Add vendored dependencies

action.yml

@@ -37,6 +37,7 @@ runs:
 
     - shell: bash
       run: |
+        export PYTHONPATH=${{ github.action_path }}:${{ github.action_path }}/vendor
         "${{ github.action_path }}/codeql-summarize" \
           --input "${{ inputs.projects }}" \
           --output "${{ inputs.output }}" \

vendor/_yaml/__init__.py

@@ -0,0 +1,33 @@
+# This is a stub package designed to roughly emulate the _yaml
+# extension module, which previously existed as a standalone module
+# and has been moved into the `yaml` package namespace.
+# It does not perfectly mimic its old counterpart, but should get
+# close enough for anyone who's relying on it even when they shouldn't.
+import yaml
+
+# in some circumstances, the yaml module we imoprted may be from a different version, so we need
+# to tread carefully when poking at it here (it may not have the attributes we expect)
+if not getattr(yaml, '__with_libyaml__', False):
+    from sys import version_info
+
+    exc = ModuleNotFoundError if version_info >= (3, 6) else ImportError
+    raise exc("No module named '_yaml'")
+else:
+    from yaml._yaml import *
+    import warnings
+    warnings.warn(
+        'The _yaml extension module is now located at yaml._yaml'
+        ' and its location is subject to change.  To use the'
+        ' LibYAML-based parser and emitter, import from `yaml`:'
+        ' `from yaml import CLoader as Loader, CDumper as Dumper`.',
+        DeprecationWarning
+    )
+    del warnings
+    # Don't `del yaml` here because yaml is actually an existing
+    # namespace member of _yaml.
+
+__name__ = '_yaml'
+# If the module is top-level (i.e. not a part of any specific package)
+# then the attribute should be set to ''.
+# https://docs.python.org/3.8/library/types.html
+__package__ = ''

vendor/update.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+set -e
+
+export VENDOR="$(pwd)/vendor"
+echo "[+] Vendor path: $VENDOR"
+
+echo "[+] Delete all folders in vendor"
+rm -rf "$VENDOR/*/"
+
+if [ -f $PWD/Pipfile ]; then
+    echo "[+] Install all dependencies (pipenv)"
+    pipenv run pip freeze > "$VENDOR/requirements.txt"
+    pip install -r "$VENDOR/requirements.txt" --target=$VENDOR
+
+    echo "[+] Clean up vendor folder"
+    rm -rf $VENDOR/*dist-info && \
+        rm -rf $VENDOR/requirements.txt
+
+elif [ -f $PWD/requirements.txt ]; then
+    echo "[+] Install all dependencies (pip -> requirements)"
+    pip install -r $PWD/requirements.txt --target=$VENDOR
+
+    echo "[+] Clean up vendor folder"
+    rm -rf $VENDOR/*dist-info && \
+        rm -rf $VENDOR/requirements.txt
+
+else 
+    echo "[!] Unsupported Python installer, please update the 'vendor/update.sh' script"
+    exit 1
+fi
+
+echo "[+] Completed vendor update"