name: OSV Scan

on:
  pull_request:
    branches:
      - main
      - litellm_internal_staging
      - litellm_oss_staging
      - "litellm_**"
  schedule:
    - cron: "23 6 * * *"
  workflow_dispatch:

permissions: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  osv-scan:
    name: osv-scan
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false

      - name: Download osv-scanner v2.3.8
        run: |
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/osv-scanner" \
            https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
          echo "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc  $RUNNER_TEMP/osv-scanner" | sha256sum -c -
          chmod +x "$RUNNER_TEMP/osv-scanner"

      - name: Scan lockfiles
        run: |
          "$RUNNER_TEMP/osv-scanner" scan source \
            --config osv-scanner.toml \
            -L uv.lock \
            -L ui/litellm-dashboard/package-lock.json