There are two shared workflows for using OSV for doing
Software Composition Analysis (SCA) using a package-lock.json (which is
generated as part of the workflow).
.github/workflows/osv-scanner-pr.yaml runs OSV on any Pull Request and
reports any found vulnerabilities on the PR as a comment. Any updates during the
PR review process will result in an additional comment being added (reflecting
any changes made along the way).
.github/workflows/osv-scanner-main.yaml uses the same OSV scanning process,
but only scans the git base ref (typically the main branch of the repo). Once
scanning is complete any vulnerabilities found will be added to a
Vulnerabilities as of ${NOW} issue.
Because these are shared workflows the actual scheduled or triggered use of them is set in the calling workflow, so it may vary across repos.
Update the workflow below by changing {{SHA}} to the preferred SHA of this
repo (see the releases table below). Use of a SHA value is preferred to using a
tag name due to the risk of "artipacking".
Once updated, save the file as .github/workflows/osv-scanner.yaml in the repo
of your choice.
# OSV-Scanner PR scanning reusable workflow, can be used as a PR action to
# detect new vulnerabilities being introduced.
name: Use OSV to do SCA on main (daily) and PRs
on:
pull_request:
branches: [main]
merge_group:
branches: [main]
schedule:
- cron: 0 0 * * *
push:
branches: [main]
jobs:
## run the following on PRs
osv-scan-pr:
uses: digitalbazaar/github-workflow-shared-action-osv-scanner/.github/workflows/osv-scanner-pr.yaml@{{SHA}}
permissions:
contents: read
pull-requests: write
## run the following only on the main branch
osv-scan-main:
uses: digitalbazaar/github-workflow-shared-action-osv-scanner/.github/workflows/osv-scanner-main.yaml@{{SHA}}
permissions:
contents: read
issues: write| Release | SHA | Notes |
|---|---|---|
| v4.0.1 | 8599d9f4d0964fa3ea83a50f6e50d69524adc7ab | Fix npm audit display |
| v4.0.0 | 7bf5b9c80f41e5fde94cb0ad74a1a0ceec036726 | Security and bug fixes, improve output, refactorings |
| v3.1.0 | 6f08463b590bb2034203bf68cde70530e43b8a26 | Fix npm audit output |
| v3.0.0 | 536972bc49c10826182731e6d7ec5d69100e14ca | Fixes & dependency updates |
| v2.0.0 | 5367fe2df1bbed52b3cc34ebde6599d990e92ece | Added npm audit/list |
| v1.0.0 | a3f075f418e548dc2d55220acd7de23bdf8c4e70 | Initial release |
BSD-3-Clause Copyright 2025 Digital Bazaar, Inc.
Commercial support is available by contacting Digital Bazaar support@digitalbazaar.com.