You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
returnfmt.Errorf("--experimental-licenses requires comma-separated spdx licenses. The following license(s) are not recognized as spdx: %s", strings.Join(unrecognized, ","))
182
+
}
178
183
}
179
-
// TODO: verify that the licenses they passed in are indeed spdx.
Please see [CONTRIBUTING.md](https://github.com/google/osv-scanner/blob/main/CONTRIBUTING.md/#contributing-documentation) for information on contributing documentation.
16
+
We use - [Prettier](https://prettier.io/) to standardize the format of markdown and config files.
17
+
18
+
This requires [node/npm](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) to be installed.
Copy file name to clipboardExpand all lines: docs/github-action.md
+88-98
Original file line number
Diff line number
Diff line change
@@ -20,18 +20,16 @@ nav_order: 7
20
20
21
21
OSV-Scanner is offered as a GitHub Action. We currently have two different GitHub Actions:
22
22
23
-
1. An action that triggers a scan with each [pull request](./github-action.md#scans-on-prs) and will only check for new vulnerabilities introduced through the pull request.
24
-
2. An action that performs a single vulnerability scan, which can be configured to scan on a [regular schedule](./github-action.md#scheduled-scans), or used as a check [on releases](./github-action.md#scan-on-release) to prevent releasing with known vulnerabilities in dependencies.
23
+
1. An action that triggers a scan with each [pull request](./github-action.md#scan-on-pull-request) and will only report new vulnerabilities introduced through the pull request.
24
+
2. An action that performs a full vulnerability scan, which can be configured to scan on a [regular schedule](./github-action.md#scheduled-scans). The full vulnerability scan can also be configured to run [on release](./github-action.md#scan-on-release) to prevent releasing with known vulnerabilities in dependencies.
25
25
26
-
## Scans on PRs
26
+
## Scan on pull request
27
27
28
-
Scanning your project on each pull request can help you keep vulnerabilities out of your project. This GitHub Action compares a vulnerability scan of the target branch to a vulnerability scan of the feature branch, and will fail if there are new vulnerabilities found which doesn't exist in the target branch. You will be notified of any new vulnerabilities introduced through the feature branch. You can also choose to [prevent merging](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging) if new vulnerabilities are introduced through the feature branch.
28
+
Scanning your project on each pull request can help you keep vulnerabilities out of your project. This GitHub Action compares a vulnerability scan of the target branch to a vulnerability scan of the feature branch, and will fail if there are new vulnerabilities introduced through the feature branch. You may choose to [prevent merging](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-status-checks-before-merging) if new vulnerabilities are introduced, but by default the check will only warn users.
29
29
30
30
### Instructions
31
31
32
-
In your project repository, create a new file `.github/workflows/osv-scanner-pr.yml`.
33
-
34
-
Include the following in the [`osv-scanner-pr.yml`](https://github.com/google/osv-scanner/blob/main/.github/workflows/osv-scanner-pr.yml) file:
32
+
In your project repository, create a new file `.github/workflows/osv-scanner-pr.yml` and include the following:
Results may be viewed by clicking on the details of the failed action, either from your project's actions tab or directly on the PR. Results are also included in GitHub annotations on the "Files changed" tab for the PR.
60
58
61
-
### Customization
62
-
63
-
`osv-scanner-reusable.yml` takes two optional inputs:
64
-
65
-
- `scan-args`: This value is passed to `osv-scanner` CLI after being split by each line. See the [usage](./usage) page for the available options.
66
-
Importantly `--format` and `--output` flags are already set by the reusable workflow and should not be overridden here.
67
-
Default:
68
-
```bash
69
-
--recursive # Recursively scan subdirectories
70
-
--skip-git=true # Skip commit scanning to focus on dependencies
71
-
./ # Start the scan from the root of the repository
72
-
```
73
-
- `results-file-name`: This is the name of the final SARIF file uploaded to Github.
74
-
Default: `results.sarif`
75
-
- `download-artifact`: Optional artifact to download for scanning. Can be used if you need to do some preprocessing to prepare the lockfiles for scanning.
76
-
If the file names in the artifact are not standard lockfile names, make sure to add custom scan-args to specify the lockfile type and path (see [specify lockfiles](./usage#specify-lockfiles)).
77
-
- `upload-sarif`: Whether to upload the results to Security > Code Scanning. Defaults to `true`.
# Download the artifact uploaded in extract-deps step
131
-
download-artifact: converted-OSV-Scanner-deps
132
-
# Scan only the file inside the uploaded artifact
133
-
scan-args: |-
134
-
--lockfile=osv-scanner:osv-scanner-deps.json
135
-
permissions:
136
-
# Needed to upload the SARIF results to code-scanning dashboard.
137
-
security-events: write
138
-
contents: read
139
-
```
140
-
141
-
</details>
142
-
143
59
## Scheduled scans
144
60
145
61
Regularly scanning your project for vulnerabilities can alert you to new vulnerabilities in your dependency tree. This GitHub Action will scan your project on a set schedule and report all known vulnerabilities. If vulnerabilities are found the action will return a failed status.
146
62
147
63
### Instructions
148
64
149
-
In your project repository, create a new file `.github/workflows/osv-scanner-scheduled.yml`.
150
-
151
-
Include the following in the [`osv-scanner-scheduled.yml`](https://github.com/google/osv-scanner/blob/main/.github/workflows/osv-scanner-scheduled.yml) file:
65
+
In your project repository, create a new file `.github/workflows/osv-scanner-scheduled.yml` and include the following:
As written, the scanner will run on 12:30 pm UTC every Monday, and also on every push to the main branch. You can change the schedule by following the instructions [here](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#schedule).
175
89
176
-
### Customization
177
-
178
-
`osv-scanner-reusable-pr.yml`has the same customization options as `osv-scanner-reusable.yml`, which is described [here](./github-action.md#customization).
179
-
180
90
### View results
181
91
182
92
Maintainers can review results of the scan by navigating to their project's `security > code scanning` tab. Vulnerability details can also be viewed by clicking on the details of the failed action.
@@ -223,3 +133,83 @@ jobs:
223
133
### View results
224
134
225
135
Results may be viewed by clicking on the details of the failed release action from the action tab.
136
+
137
+
## Customization
138
+
139
+
The GitHub Actions have the following optional inputs:
140
+
141
+
- `scan-args`: This value is passed to `osv-scanner` CLI after being split by each line. See the [usage](./usage) page for the available options. The `--format` and `--output` flags are already set by the reusable workflow and should not be overridden here.
142
+
Default:
143
+
```bash
144
+
--recursive # Recursively scan subdirectories
145
+
--skip-git=true # Skip commit scanning to focus on dependencies
146
+
./ # Start the scan from the root of the repository
147
+
```
148
+
- `results-file-name`: This is the name of the final SARIF file uploaded to Github.
149
+
Default: `results.sarif`
150
+
- `download-artifact`: Optional artifact to download for scanning. Can be used if you need to do some preprocessing to prepare the lockfiles for scanning. If the file names in the artifact are not standard lockfile names, make sure to add custom scan-args to specify the lockfile type and path (see [specify lockfiles](./usage#specify-lockfiles)).
151
+
- `upload-sarif`: Whether to upload the results to Security > Code Scanning. Defaults to `true`.
0 commit comments