emabrey/vcpkg-vuln-scan
Scan a vcpkg-based project for known CVEs via OSV.dev
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| project-root | Directory containing vcpkg.json | no | . |
| transitive | Walk transitive port dependencies | no | false |
| suppressions | Path to a suppressions JSON file (see repo README) | no | "" |
| sarif | If set, write SARIF 2.1.0 to this path | no | "" |
| json | If set, write grouped JSON results to this path | no | "" |
| fail-on-findings | Fail the step when there are active findings | no | true |
| python-version | Python version to install via actions/setup-python | no | 3.11 |
| cache-ttl-hours | OSV response cache TTL in hours | no | 24 |
Outputs
| name | description |
|---|---|
| sarif-path | Path to the generated SARIF file (empty if none was requested) |
| active-count | Number of active (un-suppressed, non-withdrawn) findings |