emphereio/deph CVE reachability

Which container CVEs are in your execution path vs just noise. A dependency-graph layer that complements your scanner.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 26, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: emphereio/deph-action@387c92cfd5a27a11a0684e47fbb2781459f845ac # v0.1.4

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
image	Image to analyze. A local image name already built on the runner (auto-saved to a tarball and scanned), or a registry reference deph pulls directly. Run this after the image is built.	yes	—
image-digest	Content digest to bind the verdict to — e.g. the digest output of docker/build-push-action (its steps.<id>.outputs.digest). If empty, the action resolves the best available digest and records how strong that binding is (digest_kind).	no	""
deph-version	deph release tag to download (from emphereio/deph-dist releases).	no	v0.1.5
deph-token	Token used to download the deph release binary. Leave empty to use the workflow's github.token. Set a PAT only if the deph repo is private.	no	""
severity	Optional severity filter passed to deph (e.g. critical,high).	no	""
vex	Optional VEX document path(s) passed to deph for suppression.	no	""
probe	Runtime probe (Linux runners only): off \| startup \| dynamic. 'startup' runs the image and observes what loads at startup (eBPF). 'dynamic' also attaches eBPF uprobes to vulnerable functions and drives the entrypoint to confirm CVEs reachable by execution. Needs a root-capable runner with Docker (GitHub-hosted ubuntu works; the action uses sudo automatically). It runs your image, so point it at your own builds.	no	off
probe-timeout	Probe window, e.g. 30s. Only used when probe is not off.	no	30s
fail-on	Gate the job on in-path findings: none \| any-reachable \| reachable-high \| reachable-critical. Always fails LAST, after artifacts are uploaded.	no	none
upload-sarif	Upload a reachable-only SARIF to the code-scanning tab. Opt-in; runs a second scan pass. SARIF is not the canonical report (verdict.json is).	no	false
upload-sbom	Emit a CycloneDX SBOM (with deph reachability/VEX enrichment). Opt-in; runs a second scan pass since deph formats are mutually exclusive.	no	false
comment-on-pr	Sticky PR comment: auto (comment on pull_request events) \| always \| off.	no	auto
output-directory	Directory where the report artifacts are written.	no	deph-report
upload-artifact	Upload the report directory as a workflow artifact.	no	true
artifact-name	Name of the uploaded artifact.	no	deph-report
retention-days	Days to retain the uploaded report artifact (GitHub artifact retention / TTL). "0" uses the repository default; otherwise 1–90.	no	0
remediate	Remediation plan: off \| plan. 'plan' turns the scan into a ranked fix plan (which upgrade clears which reachable CVEs) and, on PRs, posts it as a sticky comment. With no llm-model it posts the deterministic plan; with one it adds AI narration and freshness checks.	no	off
mode	scan \| investigate \| context. 'investigate' answers `question` against an existing `report` JSON; 'context' runs the AI analyst triage (exploitable-here / verify / unlikely-here) over the reachable set. Both skip scanning — the @deph PR bot calls these.	no	scan
question	Question to answer when mode=investigate.	no	""
report	Path to an existing deph report JSON for mode=investigate.	no	""
history	Prior conversation as a JSON array of {role: user\|assistant, content} turns, for follow-up questions. Must be pre-filtered to trusted authors + the bot's own replies; the agent re-sanitizes (role/length/count caps) and treats it as data, not commands.	no	""
actor	mode=authorize: the username invoking deph (e.g. the PR comment author).	no	""
actor-association	mode=authorize: the actor's author_association (OWNER/MEMBER/COLLABORATOR/...).	no	""
policy-file	Path to the access policy (default .deph.yml then .github/deph.yml).	no	""
comments-file	Path to the PR's issue-comments JSON (from `gh api`). The action builds the conversation history from it with the tested trusted-author/marked-reply filter, so the consumer doesn't hand-roll it. Alternative to passing `history` directly.	no	""
current-comment-id	The triggering comment id, excluded from history (used with comments-file).	no	""
llm-base-url	OpenAI-compatible base URL for the remediation model. Works with OpenAI, Anthropic (compat endpoint), OpenRouter, Groq, and local runtimes (Ollama, vLLM). The model is the user's choice; the tools are the contract.	no	https://api.openai.com/v1
llm-model	Model id for remediation. Empty disables AI; the deterministic plan still runs.	no	""
llm-api-key	API key for the LLM endpoint. Omit for keyless local servers.	no	""
token-budget	Hard ceiling on total LLM tokens per AI invocation (prompt+completion). The agent stops and returns a partial answer once exceeded. "0" = unlimited. Cost guardrail.	no	0
max-tool-calls	Max tool calls per AI invocation before the agent must answer. Bounds cost/loops.	no	32
max-output-tokens	Max tokens the model may emit per turn.	no	8000

Outputs

name	description
report-json	Path to the deph JSON report (source of truth).
verdict-json	Path to the digest-bound deph-action verdict.
summary-markdown	Path to the Markdown summary.
report-html	Path to the self-contained HTML report.
sarif	Path to the SARIF file, when upload-sarif is enabled.
sbom-cyclonedx	Path to the CycloneDX SBOM, when upload-sbom is enabled.
image-digest	The digest the verdict is bound to.
total-cves	Distinct known CVEs found (deduped by CVE ID).
in-path-cves	CVEs deph found in the execution path.
linked-cves	CVEs linked/present but not fully traced.
not-found-in-path-cves	CVEs present but with no execution path found by deph.
gate-tripped	true when fail-on policy matched (the job is failed in a later step).
deph-exit-code	deph scan exit code (0 clean, 1 findings, 2 error).
remediation-markdown	Path to the remediation plan (mode=scan) or the investigation answer (mode=investigate).
answer	The investigation answer text (mode=investigate).
allowed	mode=authorize: 'true' if the actor may invoke deph, per the access policy.
authz-reason	mode=authorize: why the access decision was made.