ci: Integrate vet for scanning OSS components during PR #263
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Integrate vet to automate vetting of OSS packages for security vulnerabilities and other risks. The policy is configured to be minimal, checking only for critical & high risk vulnerabilities, malicious libraries. The policy can be fine tuned / improved based on usage.
Example
For PRs raised from a branch in this repository,
vet
will add a PR comment with vetting results. Example:For PRs raised from forked repositories, GitHub by default offer a read only
GITHUB_TOKEN
to actions. This is a security feature to prevent malicious actions to perform write operations in a repository through forks. When such a PR is raised,vet
cannot add a PR comment without compromising on security (possible withpull_request_target
but it has a security cost). Instead, the action will fail on policy violation and the policy violation is visible in the action output.Our Usage
We use
vet
to vet our own packages.Example PR vetted by vet:
safedep/vet#239 (comment)
Example policy using which the vetting was done:
https://github.com/safedep/vet/blob/main/.github/vet/policy.yml
Support
If you need help with fine tuning policy or have any questions, please tag @abhisek and I am happy to contribute to your project.