Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ci: Integrate vet for scanning OSS components during PR #263

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

abhisek
Copy link

@abhisek abhisek commented Nov 15, 2024

Integrate vet to automate vetting of OSS packages for security vulnerabilities and other risks. The policy is configured to be minimal, checking only for critical & high risk vulnerabilities, malicious libraries. The policy can be fine tuned / improved based on usage.

Example

For PRs raised from a branch in this repository, vet will add a PR comment with vetting results. Example:

example

For PRs raised from forked repositories, GitHub by default offer a read only GITHUB_TOKEN to actions. This is a security feature to prevent malicious actions to perform write operations in a repository through forks. When such a PR is raised, vet cannot add a PR comment without compromising on security (possible with pull_request_target but it has a security cost). Instead, the action will fail on policy violation and the policy violation is visible in the action output.

console

Our Usage

We use vet to vet our own packages.

Example PR vetted by vet:

safedep/vet#239 (comment)

Example policy using which the vetting was done:

https://github.com/safedep/vet/blob/main/.github/vet/policy.yml

Support

If you need help with fine tuning policy or have any questions, please tag @abhisek and I am happy to contribute to your project.

Copy link

changeset-bot bot commented Nov 15, 2024

⚠️ No Changeset found

Latest commit: c98e568

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant