bestit/qa-osv-scanner repository overview

⁠bestit/qa-osv-scanner

OSV Scanner Image based on https://osv.dev/⁠

⁠Usage

To run the tool on your local working directory to scan for vulnerabilities:

docker run -v $PWD:/workdir --workdir /workdir  --rm -it bestit/qa-osv-scanner:1.0.0

The tool will scan the source code and check for critical vulnerabilities. It will exit with a non-zero status code if critical vulnerabilities are found.

⁠Configuration

The osv-scanner script can be executed with an error level argument or error level can be configured with a .osv-config.yaml file.

osv-scanner:
    error-level: high

⁠Releasing new versions

The build is using a docker multi stage build. To release a new version the following steps are required:

1. Update the base image version in Dockerfile (amd64) and Dockerfile.arm64v8 (arm64v8) if needed (currently uses ghcr.io/google/osv-scanner:latest)
2. Update versions in multi-arch-manifest.yaml for both platforms.
3. Update CHANGLOG.md accordingly.
4. Push new tag, dockerhub will start the build automatically.

⁠Local Testing

To test the Dockerfiles locally you can execute this command to build the image on amd64 and arm64 architectures:

docker buildx build --force-rm --no-cache -t qa-osv-scanner --platform linux/arm64,linux/amd64 . && docker run -it qa-osv-scanner