26 lines
972 B
YAML
26 lines
972 B
YAML
# Known-vulnerable dependencies, via osv-scanner against the OSV database.
|
|
#
|
|
# Reads every lockfile and manifest it recognises (pnpm/npm/yarn, pip/uv/poetry,
|
|
# go.mod, NuGet, Cargo and more). Accepted vulnerabilities go in an
|
|
# osv-scanner.toml in the calling repo as [[IgnoredVulns]] entries with a
|
|
# reason and an ignoreUntil date, so an exception expires instead of
|
|
# silently living forever.
|
|
on:
|
|
workflow_call:
|
|
|
|
jobs:
|
|
osv-scanner:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
- name: osv-scanner
|
|
run: |
|
|
osv-scanner --version | head -1
|
|
rc=0
|
|
osv-scanner scan source --recursive . || rc=$?
|
|
# 128 means no lockfile or manifest was found: nothing to check, not a failure.
|
|
if [ "$rc" -eq 128 ]; then
|
|
echo "No supported lockfiles or manifests found; nothing to scan."
|
|
exit 0
|
|
fi
|
|
exit "$rc"
|