Skip to content

Commit bf0b4f1

Browse files
sonukapoorsonukapoor
authored
Merge pull request #93 from sonukapoor/feature/issue-92-github-action
[Feature] Add a reusable first-party GitHub Action
2 parents f394788 + e6a219c commit bf0b4f1

2 files changed

Lines changed: 177 additions & 1 deletion

File tree

‎README.md‎

Lines changed: 43 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -501,6 +501,49 @@ cve-lite . --offline
501501

502502
This repository also uses CVE Lite CLI in its own GitHub Actions workflow to scan itself as part of CI. See [`self-scan.yml`](https://github.com/sonukapoor/cve-lite-cli/blob/main/.github/workflows/self-scan.yml).
503503

504+
Use the reusable first-party GitHub Action in another repository:
505+
506+
```yaml
507+
name: Dependency Scan
508+
509+
on:
510+
pull_request:
511+
push:
512+
branches: [main]
513+
514+
jobs:
515+
cve-lite:
516+
runs-on: ubuntu-latest
517+
steps:
518+
- uses: actions/checkout@v4
519+
- uses: sonukapoor/cve-lite-cli@v1.1.1
520+
with:
521+
verbose: "true"
522+
fail-on: high
523+
```
524+
525+
For an offline GitHub Actions workflow that refreshes the advisory DB first:
526+
527+
```yaml
528+
name: Offline Dependency Scan
529+
530+
on:
531+
pull_request:
532+
533+
jobs:
534+
cve-lite:
535+
runs-on: ubuntu-latest
536+
steps:
537+
- uses: actions/checkout@v4
538+
- uses: sonukapoor/cve-lite-cli@v1.1.1
539+
with:
540+
sync-advisories: "true"
541+
offline: "true"
542+
offline-db: ./.cache/cve-lite/advisories.db
543+
verbose: "true"
544+
fail-on: high
545+
```
546+
504547
For CI, we recommend using `--verbose` so build logs include the full fix plan, dependency paths, and detailed table output when a scan fails.
505548

506549
Use it as a release gate in CI:
@@ -733,7 +776,6 @@ CVE Lite CLI is evolving from a vulnerability scanner into a comprehensive remed
733776
* **Deduplication Analysis:** Identify instances where multiple versions of the same vulnerable package exist and suggest a single version for consolidation.
734777

735778
### Phase 2: Ecosystem & Integration (Mid-Term)
736-
* **Official GitHub Action:** Create a dedicated Action for one-line setup in CI/CD pipelines.
737779
* **Expanded Lockfile Support:** Introduce parsers for emerging JS/TS ecosystems, including `bun.lockb`.
738780
* **IDE Integration:** Develop a lightweight extension to highlight vulnerable packages directly within the code editor.
739781
* **Workflow Integration Guidance:** Expand official workflow patterns for local scripts, hooks, CI, and offline developer adoption.

‎action.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: "CVE Lite CLI"
2+
description: "Run CVE Lite CLI in GitHub Actions for JS/TS dependency vulnerability scanning."
3+
author: "Sonu Kapoor"
4+
5+
branding:
6+
icon: "shield"
7+
color: "green"
8+
9+
inputs:
10+
node-version:
11+
description: "Node.js version used to install and run CVE Lite CLI"
12+
required: false
13+
default: "20"
14+
path:
15+
description: "Project path to scan"
16+
required: false
17+
default: "."
18+
fail-on:
19+
description: "Exit non-zero at or above this severity"
20+
required: false
21+
default: ""
22+
verbose:
23+
description: "Run the scan with verbose output"
24+
required: false
25+
default: "false"
26+
prod-only:
27+
description: "Exclude dev dependencies where available"
28+
required: false
29+
default: "false"
30+
offline:
31+
description: "Run the scan using the local advisory database"
32+
required: false
33+
default: "false"
34+
offline-db:
35+
description: "Path to the local advisory database file"
36+
required: false
37+
default: ""
38+
sync-advisories:
39+
description: "Build or refresh the local advisory database before scanning"
40+
required: false
41+
default: "false"
42+
43+
runs:
44+
using: "composite"
45+
steps:
46+
- name: Setup Node
47+
uses: actions/setup-node@v4
48+
with:
49+
node-version: ${{ inputs.node-version }}
50+
cache: npm
51+
cache-dependency-path: ${{ github.action_path }}/package-lock.json
52+
53+
- name: Install CVE Lite CLI dependencies
54+
shell: bash
55+
working-directory: ${{ github.action_path }}
56+
run: npm ci
57+
58+
- name: Build CVE Lite CLI
59+
shell: bash
60+
working-directory: ${{ github.action_path }}
61+
run: npm run build
62+
63+
- name: Resolve action inputs
64+
id: resolve
65+
shell: bash
66+
env:
67+
INPUT_PATH: ${{ inputs.path }}
68+
INPUT_OFFLINE: ${{ inputs.offline }}
69+
INPUT_OFFLINE_DB: ${{ inputs.offline-db }}
70+
INPUT_SYNC_ADVISORIES: ${{ inputs.sync-advisories }}
71+
run: |
72+
set -euo pipefail
73+
74+
project_path="${INPUT_PATH:-.}"
75+
requested_offline_db="${INPUT_OFFLINE_DB:-}"
76+
use_offline="false"
77+
resolved_offline_db=""
78+
79+
if [[ "${INPUT_OFFLINE}" == "true" || "${INPUT_SYNC_ADVISORIES}" == "true" || -n "${requested_offline_db}" ]]; then
80+
use_offline="true"
81+
resolved_offline_db="${requested_offline_db:-./.cache/cve-lite/advisories.db}"
82+
fi
83+
84+
{
85+
echo "project-path=${project_path}"
86+
echo "use-offline=${use_offline}"
87+
echo "offline-db=${resolved_offline_db}"
88+
} >> "$GITHUB_OUTPUT"
89+
90+
- name: Sync local advisory database
91+
if: ${{ inputs.sync-advisories == 'true' }}
92+
shell: bash
93+
working-directory: ${{ github.workspace }}
94+
env:
95+
ACTION_PATH: ${{ github.action_path }}
96+
OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
97+
run: |
98+
set -euo pipefail
99+
mkdir -p "$(dirname "${OFFLINE_DB_PATH}")"
100+
node "${ACTION_PATH}/dist/index.js" advisories sync --output "${OFFLINE_DB_PATH}"
101+
102+
- name: Run CVE Lite CLI scan
103+
shell: bash
104+
working-directory: ${{ github.workspace }}
105+
env:
106+
ACTION_PATH: ${{ github.action_path }}
107+
PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
108+
USE_OFFLINE: ${{ steps.resolve.outputs.use-offline }}
109+
OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
110+
INPUT_FAIL_ON: ${{ inputs.fail-on }}
111+
INPUT_VERBOSE: ${{ inputs.verbose }}
112+
INPUT_PROD_ONLY: ${{ inputs.prod-only }}
113+
run: |
114+
set -euo pipefail
115+
116+
args=("${PROJECT_PATH}")
117+
118+
if [[ "${INPUT_VERBOSE}" == "true" ]]; then
119+
args+=("--verbose")
120+
fi
121+
122+
if [[ "${INPUT_PROD_ONLY}" == "true" ]]; then
123+
args+=("--prod-only")
124+
fi
125+
126+
if [[ -n "${INPUT_FAIL_ON}" ]]; then
127+
args+=("--fail-on" "${INPUT_FAIL_ON}")
128+
fi
129+
130+
if [[ "${USE_OFFLINE}" == "true" ]]; then
131+
args+=("--offline-db" "${OFFLINE_DB_PATH}")
132+
fi
133+
134+
node "${ACTION_PATH}/dist/index.js" "${args[@]}"

0 commit comments

Comments
 (0)