google / google/osv-scanner

Add distinct status code for vulnerabilities with available fixes

Open
#2,145 3 comments 0 reactions 0 assignees View on GitHub
backlog enhancement
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

Currently, OSV-Scanner uses exit code 1 for any vulnerabilities found, regardless of whether fixes are available. It would be beneficial for CI/CD workflows to have a dedicated status code to indicate when vulnerabilities with available fixes are detected. This would allow pipelines to differentiate between vulnerabilities that can be immediately addressed and those that do not yet have a solution, enabling more actionable automation and reporting.

**Request:**
- Add a new, distinct exit/status code to indicate when one or more vulnerabilities found have available fixes.
- Update documentation to reflect the new status code and its intended use case.

**Motivation:**
- Enables CI/CD pipelines to fail or alert only when actionable (fixable) vulnerabilities are detected.
- Reduces noise for vulnerabilities that cannot yet be addressed.
- Improves usability for teams integrating OSV-Scanner into automated workflows.

Let me know if you'd be willing to accept an appropriate PR!

Thanks (note - I used copilot to prepare this issue, seems to have done a good job of it)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.