actions-marketplace-validations/CVE CNA Bot

A Bot that validates CVE records and (optionally) submits them to the CVE database.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
cve-user	CVE services user name (usually the email address)	yes	—
cve-org	CVE services organisation	yes	—
cve-api-key	CVE services api key (Please store this in a GitHub secret)	yes	—
cve-environment	CVE services environment (defaults to test)	yes	test
publish	Set to `true` to publish the records to the CVE services	—	false
path	Path to check and submit	—	.
ignore	Comma separted list of checks to ignore.	—	""
min-reserved	Minimum number of reserved records for the current year	—	0
reserve	Minimum number of records to reserve in one go (0=do not make reservations)	—	0
pr	Create a PR to bring local records in line with remote records.	—	false
github-token	Github token, usually automatically provided via `secrets.GITHUB_TOKEN`, required when pr is set to `true`	—	—
github-branch	Name of the github branch to create the pull request from. Defaults to `cve_sumbit_pr`	—	cve_submit_pr_${{ github.sha }}
github-pr-description	description of the github pull request. Defaults to `Automatic updates made by cve-rsus-validate-submit Github Action`	—	Automatic updates made by cve-rsus-validate-submit Github Action
check-reservations	Check reservations as well (default: true)	—	true
reservations-path	Path where reservations are kept by default. (default: $path/reservations	—	""
create-missing	Create files for missing records from the CVE database (default: true)	—	true
expire-after	Create PR to expire reservations this much time after the end of the year (e.g 4d, 3w, 2m or 1y)	—	""
verbose	Verbose output	—	false
quiet	Minimal output (wins over verbose)	—	false
debug	Most verbose output	—	false
skip-cve-lint	Skip running cvelint validation (default: false)	—	false

Outputs

no outputs