Vet Action
Enables policy-driven vetting of open source dependencies within GitHub workflows to actively protect against vulnerabilities and malicious components.
概要
Vet Action integrates the 'vet' tool into your GitHub workflow, providing active protection against vulnerable, outdated, unpopular, and potentially malicious open-source dependencies. By leveraging policy-as-code guardrails, it helps ensure the security and reliability of your software supply chain. It supports integration with SafeDep Cloud for enhanced features like malicious package analysis, and generates SARIF reports compatible with GitHub Code Scanning.
主な機能
- Generates SARIF reports for GitHub Code Scanning
- 3 GitHub stars
- Supports comments proxy server for pull requests from forked repositories
- Policy-as-code based guardrails for OSS dependencies
- Integration with SafeDep Cloud for malicious package analysis
- Customizable policies and exception handling
ユースケース
- Continuous monitoring of OSS dependencies for vulnerabilities
- Enforcing security policies across software projects
- Automated vetting of dependencies in pull requests