_id: BC-4200.60
      capability_name: Open Source Stewardship
      spec: tidelift-releases-api-openapi.yml
      confidence: 0.78
    model: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities, CC BY 4.0
sourceDescriptions:
- name: authenticationApi
  url: ../openapi/tidelift-authentication-api-openapi.yml
  type: openapi
- name: packagesApi
  url: ../openapi/tidelift-packages-api-openapi.yml
  type: openapi
- name: releasesApi
  url: ../openapi/tidelift-releases-api-openapi.yml
  type: openapi
- name: vulnerabilitiesApi
  url: ../openapi/tidelift-vulnerabilities-api-openapi.yml
  type: openapi
workflows:
- workflowId: packageVulnerabilityCheck
  summary: Look up a package release and inspect a vulnerability affecting it.
  inputs:
    type: object
    properties:
      package_platform: {type: string}
      package_name: {type: string}
      release_version: {type: string}
      vulnerability_id: {type: string}
    required: [package_platform, package_name, release_version]
  steps:
  - stepId: auth
    operationId: authCheck
  - stepId: showPackage
    operationId: showPackage
    parameters:
    - name: package_platform
      in: path
      value: $inputs.package_platform
    - name: package_name
      in: path
      value: $inputs.package_name
  - stepId: showRelease
    operationId: showRelease
    parameters:
    - name: package_platform
      in: path
      value: $inputs.package_platform
    - name: package_name
      in: path
      value: $inputs.package_name
    - name: release_version
      in: path
      value: $inputs.release_version
  - stepId: releaseSbom
    operationId: releaseSbom
    parameters:
    - name: package_platform
      in: path
      value: $inputs.package_platform
    - name: package_name
      in: path
      value: $inputs.package_name
    - name: release_version
      in: path
      value: $inputs.release_version
  - stepId: getVulnerability
    operationId: getVulnerability
    parameters:
    - name: vulnerability_id
      in: path
      value: $inputs.vulnerability_id