From ef91e4a7ce2a507a6b010d70ee86250c17fc90db Mon Sep 17 00:00:00 2001 From: forkwright Date: Mon, 24 Aug 2026 11:49:11 -0500 Subject: [PATCH] ci(security): add osv-scanner job to security workflow epitelesis ran cargo-audit and cargo-deny but no OSV scan, so it saw only RustSec advisories and missed the broader OSV database that org PRs are gated on. Add the osv-scanner job exactly as sphragis defines it (the only fleet repo proven to report all four check groups the org auto-merge workflow waits on): the reusable google/osv-scanner-action workflow, pinned by commit SHA, name "osv scanner", scoped to the existing osv-scanner.toml config and Cargo.lock. No existing job touched. --- .github/workflows/security.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index e073f3a..3702471 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -57,3 +57,13 @@ jobs: tool: cargo-audit@0.22.2 - name: cargo audit run: cargo audit --deny unmaintained --deny unsound --deny yanked + + osv-scanner: + name: osv scanner + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 + permissions: + actions: read + contents: read + security-events: write + with: + scan-args: '--config=osv-scanner.toml --lockfile=Cargo.lock'