From 8cf47c04fcab921e4c2827dd0d2d921856d9235e Mon Sep 17 00:00:00 2001 From: Jared Hatfield Date: Thu, 22 Oct 2026 21:42:11 +0000 Subject: [PATCH 1/3] Add weekly OSV-Scanner vulnerability scans --- .github/workflows/osv-scanner.yml | 46 +++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/osv-scanner.yml diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml new file mode 100644 index 0000000..1276393 --- /dev/null +++ b/.github/workflows/osv-scanner.yml @@ -0,0 +1,46 @@ +# .github/workflows/osv-scanner.yml +name: OSV-Scanner + +on: + pull_request: + branches: [ 'main' ] + push: + branches: [ 'main' ] + schedule: + - cron: '23 9 * * 0' # Sunday at 09:23 UTC + workflow_dispatch: + +permissions: {} + +jobs: + scan-pr: + name: Scan pull request dependencies + if: ${{ github.event_name == 'pull_request' }} + permissions: + actions: read + contents: read + security-events: write + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 + with: + fail-on-vuln: false + upload-sarif: true + scan-args: |- + --recursive + --allow-no-lockfiles + ./ + + scan-full: + name: Scan all dependencies + if: ${{ github.event_name != 'pull_request' }} + permissions: + actions: read + contents: read + security-events: write + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 + with: + fail-on-vuln: false + upload-sarif: true + scan-args: |- + --recursive + --allow-no-lockfiles + ./ From 1d9af69161cae4931e5ca808853208013a219469 Mon Sep 17 00:00:00 2001 From: Jared Hatfield Date: Fri, 23 Oct 2026 09:38:52 +0000 Subject: [PATCH 2/3] security: refine OSV scanner event filters --- .github/workflows/osv-scanner.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml index 1276393..026ba04 100644 --- a/.github/workflows/osv-scanner.yml +++ b/.github/workflows/osv-scanner.yml @@ -4,6 +4,9 @@ name: OSV-Scanner on: pull_request: branches: [ 'main' ] + merge_group: + branches: [main] + types: [checks_requested] push: branches: [ 'main' ] schedule: @@ -15,7 +18,7 @@ permissions: {} jobs: scan-pr: name: Scan pull request dependencies - if: ${{ github.event_name == 'pull_request' }} + if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} permissions: actions: read contents: read @@ -31,7 +34,7 @@ jobs: scan-full: name: Scan all dependencies - if: ${{ github.event_name != 'pull_request' }} + if: ${{ github.event_name != 'pull_request' && github.event_name != 'merge_group' }} permissions: actions: read contents: read From b33696becee50b97e09f4b7c7b114e8dfaf81f0e Mon Sep 17 00:00:00 2001 From: Jared Hatfield Date: Fri, 23 Oct 2026 11:03:05 +0000 Subject: [PATCH 3/3] Split OSV scanner workflows by event --- .github/workflows/osv-scanner-full.yml | 21 +++++++++++ .github/workflows/osv-scanner-pr.yml | 21 +++++++++++ .github/workflows/osv-scanner.yml | 49 -------------------------- 3 files changed, 42 insertions(+), 49 deletions(-) create mode 100644 .github/workflows/osv-scanner-full.yml create mode 100644 .github/workflows/osv-scanner-pr.yml delete mode 100644 .github/workflows/osv-scanner.yml diff --git a/.github/workflows/osv-scanner-full.yml b/.github/workflows/osv-scanner-full.yml new file mode 100644 index 0000000..cd665ee --- /dev/null +++ b/.github/workflows/osv-scanner-full.yml @@ -0,0 +1,21 @@ +name: OSV-Scanner Full Scan + +on: + push: + branches: [main] + schedule: + - cron: '23 9 * * 0' + workflow_dispatch: + +permissions: + actions: read + contents: read + security-events: write + +jobs: + scan-full: + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 + with: + # Initial rollout reports vulnerabilities without failing the scan. + fail-on-vuln: false + upload-sarif: true diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml new file mode 100644 index 0000000..86c35a3 --- /dev/null +++ b/.github/workflows/osv-scanner-pr.yml @@ -0,0 +1,21 @@ +name: OSV-Scanner PR Scan + +on: + pull_request: + branches: [main] + merge_group: + branches: [main] + types: [checks_requested] + +permissions: + actions: read + contents: read + security-events: write + +jobs: + scan-pr: + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 + with: + # Initial rollout reports vulnerabilities without blocking merges. + fail-on-vuln: false + upload-sarif: true diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml deleted file mode 100644 index 026ba04..0000000 --- a/.github/workflows/osv-scanner.yml +++ /dev/null @@ -1,49 +0,0 @@ -# .github/workflows/osv-scanner.yml -name: OSV-Scanner - -on: - pull_request: - branches: [ 'main' ] - merge_group: - branches: [main] - types: [checks_requested] - push: - branches: [ 'main' ] - schedule: - - cron: '23 9 * * 0' # Sunday at 09:23 UTC - workflow_dispatch: - -permissions: {} - -jobs: - scan-pr: - name: Scan pull request dependencies - if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} - permissions: - actions: read - contents: read - security-events: write - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 - with: - fail-on-vuln: false - upload-sarif: true - scan-args: |- - --recursive - --allow-no-lockfiles - ./ - - scan-full: - name: Scan all dependencies - if: ${{ github.event_name != 'pull_request' && github.event_name != 'merge_group' }} - permissions: - actions: read - contents: read - security-events: write - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0 - with: - fail-on-vuln: false - upload-sarif: true - scan-args: |- - --recursive - --allow-no-lockfiles - ./