Do OSV code scan #6
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Summary: run Open Source Vulnerabilities (OSV) code scan. | |
| # | |
| # The OSV project provides a GA workflow that you can reference as a step with | |
| # "uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml". | |
| # Unfortunately, that workflow inexplicably doesn't use the latest version of | |
| # the scanner and reporter workflows, and also does other things like hard-code | |
| # the value of the osv-scanner "--gh-annotations" option to "false". Using the | |
| # separate actions directly allows us to adjust the options and use Dependabot | |
| # to update the workflow versions as new ones are introduced. | |
| # | |
| # For more examples and options, including how to ignore specific | |
| # vulnerabilities, see https://google.github.io/osv-scanner/github-action/. | |
| # ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | |
| name: OSV code scan | |
| run-name: Do ${{inputs.reason}} OSV code scan | |
| on: | |
| merge_group: | |
| types: | |
| - checks_requested | |
| # Allow calling from nightly.yaml. | |
| workflow_call: | |
| inputs: | |
| # Why is this workflow being called? | |
| reason: | |
| type: string | |
| required: false | |
| # Allow manual invocation. | |
| workflow_dispatch: | |
| # Declare default permissions as read only. | |
| permissions: read-all | |
| jobs: | |
| osv-scan: | |
| name: Run | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 15 | |
| permissions: | |
| # Needed to upload the results to code-scanning dashboard. | |
| security-events: write | |
| # Read commit contents | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Check out a copy of the git repository | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - name: Run OSV scanner | |
| # yamllint disable rule:line-length | |
| uses: google/osv-scanner-action/osv-scanner-action@90fad544eb4036129491f76db3161ffdc2956748 # v1.9.2 | |
| continue-on-error: true | |
| with: | |
| scan-args: |- | |
| --config=.osv-scanner.toml | |
| --format=json | |
| --output=osv-results.json | |
| --recursive | |
| ./ | |
| - name: Run OSV reporter | |
| # yamllint disable rule:line-length | |
| uses: google/osv-scanner-action/osv-reporter-action@90fad544eb4036129491f76db3161ffdc2956748 # v1.9.2 | |
| with: | |
| scan-args: |- | |
| --output=osv-results.sarif | |
| --new=osv-results.json | |
| --gh-annotations=true | |
| --fail-on-vuln=true | |
| - name: Upload to code-scanning dashboard | |
| uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11 | |
| with: | |
| sarif_file: osv-results.sarif |