google / google/osv-scanner-action

Taking as input VEX files

Open
#74 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
96
Forks
40
Avg merge
4d 21h
Merged PRs (30d)
4

Description

Hi there,

We work on ErlangOTP and we were wondering if it would be possible to add a new input field that takes a VEX file.
The semantics are that this Github Action should ignore any of the listed CVEs in the VEX files (for which there is a reason that the CVE does not apply).

For example, one could add the following new input field `vex-args` to pass such file

```
jobs:
osv-scan:
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.0.2"
with:
# takes as input a vex file that will make OSV to ignore some CVEs
vex-args: |-
otp.vex

scan-args: |-
./
permissions:
# Require writing security events to upload SARIF file to security tab
security-events: write
```

It would be great if the addition of VEX files is integrated into this action.

### Alternative solutions

An alternative solution is to not use this action and rely instead on the OSV API. One can build a custom script that calls OSV API and ignores some of the errors reported by OSV taking into account a VEX file.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.