SecOSS GitHub Action

Composite Action

Automatically scan your dependencies for CVEs on every pull request and post a formatted vulnerability report as a PR comment — completely free, no API key required.

✅ Posts comment on every PR🔄 Updates existing comment on re-run🚫 Fails build on critical CVEs🔑 No API key or signup🆓 Completely free

Quick Setup

Create the workflow file

Create .github/workflows/secoss.yml in your repository with this content:

yaml

name: SecOSS Security Scan

on:
  pull_request:
    branches: ['*']

jobs:
  secoss:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      contents: read
    steps:
      - uses: actions/checkout@v4

      - uses: rafraf-ops/SecurityForOpenSource-@main
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-on: critical

Open a pull request

The workflow triggers automatically on every new PR. No further configuration needed.

Review the comment

SecOSS posts a formatted vulnerability table. On subsequent commits to the same PR, the comment is updated in place rather than creating a new one.

Example PR Comment

This is what the comment looks like on a PR with vulnerabilities:

github-actionsbotjust now

🛡️ SecOSS Security Scan

⚠️ Found 3 vulnerabilities across 2 lockfiles.

Severity	Count
🔴 Critical	1
🟠 High	2
🟡 Medium	0
🔵 Low	0

📦 Lockfile details

package-lock.json

Packages: 214 · Vulnerable: 2 · Critical: 1 · High: 1

requirements.txt

Packages: 18 · Vulnerable: 1 · Critical: 0 · High: 1

When no vulnerabilities are found, the comment shows a ✅ green status instead. The comment is automatically updated on every new commit push.

Inputs

Input	Default	Description
github-token	github.token	Token used to post PR comments and call the GitHub API for scanning. The built-in token works for public repos.
fail-on	critical	Severity threshold that fails the workflow. Options: critical · high · medium · any · never
secoss-api	https://app.cloudrf.xyz	SecOSS API base URL. Override only if self-hosting the API.

Outputs

Use outputs to make decisions in downstream steps:

Output	Description
critical	Number of critical vulnerabilities found across all lockfiles.
high	Number of high vulnerabilities found.
medium	Number of medium vulnerabilities found.
low	Number of low vulnerabilities found.
total	Total vulnerabilities found.

Full Workflow Example

Advanced setup with outputs and push-to-main scanning:

yaml

name: SecOSS Security Scan

on:
  pull_request:
    branches: ['*']
  push:
    branches: [main]        # also scan the main branch on merge

jobs:
  secoss:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write  # needed to post PR comments
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: SecOSS — dependency CVE scan
        id: secoss
        uses: rafraf-ops/SecurityForOpenSource-@main
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-on: critical       # critical | high | medium | any | never

      # Optional: use outputs in downstream steps
      - name: Print summary
        if: always()
        run: |
          echo "Critical : ${{ steps.secoss.outputs.critical }}"
          echo "High     : ${{ steps.secoss.outputs.high }}"
          echo "Total    : ${{ steps.secoss.outputs.total }}"

How it works

On a pull request event, the Action calls POST https://app.cloudrf.xyz/api/scan/github with your repo URL and the built-in GitHub token.
SecOSS fetches your repository, discovers all lockfiles (package-lock.json, yarn.lock, requirements.txt, and more), and queries OSV.dev + GitHub Advisory DB for matching CVEs.
A markdown comment is posted (or the existing SecOSS comment is updated) on the pull request.
If fail-on threshold is exceeded the Action exits with code 1, failing the workflow check.

No data is retained — all scan results are computed in-memory and discarded after the API response.

Supported Lockfiles

package-lock.jsonnpm

yarn.lockYarn

pnpm-lock.yamlpnpm

requirements.txtpip

Pipfile.lockPipenv

Cargo.lockRust

go.sumGo

Gemfile.lockRuby

composer.lockPHP

Required permissions

The workflow needs pull-requests: write to post comments, and contents: read to allow SecOSS to fetch your repository. These permissions are shown in the workflow template above.

For private repositories the built-in GITHUB_TOKEN works automatically. No additional secrets needed.

🔌 API Docs + Try SecOSS Now