Add distinct status code for vulnerabilities with available fixes
- Dominant language
- Go
- Stars
- 11k
- Forks
- 792
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 48
Description
Currently, OSV-Scanner uses exit code 1 for any vulnerabilities found, regardless of whether fixes are available. It would be beneficial for CI/CD workflows to have a dedicated status code to indicate when vulnerabilities with available fixes are detected. This would allow pipelines to differentiate between vulnerabilities that can be immediately addressed and those that do not yet have a solution, enabling more actionable automation and reporting.
**Request:**
- Add a new, distinct exit/status code to indicate when one or more vulnerabilities found have available fixes.
- Update documentation to reflect the new status code and its intended use case.
**Motivation:**
- Enables CI/CD pipelines to fail or alert only when actionable (fixable) vulnerabilities are detected.
- Reduces noise for vulnerabilities that cannot yet be addressed.
- Improves usability for teams integrating OSV-Scanner into automated workflows.
Let me know if you'd be willing to accept an appropriate PR!
Thanks (note - I used copilot to prepare this issue, seems to have done a good job of it)
Contributor guide
Assessment
This issue has not been assessed yet.