mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-09 14:38:59 +02:00
Garry TanandClaude Fable 5
716196bba5
The ignore file was inert from v1.65.0.0: OSV-Scanner only auto-discovers configs named osv-scanner.toml (no leading dot) and applies them per-directory, so the root config never covered lib/diagram-render/bun.lock either way. The workflow now passes --config=.osv-scanner.toml globally. Every IgnoredVulns entry carries a reason with an upgrade trigger and an ignoreUntil expiry (~90 days) so suppressions must be re-justified. A wiring test pins flag ↔ filename ↔ entry hygiene so the file can never silently go inert again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
28 lines
528 B
YAML
28 lines
528 B
YAML
name: OSV Scanner
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '23 7 * * 1'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: osv-scanner
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
scan:
|
|
permissions:
|
|
actions: read
|
|
contents: read
|
|
security-events: write
|
|
uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@f4cfcc01edc9c8b756a9b873b7a623ca674da51e # v2.3.8
|
|
with:
|
|
scan-args: |-
|
|
--config=.osv-scanner.toml
|
|
--include-git-root
|
|
--recursive
|
|
./
|