0pstech/VDB SBOM Scan
Scan a lockfile or SBOM against VDB (vdb.ai.kr) — known CVEs, slopsquatting, CISA KEV — and fail the build on a severity threshold. One line in CI.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 19, 2026
- License
- None
Pinned Snippet
uses: 0pstech/vdb-scan-action@5091b4f9fb436a6ad3d850b079dfbcda4d197d61 # v1.0.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| file | Path to the SBOM / dependency file (CycloneDX, SPDX, package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, go.sum, Cargo.lock, Gemfile.lock, composer.lock, …). Empty = auto-detect in the repo root. | no | "" |
| api-key | VDB API key (vdb_…). Strongly recommended in CI: anonymous calls share the runner IP pool's small lifetime trial. Free key at https://vdb.ai.kr/signup — store as a repo secret. | no | "" |
| api-url | VDB instance origin (self-hosted deployments override this). | no | https://vdb.ai.kr |
| fail-on | Fail the job at or above this severity: critical | high | medium | low | never | no | high |
Outputs
| name | description |
|---|---|
| critical | Number of critical findings |
| high | Number of high findings |
| medium | Number of medium findings |
| low | Number of low findings |
| kev | Findings on the CISA Known-Exploited list |
| components-matched | Components with at least one advisory |