sec-open/Vulnerability Diff (Syft+Grype)
Compare vulnerabilities between two refs (base/head) and output a Markdown table, JSON diff, and upload artifacts
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| base_ref | Base ref/branch/sha to compare against (e.g., main) | yes | — |
| head_ref | Head ref/branch/sha to compare | yes | — |
| path | Subdirectory to scan (monorepo). Default: repo root | no | . |
| build_command | Optional build command before scanning | no | "" |
| min_severity | Minimum severity to report: LOW|MEDIUM|HIGH|CRITICAL (inclusive) | no | LOW |
| write_summary | Write Markdown table to GITHUB_STEP_SUMMARY | no | true |
| upload_artifact | Upload SBOMs, grype outputs and a full report as artifact | no | true |
| artifact_name | Artifact name | no | vuln-diff-artifacts |
| graph_max_nodes | Max nodes to include in the Mermaid dependency graph | no | 150 |
| report_pdf | Also render report.pdf using Puppeteer, default true | no | true |
| setup_script | Shell script to run inside each worktree (BASE and HEAD) before build/SBOM | no | "" |
| pr_comment | Post/Update a reusable PR comment with NEW vulnerabilities | no | false |
| pr_comment_marker | Hidden marker used to find the existing reusable comment | no | <!-- vuln-diff-action:comment --> |
| github_token | GitHub token with permission to write PR comments (defaults to GITHUB_TOKEN) | no | "" |
| slack_webhook_url | Slack Incoming Webhook URL (if set, notify on NEW vulns) | no | "" |
| slack_channel | Slack channel override (optional, default from webhook config) | no | "" |
Outputs
| name | description |
|---|---|
| new_count | Number of NEW vulnerabilities introduced by head over base |
| removed_count | Number of vulnerabilities REMOVED by head vs base |
| unchanged_count | Number of unchanged vulnerabilities |
| diff_markdown_table | Markdown table with Severity | VulnerabilityID | package:version | branches |
| diff_json | JSON diff payload |
| base_sha | Resolved base commit SHA |
| head_sha | Resolved head commit SHA |
| base_input | Raw base input ref |
| head_input | Raw head input ref |