From 9319fb6ea4ae9725d193b43d870228cb23faed55 Mon Sep 17 00:00:00 2001 From: yusuke okura Date: Tue, 19 May 2026 18:04:04 +0900 Subject: [PATCH 1/4] ci: add OSV-Scanner Full Scan reusable workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 各リポジトリの daily フルスキャンを集約するための reusable workflow を追加する。 caller 側に schedule trigger を持つ薄いラッパーを置く運用にすることで、scanner action のバージョンや wiring を中央で一元管理できる。 Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/osv-scanner-full.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/workflows/osv-scanner-full.yml diff --git a/.github/workflows/osv-scanner-full.yml b/.github/workflows/osv-scanner-full.yml new file mode 100644 index 0000000..21aed34 --- /dev/null +++ b/.github/workflows/osv-scanner-full.yml @@ -0,0 +1,13 @@ +name: OSV-Scanner Full Scan + +on: + workflow_call: + +permissions: + actions: read + security-events: write + contents: read + +jobs: + scan-full: + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 From 5277adec909b83de48041433239d4f6de93f5853 Mon Sep 17 00:00:00 2001 From: yusuke okura Date: Wed, 20 May 2026 16:10:44 +0900 Subject: [PATCH 2/4] ci: add Slack notification to OSV Full Scan workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GHAS なし運用前提で以下を追加： - upload-sarif: false（private リポジトリで Code Scanning upload が失敗するため） - fail-on-vuln: true（明示） - 脆弱性検出時に Slack へ通知する notify-slack ジョブを追加 caller 側は SLACK_WEBHOOK_URL を secrets: inherit で渡す前提。Org 共通の Slack webhook を Org Secret として登録しておけば全リポジトリで動作する。 Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/osv-scanner-full.yml | 31 ++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/.github/workflows/osv-scanner-full.yml b/.github/workflows/osv-scanner-full.yml index 21aed34..e077fac 100644 --- a/.github/workflows/osv-scanner-full.yml +++ b/.github/workflows/osv-scanner-full.yml @@ -2,6 +2,10 @@ name: OSV-Scanner Full Scan on: workflow_call: + secrets: + SLACK_WEBHOOK_URL: + required: true + description: "Slack incoming webhook URL for vulnerability alerts" permissions: actions: read @@ -11,3 +15,30 @@ permissions: jobs: scan-full: uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 + with: + upload-sarif: false + fail-on-vuln: true + + notify-slack: + needs: scan-full + if: failure() + runs-on: ubuntu-latest + steps: + - name: Notify Slack on vulnerability + uses: slackapi/slack-github-action@v3.0.3 + with: + webhook: ${{ secrets.SLACK_WEBHOOK_URL }} + webhook-type: incoming-webhook + payload: | + { + "text": ":rotating_light: OSV vulnerabilities detected in ${{ github.repository }}", + "blocks": [ + { + "type": "section", + "text": { + "type": "mrkdwn", + "text": ":rotating_light: *OSV-Scanner found vulnerabilities*\n*Repository:* `${{ github.repository }}`\n*Workflow:* `${{ github.workflow }}`\n<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View run logs and SARIF artifact>" + } + } + ] + } From c0e796232aba367e2ac95d0e60c3a5fbe91b4713 Mon Sep 17 00:00:00 2001 From: yusuke okura Date: Wed, 20 May 2026 16:27:12 +0900 Subject: [PATCH 3/4] ci: rename Slack webhook secret to OSV_SCANNER_SLACK_WEBHOOK_URL MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 汎用名 SLACK_WEBHOOK_URL は他用途と衝突するため、OSV-Scanner 専用名にリネーム。 Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/osv-scanner-full.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/osv-scanner-full.yml b/.github/workflows/osv-scanner-full.yml index e077fac..78e139e 100644 --- a/.github/workflows/osv-scanner-full.yml +++ b/.github/workflows/osv-scanner-full.yml @@ -3,9 +3,9 @@ name: OSV-Scanner Full Scan on: workflow_call: secrets: - SLACK_WEBHOOK_URL: + OSV_SCANNER_SLACK_WEBHOOK_URL: required: true - description: "Slack incoming webhook URL for vulnerability alerts" + description: "Slack incoming webhook URL for OSV-Scanner vulnerability alerts" permissions: actions: read @@ -27,7 +27,7 @@ jobs: - name: Notify Slack on vulnerability uses: slackapi/slack-github-action@v3.0.3 with: - webhook: ${{ secrets.SLACK_WEBHOOK_URL }} + webhook: ${{ secrets.OSV_SCANNER_SLACK_WEBHOOK_URL }} webhook-type: incoming-webhook payload: | { From 7c6ab46cbec56282b1a9efece7d0c388ce258e32 Mon Sep 17 00:00:00 2001 From: yusuke okura Date: Wed, 20 May 2026 16:46:42 +0900 Subject: [PATCH 4/4] ci: add GitHub Issue creation on vulnerability detection MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Slack 通知に加えて、検出時に該当リポジトリへ Issue を自動作成する。 既存の OSV-Scanner Issue がオープン中なら新規作成せずコメント追記し、 クローズ後の再検出時に新しい Issue が作られる運用とする。 Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/osv-scanner-full.yml | 57 ++++++++++++++++++++++++++ 1 file changed, 57 insertions(+) diff --git a/.github/workflows/osv-scanner-full.yml b/.github/workflows/osv-scanner-full.yml index 78e139e..62a7e5b 100644 --- a/.github/workflows/osv-scanner-full.yml +++ b/.github/workflows/osv-scanner-full.yml @@ -42,3 +42,60 @@ jobs: } ] } + + create-issue: + needs: scan-full + if: failure() + runs-on: ubuntu-latest + permissions: + issues: write + steps: + - name: Create or update OSV-Scanner issue + uses: actions/github-script@v9.0.0 + with: + script: | + const titlePrefix = '[OSV-Scanner]'; + const issueTitle = `${titlePrefix} Vulnerabilities detected in daily scan`; + const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`; + const today = new Date().toISOString().slice(0, 10); + + const { data: issues } = await github.rest.issues.listForRepo({ + owner: context.repo.owner, + repo: context.repo.repo, + state: 'open', + per_page: 100, + }); + + const existing = issues.find( + (i) => !i.pull_request && i.title.startsWith(titlePrefix) + ); + + const commentBody = `Re-detected on ${today}.\n\n[View run logs and SARIF artifact](${runUrl})`; + + if (existing) { + await github.rest.issues.createComment({ + owner: context.repo.owner, + repo: context.repo.repo, + issue_number: existing.number, + body: commentBody, + }); + core.info(`Commented on existing issue #${existing.number}`); + } else { + const body = [ + 'OSV-Scanner detected vulnerabilities in this repository during the daily full scan.', + '', + `**First detected:** ${today}`, + `**Workflow run:** [View logs and SARIF artifact](${runUrl})`, + '', + 'This issue will be re-used for subsequent detections (added as comments).', + 'Close this issue after resolving all vulnerabilities; new failures will then create a fresh issue.', + ].join('\n'); + + const { data: created } = await github.rest.issues.create({ + owner: context.repo.owner, + repo: context.repo.repo, + title: issueTitle, + body, + }); + core.info(`Created issue #${created.number}`); + }