Awesome

vet GitHub Action

vet is a tool for finding security risks in OSS components. For more details, refer to vet GitHub repository https://github.com/safedep/vet

Usage

Follow setup instructions for step by step guide on how to integrate vet in your GitHub repository with customizable policies

Quick Start

Follow quickstart if you want to integrate vet as a step in your existing GitHub actions workflow

TLDR; add this GitHub action to vet your changed dependencies during pull request

- name: Run vet
  id: vet
  permissions:
    contents: read
    issues: write
    pull-requests: write
  uses: safedep/vet-action@v1
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The output of vet-action is a SARIF report that can be uploaded to GitHub Code Scanning

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: ${{ steps.vet.outputs.report }}
    category: vet

Setup Instructions

Follow this instruction to integrate vet as a GitHub action in your GitHub repository

Go to the root directory of your GitHub repository
Create the workflow and policy directory

mkdir -p .github/workflows .github/vet

Download the policy file into the policy directory

curl -o .github/vet/policy.yml -L https://raw.githubusercontent.com/safedep/vet-action/main/example/policy.yml

Download vet GitHub Action workflow

curl -o .github/workflows/vet-ci.yml -L https://raw.githubusercontent.com/safedep/vet-action/main/example/vet-ci.yml

Review the policy file in .github/vet/policy.yml and edit as required
Push / PR your changes into the repository

Configuration

vet-action accepts following additional configuration for customizing how vet is invoked during scan

GitHub Action Input	Example Value	Notes
`policy`	`policies/sample.yml`	Path to `vet` YAML policy file (filter suite)
`exception-file`	`config/exceptions.yml`	Path to `vet` exception YAML file
`trusted-registries`	`https://r1.org, https://r2.org`	`,` separated string of registry base URLs

Refer to vet policy as code for details on policy format
Refer to vet exceptions for details on exception-file format

Support

Raise issues related to GitHub Action at https://github.com/safedep/vet-action/issues
Raise issues related to vet tool at https://github.com/safedep/vet/issues

Development

Refer to development documentation