ci(workflows): add dependency vulnerability scanning#1344
Conversation
|
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughA new GitHub Actions workflow file ChangesDependency Vulnerability Scan CI Workflow
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/cve-lite.yml (2)
27-27: ⚡ Quick winConsider pinning cve-lite-cli to a specific version for build stability.
Using
@latestensures the newest vulnerability database and scanner features, but could introduce breaking changes or unexpected behavior between CI runs. Consider pinning to a specific version and updating periodically.📌 Example: Pin to a specific version
- run: npx cve-lite-cli@latest . --fail-on high + run: npx cve-lite-cli@1.2.3 . --fail-on highNote: Since you're the tool's author, you may prefer
@latestto always use the newest vulnerability data. This suggestion is for build predictability—adjust based on your stability vs. freshness preference.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cve-lite.yml at line 27, The npx command in the cve-lite-cli step uses `@latest` which can introduce breaking changes and inconsistent behavior across CI runs. Replace `@latest` with a specific version number (e.g., `@1.0.0` or whatever the current stable version is) in the run command that executes npx cve-lite-cli@latest . --fail-on high. This ensures consistent and predictable builds while allowing for controlled updates by changing the version pin periodically.
18-20: Consider pinning actions to commit hashes for stronger supply chain security.The workflow uses semantic version tags (
@v4) for actions. While this approach is consistent with your project's current practice across all workflows, pinning to commit hashes prevents supply chain attacks where action maintainers could modify tagged versions. This is an optional security hardening step if stricter protections are desired:Suggested hash pinning
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 - uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v4 - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cve-lite.yml around lines 18 - 20, Replace the semantic version tags (`@v4`) with specific commit hashes for the three GitHub Actions: actions/checkout, pnpm/action-setup, and actions/setup-node. For each action, replace the `@v4` reference with its corresponding commit hash (as provided in the suggested hash pinning section) and include a comment indicating which version it corresponds to (e.g., # v4). This change strengthens supply chain security by preventing potential malicious modifications to tagged versions.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cve-lite.yml:
- Line 18: The actions/checkout@v4 action currently uses default behavior which
persists GitHub credentials in the workspace, creating a potential security
risk. Add the `persist-credentials: false` option to the checkout action step to
explicitly disable credential persistence, since this workflow only needs to
perform dependency scanning and does not require git credentials for any
subsequent operations.
---
Nitpick comments:
In @.github/workflows/cve-lite.yml:
- Line 27: The npx command in the cve-lite-cli step uses `@latest` which can
introduce breaking changes and inconsistent behavior across CI runs. Replace
`@latest` with a specific version number (e.g., `@1.0.0` or whatever the current
stable version is) in the run command that executes npx cve-lite-cli@latest .
--fail-on high. This ensures consistent and predictable builds while allowing
for controlled updates by changing the version pin periodically.
- Around line 18-20: Replace the semantic version tags (`@v4`) with specific
commit hashes for the three GitHub Actions: actions/checkout, pnpm/action-setup,
and actions/setup-node. For each action, replace the `@v4` reference with its
corresponding commit hash (as provided in the suggested hash pinning section)
and include a comment indicating which version it corresponds to (e.g., # v4).
This change strengthens supply chain security by preventing potential malicious
modifications to tagged versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 7dfe8776-b8ce-4a49-9f4d-d1af1912ef23
📒 Files selected for processing (1)
.github/workflows/cve-lite.yml
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 1 file
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cve-lite.yml:
- Line 21: The `actions/setup-node@v4` action uses a mutable tag reference
instead of an immutable commit SHA, which introduces supply-chain security
risks. Replace the tag reference `@v4` with the full commit SHA for the v4
release of the actions/setup-node action to ensure the workflow always uses the
exact same version and prevent any unexpected changes from upstream updates.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4380546b-6ea9-45d2-b8e5-630a84a89d02
📒 Files selected for processing (1)
.github/workflows/cve-lite.yml
sonukapoor
force-pushed
the
ci/add-dependency-vulnerability-scan
branch
from
946d720 to
b7d4387
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/cve-lite.yml (1)
21-21:⚠️ Potential issue | 🟠 MajorPin
actions/setup-nodeto a commit SHA.
actions/setup-node@v4uses a tag reference rather than an immutable commit SHA, which creates a supply-chain risk. Replace with the verified commit SHA:- - uses: actions/setup-node@v4 + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cve-lite.yml at line 21, The `actions/setup-node@v4` action reference uses a mutable tag which creates a supply-chain risk. Replace the tag reference `@v4` with the verified immutable commit SHA that corresponds to the intended version of the action. This ensures that the exact version of the action is always used and prevents unexpected changes if the tag is updated.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In @.github/workflows/cve-lite.yml:
- Line 21: The `actions/setup-node@v4` action reference uses a mutable tag which
creates a supply-chain risk. Replace the tag reference `@v4` with the verified
immutable commit SHA that corresponds to the intended version of the action.
This ensures that the exact version of the action is always used and prevents
unexpected changes if the tag is updated.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 577dc966-13da-49ec-8e7f-ffd8b27d5f9d
📒 Files selected for processing (1)
.github/workflows/cve-lite.yml
sonukapoor
force-pushed
the
ci/add-dependency-vulnerability-scan
branch
from
c8cffa2 to
d8a8753
Compare
1 participant
What is the current behavior?
No dependency vulnerability scanning in CI. VoltAgent ships 1,611 packages across its pnpm lockfile with no automated check - a PR can introduce a high or critical severity vulnerability without any gate catching it.
What is the new behavior?
Adds a dependency vulnerability scan on every push to main and every pull request using CVE Lite CLI, an OWASP Lab Project. The workflow fails on high or critical severity findings.
I scanned the current lockfile before opening this PR - the codebase is clean. The workflow adds a forward-looking gate so it stays that way.
Notes for reviewers
I'm the creator of CVE Lite CLI and an OWASP contributor. Happy to answer any questions about the tool or adjust the configuration (e.g. severity threshold, SARIF output for GitHub Code Scanning).
Summary by cubic
Add CI dependency vulnerability scanning using
OWASP/cve-lite-clito block high-severity issues on pushes tomainand on PRs by scanning lockfiles against OSV.mainand PR events (opened, synchronize, reopened, ready_for_review); skips draft PRs and cancels in-progress via concurrency.OWASP/cve-lite-cli@v1withfail-on: highandverbose: true; no API keys needed.actions/checkout@v4usingpersist-credentials: false.Written for commit d8a8753. Summary will update on new commits.
Summary by CodeRabbit