google / google/osv-scanner-action
Taking as input VEX files
- Dominant language
- Python
- Stars
- 96
- Forks
- 40
- Avg merge
- 4d 21h
- Merged PRs (30d)
- 4
Description
Hi there,
We work on ErlangOTP and we were wondering if it would be possible to add a new input field that takes a VEX file.
The semantics are that this Github Action should ignore any of the listed CVEs in the VEX files (for which there is a reason that the CVE does not apply).
For example, one could add the following new input field `vex-args` to pass such file
```
jobs:
osv-scan:
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.0.2"
with:
# takes as input a vex file that will make OSV to ignore some CVEs
vex-args: |-
otp.vex
scan-args: |-
./
permissions:
# Require writing security events to upload SARIF file to security tab
security-events: write
```
It would be great if the addition of VEX files is integrated into this action.
### Alternative solutions
An alternative solution is to not use this action and rely instead on the OSV API. One can build a custom script that calls OSV API and ignores some of the errors reported by OSV taking into account a VEX file.
Contributor guide
Assessment
This issue has not been assessed yet.