divd-nl/CVE CNA Bot
A Bot that validates CVE records and (optionally) submits them to the CVE database.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jun 26, 2026
- License
- Apache 2.0
Pinned Snippet
uses: divd-nl/cna-bot@577a08d0f1cf420e9afea2b26222a1f1e9726037 # v1.8.0tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| cve-user | CVE services user name (usually the email address) | yes | — |
| cve-org | CVE services organisation | yes | — |
| cve-api-key | CVE services api key (Please store this in a GitHub secret) | yes | — |
| cve-environment | CVE services environment (defaults to test) | yes | test |
| publish | Set to `true` to publish the records to the CVE services | — | false |
| path | Path to check and submit | — | . |
| ignore | Comma separted list of checks to ignore. | — | "" |
| min-reserved | Minimum number of reserved records for the current year | — | 0 |
| reserve | Minimum number of records to reserve in one go (0=do not make reservations) | — | 0 |
| exclude-locked | Exclude reservations listed in reservations.lock files from the min-reserved count | — | false |
| pr | Create a PR to bring local records in line with remote records. | — | false |
| update-local | Update local records/reservations to match remote state. Defaults to the value of `pr` when left empty, so set it to `true` to update local files without creating a PR. | — | "" |
| github-token | Github token, usually automatically provided via `secrets.GITHUB_TOKEN`, required when pr is set to `true` | — | — |
| github-branch | Name of the github branch to create the pull request from. Defaults to `cve_sumbit_pr` | — | cve_submit_pr_${{ github.sha }} |
| github-pr-description | description of the github pull request. Defaults to `Automatic updates made by cve-rsus-validate-submit Github Action` | — | Automatic updates made by cve-rsus-validate-submit Github Action |
| check-reservations | Check reservations as well (default: true) | — | true |
| reservations-path | Path where reservations are kept by default. (default: $path/reservations | — | "" |
| create-missing | Create files for missing records from the CVE database (default: true) | — | true |
| expire-after | Create PR to expire reservations this much time after the end of the year (e.g 4d, 3w, 2m or 1y) | — | "" |
| delete-rejected | Delete the local file of a rejected reservation instead of keeping it with state REJECTED (default: false) | — | false |
| verbose | Verbose output | — | false |
| quiet | Minimal output (wins over verbose) | — | false |
| debug | Most verbose output | — | false |
| skip-cve-lint | Skip running cvelint validation (default: false) | — | false |
Outputs
no outputs