From 8b3353aab14323099814af9e029ae70dbecca68f Mon Sep 17 00:00:00 2001
From: David Meister <thedavidmeister@gmail.com>
Date: Mon, 15 Jun 2026 16:34:03 +0000
Subject: [PATCH] feat(npm-blacklist): scan multiple directories in one call

Add a `working-directories` input (whitespace-separated list of NPM
project paths) so a single action call can scan several projects from one
installed dependency tree. It takes precedence over the singular
`working-directory` and is fully backward compatible: callers that pass
only `working-directory` are unaffected.

This lets a CI job install dependencies once and scan every workspace
package in a single step, instead of repeating the composite `uses:` per
directory or re-installing per directory in a matrix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/actions/npm-blacklist/action.yml | 31 ++++++++++++++++++++----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/.github/actions/npm-blacklist/action.yml b/.github/actions/npm-blacklist/action.yml
index 2964c04..49cc114 100644
--- a/.github/actions/npm-blacklist/action.yml
+++ b/.github/actions/npm-blacklist/action.yml
@@ -10,6 +10,15 @@ inputs:
     description: 'Path to the NPM project, example: ./packages/my-npm-project'
     required: false
     default: '.'
+  working-directories:
+    description: >-
+      Whitespace-separated list of NPM project paths to scan in one invocation,
+      example: a YAML multiline of ". packages/foo packages/bar". Takes
+      precedence over `working-directory` when set; the checker runs against
+      every listed directory and fails if any of them resolves a blacklisted
+      package.
+    required: false
+    default: ''
   additional-blacklist-file:
     description: 'Path to an additional file with list of packages in form of "pkg@version", example: ./my-blacklist.txt'
     required: false
@@ -29,13 +38,25 @@ runs:
       shell: bash
       env:
         WORKING_DIRECTORY: ${{ inputs['working-directory'] }}
+        WORKING_DIRECTORIES: ${{ inputs['working-directories'] }}
         DEFAULT_BLACKLIST: ${{ github.action_path }}/blacklist.txt
         ADDITIONAL_BLACKLIST_FILE: ${{ inputs['additional-blacklist-file'] }}
         ADDITIONAL_BLACKLIST_PKGS: ${{ inputs['additional-blacklist-pkgs'] }}
         OVERRIDE_BLACKLIST: ${{ inputs['override-blacklist'] }}
+      # `working-directories` (whitespace-separated) lets one action call scan
+      # several NPM projects from a single installed dependency tree; it takes
+      # precedence over the singular `working-directory`. Word-splitting the
+      # list is intentional, so IFS-splitting is left on for the loop. Every
+      # directory is checked even if an earlier one fails, and a non-zero exit
+      # from any directory fails the step.
       run: |
-        ${{ github.action_path }}/checker.sh \
-        "${WORKING_DIRECTORY}" \
-        "${OVERRIDE_BLACKLIST:-$DEFAULT_BLACKLIST}" \
-        "${ADDITIONAL_BLACKLIST_FILE}" \
-        "${ADDITIONAL_BLACKLIST_PKGS}"
+        dirs="${WORKING_DIRECTORIES:-$WORKING_DIRECTORY}"
+        rc=0
+        for dir in $dirs; do
+          "${{ github.action_path }}/checker.sh" \
+            "$dir" \
+            "${OVERRIDE_BLACKLIST:-$DEFAULT_BLACKLIST}" \
+            "${ADDITIONAL_BLACKLIST_FILE}" \
+            "${ADDITIONAL_BLACKLIST_PKGS}" || rc=1
+        done
+        exit "$rc"