digitalbazaar / digitalbazaar/github-workflow-shared-action-osv-scanner
Add override support.
Nobody has claimed this yet.
- Dominant language
- No language data
- Stars
- 0
- Forks
- 1
- Avg merge
- 7m
- Merged PRs (30d)
- 15
Description
External comment:
Allow an override by package version and OSV URL (so that once a dev looks at the issue, and determines it's not an issue, there is a way for them to move forward w/o having to upgrade in case that would be worse). Package version / OSV URL is a tuple so that an override doesn't apply to a newer version. [...] am fine w/ anything that 1) allows an override to happen, and 2) doesn't make that dangerous for future versions of the software (the vuln showing up in new code for a future version of the software, if that's possible -- this might be an extreme corner case that we're okay with). The goal would to be keep that overrides file as small as possible, having lots of overrides is probably another [use case] we might want to warn on image build.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files or tests are named. Start by tracing how this GitHub Action invokes OSV Scanner and where package version and OSV URL data are configured. Define and test a version-scoped override mechanism, including protection against future versions and the requested warning for excessive overrides.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 45/100