mirror of
https://github.com/BerriAI/litellm.git
synced 2026-09-12 23:01:41 +00:00
a519a37c56
* ci: add osv-scanner lockfile scan workflow Daily scheduled scan plus a pull_request scan scoped to uv.lock and the dashboard package-lock.json. The osv-scanner v2.3.8 binary is fetched by full release URL and verified against its official SHA-256 before use; the job needs no credentials and runs with contents: read only. osv-scanner.toml carries the single suppression for the diskcache advisory, which has no fixed release published * ci: temporary push trigger for runtime verification (will be dropped) * ci: harden osv-scan per review (RUNNER_TEMP, job-scoped permissions, suppression expiry) * ci: drop temporary push trigger after runtime verification * ci: suppress aiohttp advisories while vcrpy blocks the 3.14 bump Time-boxed like the diskcache entry: ignoreUntil forces a dated re-triage if no vcrpy release has shipped by then
49 lines
1.3 KiB
YAML
49 lines
1.3 KiB
YAML
name: OSV Scan
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- litellm_internal_staging
|
|
- litellm_oss_branch
|
|
- "litellm_**"
|
|
paths:
|
|
- uv.lock
|
|
- ui/litellm-dashboard/package-lock.json
|
|
- osv-scanner.toml
|
|
- .github/workflows/osv-scan.yml
|
|
schedule:
|
|
- cron: "23 6 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
osv-scan:
|
|
name: osv-scan
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Download osv-scanner v2.3.8
|
|
run: |
|
|
curl -fsSL --retry 3 -o "$RUNNER_TEMP/osv-scanner" \
|
|
https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64
|
|
echo "bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc $RUNNER_TEMP/osv-scanner" | sha256sum -c -
|
|
chmod +x "$RUNNER_TEMP/osv-scanner"
|
|
|
|
- name: Scan lockfiles
|
|
run: |
|
|
"$RUNNER_TEMP/osv-scanner" scan source \
|
|
--config osv-scanner.toml \
|
|
-L uv.lock \
|
|
-L ui/litellm-dashboard/package-lock.json
|