venslabs/vens-action
Prioritize vulnerabilities by real risk, not just CVSS
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| version | vens release tag to install (e.g. v0.3.2). Ignored when bin-path is set. | — | "" |
| bin-path | Path to a pre-installed vens binary. Skips download. Use for air-gapped runners and custom builds. | — | "" |
| config-file | Path to config.yaml describing project context | yes | — |
| input-report | Path to the Trivy or Grype JSON scan report | yes | — |
| input-format | Scanner format: auto | trivy | grype | — | auto |
| output-vex | Output path for the generated CycloneDX VEX file | — | ${{ runner.temp }}/vens-vex.cdx.json |
| attest | If true, also emit a CycloneDX Attestations (CDXA) sibling file next to the VEX (prompt hash, input hash, model, seed, raw LLM response) | — | false |
| sbom-serial-number | SBOM BOM-Link serial in urn:uuid:<uuid> form. Pin one per service and reuse it across runs. | yes | — |
| sbom-version | BOM-Link version integer | — | 1 |
| llm-provider | openai | anthropic | googleai | ollama | mock | — | openai |
| llm-model | Model name (mapped to <PROVIDER>_MODEL) | — | "" |
| llm-api-key | API key for the selected provider. Masked in logs. | — | "" |
| llm-base-url | Custom base URL (OpenAI-compatible endpoint or Ollama host) | — | "" |
| llm-batch-size | CVEs per LLM request | — | 10 |
| enrich | If true, also produce an enriched Trivy report | — | false |
| output-enriched-report | Output path for the enriched report (when enrich=true) | — | ${{ runner.temp }}/vens-enriched.json |
| fail-on-severity | Gate the build: fail the step when the VEX contains at least one CVE scored at or above this OWASP level (critical | high | medium | low | info). Leave empty to never fail. | — | "" |
Outputs
| name | description |
|---|---|
| vex-file | Path to the generated CycloneDX VEX file |
| attestation-file | Path to the CDXA attestation sibling file (empty when attest=false) |
| enriched-report | Path to the enriched Trivy report (empty when enrich=false) |
| version | vens version that was installed (empty when bin-path is used) |
| sbom-serial-number | SBOM serial number that was used |
| count-critical | Number of CVEs the VEX rated CRITICAL by OWASP (score >= 60) |
| count-high | Number of CVEs the VEX rated HIGH (score >= 40) |
| count-medium | Number of CVEs the VEX rated MEDIUM (score >= 20) |
| count-low | Number of CVEs the VEX rated LOW (score >= 5) |
| count-info | Number of CVEs the VEX rated INFO (score < 5) |