ci(osv-scan): fail only for vulnerabilities above threshold

Author: thomasleplus

.github/workflows/osv-scanner-pr.yml

@@ -0,0 +1,55 @@
+---
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
+# in addition to a PR check which fails if new vulnerabilities are introduced.
+#
+# For more examples and options, including how to ignore specific vulnerabilities,
+# see https://google.github.io/osv-scanner/github-action/
+
+name: OSV-Scanner
+
+on:
+  pull_request:
+    branches: ["main"]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  osv-scanner-pr:
+    permissions:
+      # Require writing security events to upload SARIF file to security tab
+      security-events: write
+      # Read commit contents
+      contents: read
+      # Actions read-only
+      actions: read
+    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@90b209d0ea55cea1da9fc0c4e65782cc6acb6e2e" # v2.2.2
+    with:
+      fail-on-vuln: false
+  check:
+    runs-on: ubuntu-latest
+    needs: osv-scanner-pr
+    steps:
+      - name: Check OSV scan results
+        shell: bash
+        run: |
+          set -euo pipefail
+          IFS=$'\n\t'
+          rc=0
+          echo "${NEW_RESULTS}" | jq -r '.results[].packages[].vulnerabilities[].id' | while read -r vid; do
+            if echo "${OLD_RESULTS}" | grep -q -L -e "\"${vid}\""; then
+              rc=$((rc+1))
+              >&2 echo "error: PR introduces new vulnerabilities ${vid} (see step 'scan > osv-scanner-pr > Run osv-scanner-reporter' for details)"
+            fi
+          done
+          if [ "${rc}" -gt 0 ]; then
+            exit "${rc}"
+          fi
+        env:
+          OLD_RESULTS: ${{ needs.osv-scanner-pr.outputs.old-results }}
+          NEW_RESULTS: ${{ needs.osv-scanner-pr.outputs.new-results }}

.github/workflows/osv-scanner.yml

@@ -13,8 +13,6 @@
 name: OSV-Scanner
 
 on:
-  pull_request:
-    branches: ["main"]
   push:
     branches: ["main"]
   schedule:
@@ -33,3 +31,31 @@ jobs:
       # Required to read the code
       actions: read
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" # v2.3.8
+    with:
+      fail-on-vuln: false
+  check:
+    runs-on: ubuntu-latest
+    needs: osv-scanner
+    steps:
+      - name: Check OSV scan results
+        shell: bash
+        run: |
+          set -euo pipefail
+          IFS=$'\n\t'
+          # jq expression:
+          # - iterate packages -> vulnerabilities -> full osv entry -> severity[] (type, score)
+          # - extract numeric scores for CVSS types (cvss_v3 or numeric severity[].score)
+          # - compare to threshold
+          if echo "${RESULTS}" | jq '
+            .results[]
+            | .packages[]?
+            | .vulnerabilities[]?
+            | ( .severity[]?.score // "" ) as $s
+            | select($s != "")
+            | ($s | tonumber) >= 4.0
+            ' | grep -q -e . ; then
+            >&2 echo "error: found one or more vulnerabilities with a medium or higher severity (see step 'scan > osv-scanner > Run osv-scanner-reporter' for details)"
+            exit 1
+          fi
+        env:
+          RESULTS: ${{ needs.osv-scanner.outputs.results }}