thomas/svelte-examples
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ci: add daily dependency security checks #3

Closed
renovate wants to merge 2 commits from security/dependency-scanning into main
pull from: security/dependency-scanning
merge into: thomas:main
Conversation 0 Commits 2 Files changed 1 +33
renovate commented 2026-10-02 14:26:20 +01:00
Collaborator
Copy link

Adds a checksum-verified OSV Scanner check on pushes, pull requests, and daily at 04:00 UTC. Scans committed lockfiles recursively, including transitive dependencies. No project install/build scripts or call analysis are executed. Known advisories intentionally fail the check; review reachability before prioritizing fixes. Nix closures and deployed containers are not covered. This workflow becomes active on the default branch after you merge this PR. Renovate auto-merge remains disabled.

Adds a checksum-verified OSV Scanner check on pushes, pull requests, and daily at 04:00 UTC. Scans committed lockfiles recursively, including transitive dependencies. No project install/build scripts or call analysis are executed. Known advisories intentionally fail the check; review reachability before prioritizing fixes. Nix closures and deployed containers are not covered. This workflow becomes active on the default branch after you merge this PR. Renovate auto-merge remains disabled.
ci: scan dependencies for security advisories daily
Some checks failed
Dependency security / osv (pull_request) Failing after 2s
Details
Dependency security / osv (push) Failing after 2s
Details
876d1bdd2e
fix(ci): pass explicit OSV call-analysis options
Some checks failed
Dependency security / osv (push) Failing after 3s
Details
Dependency security / osv (pull_request) Failing after 4s
Details
0bf93ad012
renovate closed this pull request 2026-10-02 15:00:30 +01:00
Some checks failed
Dependency security / osv (push) Failing after 3s
Details
Dependency security / osv (pull_request) Failing after 4s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
thomas/svelte-examples!3
No description provided.