opensecdevops/OSDO SCA
Software Composition Analysis - Scan dependencies for vulnerabilities using OSV-Scanner, Grype, and native package managers
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to scan for dependency vulnerabilities | no | . |
| manifest-file | Dependency manifest file (auto-detect if not specified) | no | "" |
| scanners | Scanners to use (osv, grype, native, all) | no | osv |
| severity-threshold | Minimum severity to report (LOW, MEDIUM, HIGH, CRITICAL) | no | MEDIUM |
| fail-on-critical | Fail the action if critical vulnerabilities are found | no | true |
| fail-on-high | Fail the action if high severity vulnerabilities are found | no | false |
| ignore-unfixed | Ignore vulnerabilities without fixes available | no | false |
| results-dir | Directory to store results | no | .osdo/results |
Outputs
| name | description |
|---|---|
| findings | Total vulnerable dependencies found |
| critical-count | Critical vulnerabilities count |
| high-count | High vulnerabilities count |
| package-manager | Detected package manager |