From a4e67c9163afff0ee8ce7746880e10c740e3ef3b Mon Sep 17 00:00:00 2001
From: tteenntt <87744652+Unlxii@users.noreply.github.com>
Date: Tue, 23 Jun 2026 17:41:30 +0700
Subject: [PATCH 1/2] fix: declare registry-username and registry-password
 inputs in action.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`registry-username` and `registry-password` were added to the README and implemented in `action.js` (via `core.getInput()`) in #158, but were never declared in `action.yml`.

This means the inputs are functionally supported but undocumented in the action metadata — no IDE autocomplete, no validation, and the inputs table in README references inputs that don't appear in `action.yml`.

This PR adds the missing declarations to `action.yml` to match the existing implementation.

Signed-off-by: tteenntt <87744652+Unlxii@users.noreply.github.com>
---
 action.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/action.yml b/action.yml
index 5fdd0142..9bc6bd6d 100644
--- a/action.yml
+++ b/action.yml
@@ -13,6 +13,12 @@ inputs:
   sbom:
     description: 'The SBOM file to scan. This option is mutually exclusive with "path" and "image".'
     required: false
+  registry-username:
+    description: "The registry username to use when authenticating to an external registry"
+    required: false
+  registry-password:
+    description: "The registry password to use when authenticating to an external registry"
+    required: false
   fail-build:
     description: "Set to false to avoid failing based on severity-cutoff. Default is to fail when severity-cutoff is reached (or surpassed)"
     required: false

From c9d2ecafc4fa2c68ce437ec46b77b225d4bdb950 Mon Sep 17 00:00:00 2001
From: tteenntt <87744652+Unlxii@users.noreply.github.com>
Date: Tue, 23 Jun 2026 17:45:51 +0700
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: tteenntt <87744652+Unlxii@users.noreply.github.com>
---
 action.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 9bc6bd6d..137720c6 100644
--- a/action.yml
+++ b/action.yml
@@ -14,7 +14,7 @@ inputs:
     description: 'The SBOM file to scan. This option is mutually exclusive with "path" and "image".'
     required: false
   registry-username:
-    description: "The registry username to use when authenticating to an external registry"
+    description: 'Registry username for authenticating to a container registry. Must be specified together with "registry-password".'
     required: false
   registry-password:
     description: "The registry password to use when authenticating to an external registry"