Adding OSV-Scanner to GitHub Actions

By Daniel Zoghalchali·Latchkey

Scan your lockfiles against the open OSV database with Google OSV-Scanner.

OSV-Scanner checks your lockfiles against OSV.dev, the open vulnerability database aggregating advisories across ecosystems. Google publishes a reusable workflow that handles SARIF upload, so wiring it up is mostly a one-liner referencing that workflow.

What you need

Supported lockfiles (package-lock.json, poetry.lock, go.mod, Cargo.lock, etc.).
The google/osv-scanner-action reusable workflow.
security-events: write to upload SARIF.

The workflow

Call the reusable PR-scan workflow.

.github/workflows/osv.yml

jobs:
  scan:
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2
    with:
      scan-args: |-
        --recursive
        ./
    permissions:
      security-events: write
      contents: read

Common gotchas

It scans lockfiles, so a manifest without a committed lockfile yields nothing.
--recursive is needed for monorepos with nested lockfiles.
Findings can include transitive-only CVEs you cannot fix directly - triage before failing builds.

Make the gate meaningful

Fail the build on the severity you actually intend to block, and set it explicitly. A scanner that reports without failing is documentation, not a gate.
Scan the artifact you ship, not the source tree. A vulnerability in a base image will not appear in a source scan.
Pin the scanner version and its database snapshot for reproducibility, then update deliberately; a floating database turns an unrelated push into a red build.
Give the job a way to record accepted risk, or people will disable the gate rather than triage it.

Key takeaways

OSV-Scanner checks lockfiles against the open OSV.dev database.
Use the google/osv-scanner-action reusable workflow for SARIF.
Commit lockfiles and use --recursive for monorepos.

Frequently asked questions

Adding OSV-Scanner to GitHub Actions?

The workflow?