osv-scanner-reusable.yml

# Copyright 2023 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: OSV-Scanner scanning reusable

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

on:
  workflow_call:
    inputs:
      scan-args:
        description: "Custom osv-scanner arguments (See https://google.github.io/osv-scanner/usage/ for options, you cannot set --format or --output)"
        type: string
        default: |-
          -r
          --skip-git
          ./
      results-file-name:
        description: "File name of the result SARIF file"
        type: string
        default: results.sarif
      download-artifact:
        description: "Optional artifact to download for scanning"
        required: false
        default: ""
        type: string
      upload-sarif:
        description: "Whether to upload to Security > Code Scanning"
        type: boolean
        required: false
        default: true
      fail-on-vuln:
        description: "Whether to fail the action on vulnerability found"
        type: boolean
        default: true

jobs:
  osv-scan:
    permissions:
      contents: read # to fetch code (actions/checkout)
      security-events: write # for uploading SARIF files
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: "Download custom artifact if specified"
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        if: "${{ inputs.download-artifact != '' }}"
        with:
          name: "${{ inputs.download-artifact }}"
          path: "./"
      - name: "Run scanner"
        uses: google/osv-scanner/actions/scanner@main
        with:
          scan-args: |-
            --output=results.json
            --format=json
            ${{ inputs.scan-args }}
        continue-on-error: true
      - name: "Run osv-scanner-reporter"
        uses: google/osv-scanner/actions/reporter@main
        with:
          scan-args: |-
            --output=${{ inputs.results-file-name }}
            --new=results.json
            --gh-annotations=false
            --fail-on-vuln=${{ inputs.fail-on-vuln }}
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
        if: "!cancelled()"
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: SARIF file
          path: ${{ inputs.results-file-name }}
          retention-days: 5
      # Upload the results to GitHub's code scanning dashboard.
      - name: "Upload to code-scanning"
        if: "${{ !cancelled() && inputs.upload-sarif == true }}"
        uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1
        with:
          sarif_file: ${{ inputs.results-file-name }}