From a519a37c566180e530becd6236f45de293cd99d5 Mon Sep 17 00:00:00 2001
From: yuneng-jiang <yuneng@berri.ai>
Date: Sat, 13 Jun 2026 11:25:07 -0700
Subject: [PATCH] ci: add osv-scanner lockfile scan workflow (#30222)

* ci: add osv-scanner lockfile scan workflow

Daily scheduled scan plus a pull_request scan scoped to uv.lock and the
dashboard package-lock.json. The osv-scanner v2.3.8 binary is fetched by
full release URL and verified against its official SHA-256 before use;
the job needs no credentials and runs with contents: read only.
osv-scanner.toml carries the single suppression for the diskcache
advisory, which has no fixed release published

* ci: temporary push trigger for runtime verification (will be dropped)

* ci: harden osv-scan per review (RUNNER_TEMP, job-scoped permissions, suppression expiry)

* ci: drop temporary push trigger after runtime verification

* ci: suppress aiohttp advisories while vcrpy blocks the 3.14 bump

Time-boxed like the diskcache entry: ignoreUntil forces a dated
re-triage if no vcrpy release has shipped by then
---
 .github/workflows/osv-scan.yml | 49 ++++++++++++++++++++++++++++++++++
 osv-scanner.toml               | 14 ++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 .github/workflows/osv-scan.yml
 create mode 100644 osv-scanner.toml

diff --git a/.github/workflows/osv-scan.yml b/.github/workflows/osv-scan.yml
new file mode 100644
index 00000000000..9dd321f88db
--- /dev/null
+++ b/.github/workflows/osv-scan.yml
@@ -0,0 +1,49 @@
+name: OSV Scan
+
+on:
+  pull_request:
+    branches:
+      - main
+      - litellm_internal_staging
+      - litellm_oss_branch
+      - "litellm_**"
+    paths:
+      - uv.lock
+      - ui/litellm-dashboard/package-lock.json
+      - osv-scanner.toml
+      - .github/workflows/osv-scan.yml
+  schedule:
+    - cron: "23 6 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  osv-scan:
+    name: osv-scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Download osv-scanner v2.3.8
+        run: |
+          curl -fsSL --retry 3 -o "$RUNNER_TEMP/osv-scanner" \
+            https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
+          echo "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc  $RUNNER_TEMP/osv-scanner" | sha256sum -c -
+          chmod +x "$RUNNER_TEMP/osv-scanner"
+
+      - name: Scan lockfiles
+        run: |
+          "$RUNNER_TEMP/osv-scanner" scan source \
+            --config osv-scanner.toml \
+            -L uv.lock \
+            -L ui/litellm-dashboard/package-lock.json
diff --git a/osv-scanner.toml b/osv-scanner.toml
new file mode 100644
index 00000000000..f0f5f045f1a
--- /dev/null
+++ b/osv-scanner.toml
@@ -0,0 +1,14 @@
+[[IgnoredVulns]]
+id = "GHSA-w8v5-vhqr-4h9v"
+ignoreUntil = 2026-09-09
+reason = "diskcache has no fixed release published; remove this entry once one exists"
+
+[[IgnoredVulns]]
+id = "GHSA-hg6j-4rv6-33pg"
+ignoreUntil = 2026-08-15
+reason = "aiohttp held at 3.13.5: vcrpy releases <= 8.1.1 cannot import aiohttp >= 3.14 and the merged upstream fix (vcrpy PR 996) is unreleased; bump aiohttp and drop this entry when a newer vcrpy ships"
+
+[[IgnoredVulns]]
+id = "GHSA-jg22-mg44-37j8"
+ignoreUntil = 2026-08-15
+reason = "aiohttp held at 3.13.5: vcrpy releases <= 8.1.1 cannot import aiohttp >= 3.14 and the merged upstream fix (vcrpy PR 996) is unreleased; bump aiohttp and drop this entry when a newer vcrpy ships"