ci: Integrate vet for scanning OSS components during PR #16458
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why?
This PR integrates vet to automate vetting of OSS packages for security vulnerabilities, malware and other risks. The policy is configured to be minimal, checking only for critical & high risk vulnerabilities, malicious libraries. The policy can be fine tuned / improved based on usage.
Example
For PRs raised from a branch in this repository,
vetwill add a PR comment with vetting results. Example:For PRs raised from forked repositories, GitHub by default offer a read only
GITHUB_TOKENto actions. This is a security feature to prevent malicious actions to perform write operations in a repository through forks. When such a PR is raised,vetcannot add a PR comment without compromising on security (possible withpull_request_targetbut it has a security cost). Instead, the action will fail on policy violation and the policy violation is visible in the action output.Our Usage
We use
vetto vet our own packages.Example PR vetted by vet:
safedep/vet#239 (comment)
Example policy using which the vetting was done:
https://github.com/safedep/vet/blob/main/.github/vet/policy.yml
Support
If you need help with fine tuning policy or have any question, please tag @abhisek and I am happy to contribute to your project.
vetis used by multiple open source projects to prevent risky open source components from being included as dependencies.