action.yml

name: "CVE Lite CLI"
description: "Run CVE Lite CLI in GitHub Actions for JS/TS dependency vulnerability scanning."
author: "Sonu Kapoor"

branding:
  icon: "shield"
  color: "green"

inputs:
  node-version:
    description: "Node.js version used to install and run CVE Lite CLI"
    required: false
    default: "24"
  path:
    description: "Project path to scan"
    required: false
    default: "."
  fail-on:
    description: "Exit non-zero at or above this severity"
    required: false
    default: ""
  all:
    description: "Show all findings in the table regardless of severity threshold"
    required: false
    default: "false"
  verbose:
    description: "Run the scan with verbose output"
    required: false
    default: "false"
  prod-only:
    description: "Exclude dev dependencies where available"
    required: false
    default: "false"
  offline:
    description: "Run the scan using the local advisory database"
    required: false
    default: "false"
  offline-db:
    description: "Path to the local advisory database file"
    required: false
    default: ""
  sync-advisories:
    description: "Build or refresh the local advisory database before scanning"
    required: false
    default: "false"
  usage:
    description: "Scan source files to detect which vulnerable packages are actually imported"
    required: false
    default: "false"
  only-used:
    description: "Only report findings for packages that are imported in source code (implies usage)"
    required: false
    default: "false"
  sarif:
    description: "Write SARIF 2.1.0 output to a timestamped .sarif file for GitHub Code Scanning upload"
    required: false
    default: "false"
  no-cache:
    description: "Skip the OSV query cache and fetch fresh results; defaults to true in CI"
    required: false
    default: "true"
  cdx:
    description: "Write CycloneDX 1.4 SBOM to a timestamped .cdx.json file"
    required: false
    default: "false"
  ca-cert:
    description: "Path to a PEM CA certificate file for corporate SSL inspection proxies"
    required: false
    default: ""
  version:
    description: "CVE Lite CLI version to install (e.g. '1.23.1', '1', 'latest')"
    required: false
    default: "1"
  check-overrides:
    description: "Run override hygiene checks (OA001-OA008) inline with the scan and surface findings in the same report"
    required: false
    default: "false"
  overrides:
    description: "Run a dedicated 'cve-lite overrides' audit (OA001-OA008) as a separate step in addition to the scan"
    required: false
    default: "false"
  overrides-fail-on:
    description: "Exit non-zero when the dedicated overrides audit finds an issue at or above this severity (used with overrides: true)"
    required: false
    default: ""
  check-network:
    description: "Allow the override audit to make registry calls for the OA007 drift check; off by default in CI"
    required: false
    default: "false"
  audit-log:
    description: "Stream override detection and fix events as NDJSON change-control to this path"
    required: false
    default: ""
  fix:
    description: "Apply validated direct dependency upgrades automatically"
    required: false
    default: "false"
  create-pr:
    description: "Open or update a pull request with the applied fixes (requires fix: true, and contents: write + pull-requests: write permissions on the workflow)"
    required: false
    default: "false"
  base-branch:
    description: "Target branch for the fix PR. Auto-detects the repo default branch if empty."
    required: false
    default: ""
  labels:
    description: "Comma-separated labels to apply to the fix PR. Labels are created in the repo if they do not exist."
    required: false
    default: "dependencies,security"
  token:
    description: "GitHub token for creating the fix PR. Must have contents: write and pull-requests: write. Leave empty to use the workflow token."
    required: false
    default: ""
  report:
    description: "Write an HTML report to this directory path; --no-open is applied automatically in CI"
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - name: Setup Node
      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
      with:
        node-version: ${{ inputs.node-version }}

    - name: Check for new major version
      shell: bash
      env:
        INPUT_VERSION: ${{ inputs.version }}
      run: |
        LATEST=$(npm view cve-lite-cli version 2>/dev/null || echo "")
        if [[ -z "$LATEST" || "$INPUT_VERSION" == "latest" ]]; then exit 0; fi
        CURRENT_MAJOR="${INPUT_VERSION%%.*}"
        LATEST_MAJOR="${LATEST%%.*}"
        if [[ "$LATEST_MAJOR" -gt "$CURRENT_MAJOR" ]]; then
          echo "::warning::CVE Lite CLI v${LATEST_MAJOR} is available. You are currently using v${CURRENT_MAJOR}.x. Update the 'version' input in your workflow to upgrade."
        fi

    - name: Resolve action inputs
      id: resolve
      shell: bash
      env:
        INPUT_PATH: ${{ inputs.path }}
        INPUT_OFFLINE: ${{ inputs.offline }}
        INPUT_OFFLINE_DB: ${{ inputs.offline-db }}
        INPUT_SYNC_ADVISORIES: ${{ inputs.sync-advisories }}
      run: |
        set -euo pipefail

        project_path="${INPUT_PATH:-.}"
        requested_offline_db="${INPUT_OFFLINE_DB:-}"
        use_offline="false"
        resolved_offline_db=""

        if [[ "${INPUT_OFFLINE}" == "true" || "${INPUT_SYNC_ADVISORIES}" == "true" || -n "${requested_offline_db}" ]]; then
          use_offline="true"
          resolved_offline_db="${requested_offline_db:-./.cache/cve-lite/advisories.db}"
        fi

        {
          echo "project-path=${project_path}"
          echo "use-offline=${use_offline}"
          echo "offline-db=${resolved_offline_db}"
        } >> "$GITHUB_OUTPUT"

    - name: Install CVE Lite CLI
      shell: bash
      env:
        INPUT_VERSION: ${{ inputs.version }}
      run: |
        npm install --prefix "$RUNNER_TEMP/cve-lite-install" "cve-lite-cli@${INPUT_VERSION}"
        echo "$RUNNER_TEMP/cve-lite-install/node_modules/.bin" >> "$GITHUB_PATH"

    - name: Sync local advisory database
      if: ${{ inputs.sync-advisories == 'true' }}
      shell: bash
      working-directory: ${{ github.workspace }}
      env:
        OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
        INPUT_CA_CERT: ${{ inputs.ca-cert }}
      run: |
        set -euo pipefail
        mkdir -p "$(dirname "${OFFLINE_DB_PATH}")"
        sync_args=(advisories sync --output "${OFFLINE_DB_PATH}")
        if [[ -n "${INPUT_CA_CERT}" ]]; then
          sync_args+=("--ca-cert" "${INPUT_CA_CERT}")
        fi
        cve-lite "${sync_args[@]}"

    - name: Set up package manager for fix mode
      if: ${{ inputs.fix == 'true' }}
      shell: bash
      working-directory: ${{ github.workspace }}
      env:
        PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
      run: |
        set -euo pipefail

        cd "${PROJECT_PATH}"

        if [ -f "pnpm-lock.yaml" ]; then
          echo "Detected pnpm lockfile"
          corepack enable pnpm 2>/dev/null || npm install -g pnpm@latest
          echo "pnpm version: $(pnpm --version)"
        elif [ -f "yarn.lock" ]; then
          echo "Detected yarn lockfile"
          corepack enable yarn 2>/dev/null || npm install -g yarn
          echo "yarn version: $(yarn --version)"
        elif [ -f "bun.lock" ] || [ -f "bun.lockb" ]; then
          echo "Detected bun lockfile"
          npm install -g bun
          echo "bun version: $(bun --version)"
        else
          echo "Using npm (package-lock.json detected or fallback)"
          npm --version
        fi

    - name: Run CVE Lite CLI scan
      shell: bash
      working-directory: ${{ github.workspace }}
      env:
        PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
        USE_OFFLINE: ${{ steps.resolve.outputs.use-offline }}
        OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
        INPUT_ALL: ${{ inputs.all }}
        INPUT_FAIL_ON: ${{ inputs.fail-on }}
        INPUT_VERBOSE: ${{ inputs.verbose }}
        INPUT_PROD_ONLY: ${{ inputs.prod-only }}
        INPUT_USAGE: ${{ inputs.usage }}
        INPUT_ONLY_USED: ${{ inputs.only-used }}
        INPUT_SARIF: ${{ inputs.sarif }}
        INPUT_NO_CACHE: ${{ inputs.no-cache }}
        INPUT_CDX: ${{ inputs.cdx }}
        INPUT_CA_CERT: ${{ inputs.ca-cert }}
        INPUT_CHECK_OVERRIDES: ${{ inputs.check-overrides }}
        INPUT_AUDIT_LOG: ${{ inputs.audit-log }}
        INPUT_REPORT: ${{ inputs.report }}
        INPUT_FIX: ${{ inputs.fix }}
      run: |
        set -euo pipefail

        if [[ "${INPUT_FIX}" == "true" && -n "${INPUT_FAIL_ON}" ]]; then
          echo "::warning::fail-on is set with fix: true - job failure is suppressed so the fix step can run. Add a second scan step without fix: true if you want to gate on remaining findings after fixing."
        fi

        args=("${PROJECT_PATH}")

        if [[ "${INPUT_ALL}" == "true" ]]; then
          args+=("--all")
        fi

        if [[ "${INPUT_VERBOSE}" == "true" ]]; then
          args+=("--verbose")
        fi

        if [[ "${INPUT_PROD_ONLY}" == "true" ]]; then
          args+=("--prod-only")
        fi

        if [[ -n "${INPUT_FAIL_ON}" ]]; then
          args+=("--fail-on" "${INPUT_FAIL_ON}")
        fi

        if [[ "${USE_OFFLINE}" == "true" ]]; then
          args+=("--offline-db" "${OFFLINE_DB_PATH}")
        fi

        if [[ "${INPUT_ONLY_USED}" == "true" ]]; then
          args+=("--only-used")
        elif [[ "${INPUT_USAGE}" == "true" ]]; then
          args+=("--usage")
        fi

        if [[ "${INPUT_SARIF}" == "true" ]]; then
          args+=("--sarif")
        fi

        if [[ "${INPUT_NO_CACHE}" == "true" ]]; then
          args+=("--no-cache")
        fi

        if [[ "${INPUT_CDX}" == "true" ]]; then
          args+=("--cdx")
        fi

        if [[ -n "${INPUT_CA_CERT}" ]]; then
          args+=("--ca-cert" "${INPUT_CA_CERT}")
        fi

        if [[ "${INPUT_CHECK_OVERRIDES}" == "true" ]]; then
          args+=("--check-overrides")
        fi

        if [[ -n "${INPUT_AUDIT_LOG}" ]]; then
          args+=("--audit-log" "${INPUT_AUDIT_LOG}")
        fi

        if [[ -n "${INPUT_REPORT}" ]]; then
          args+=("--report" "${INPUT_REPORT}" "--no-open")
        fi

        if [[ "${INPUT_FIX}" == "true" ]]; then
          cve-lite "${args[@]}" || EXIT_CODE=$?
          if [[ "${EXIT_CODE:-0}" -gt 1 ]]; then
            exit "${EXIT_CODE:-0}"
          fi
        else
          cve-lite "${args[@]}"
        fi

    - name: Apply security fixes
      if: ${{ inputs.fix == 'true' }}
      shell: bash
      working-directory: ${{ github.workspace }}
      env:
        PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
        USE_OFFLINE: ${{ steps.resolve.outputs.use-offline }}
        OFFLINE_DB_PATH: ${{ steps.resolve.outputs.offline-db }}
        INPUT_NO_CACHE: ${{ inputs.no-cache }}
        INPUT_CA_CERT: ${{ inputs.ca-cert }}
      run: |
        set -euo pipefail

        args=("${PROJECT_PATH}" "--fix")

        if [[ "${USE_OFFLINE}" == "true" ]]; then
          args+=("--offline-db" "${OFFLINE_DB_PATH}")
        fi

        if [[ "${INPUT_NO_CACHE}" == "true" ]]; then
          args+=("--no-cache")
        fi

        if [[ -n "${INPUT_CA_CERT}" ]]; then
          args+=("--ca-cert" "${INPUT_CA_CERT}")
        fi

        # --fail-on is intentionally not passed: fix mode suppresses the
        # fail-on exit so remaining transitive findings do not block PR creation.
        cve-lite "${args[@]}"

    - name: Create or update fix pull request
      if: ${{ inputs.fix == 'true' && inputs.create-pr == 'true' }}
      shell: bash
      working-directory: ${{ github.workspace }}
      env:
        PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
        INPUT_BASE_BRANCH: ${{ inputs.base-branch }}
        INPUT_LABELS: ${{ inputs.labels }}
        GH_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        GH_TOKEN: ${{ inputs.token != '' && inputs.token || github.token }}
      run: |
        set -euo pipefail

        FIX_RESULT="${PROJECT_PATH}/cve-lite-fix-result.json"

        if [ ! -f "${FIX_RESULT}" ]; then
          echo "::notice::No fix result file found - nothing to PR"
          exit 0
        fi

        APPLIED=$(jq '.appliedFixCount' "${FIX_RESULT}")
        if [ "${APPLIED}" -eq 0 ]; then
          echo "::notice::No direct dependency fixes were applied - no PR needed"
          exit 0
        fi

        cd "${PROJECT_PATH}"

        if [ -z "$(git status --porcelain)" ]; then
          echo "::notice::No dependency file changes detected after fix"
          exit 0
        fi

        git config user.email "github-actions[bot]@users.noreply.github.com"
        git config user.name "github-actions[bot]"

        BASE_BRANCH="${INPUT_BASE_BRANCH:-${GH_DEFAULT_BRANCH}}"
        BRANCH="cve-lite/fix"

        BEFORE=$(jq '.findingsBeforeFix' "${FIX_RESULT}")
        AFTER=$(jq '.findingsAfterFix' "${FIX_RESULT}")
        APPLIED_COUNT=$(jq '.appliedFixCount' "${FIX_RESULT}")
        PKG_COUNT=$(jq '.applied | length' "${FIX_RESULT}")

        if [ "${PKG_COUNT}" -le 3 ]; then
          PKG_LIST=$(jq -r '[.applied[].package] | join(", ")' "${FIX_RESULT}")
        else
          PKG_LIST=$(jq -r '[.applied[:2][].package] | join(", ")' "${FIX_RESULT}")
          EXTRA=$((PKG_COUNT - 2))
          PKG_LIST="${PKG_LIST} +${EXTRA} more"
        fi

        VULN_WORD="vulnerabilities"
        [ "${APPLIED_COUNT}" -eq 1 ] && VULN_WORD="vulnerability"

        TITLE="[CVE-Lite-CLI] fix: upgrade ${PKG_LIST} (${APPLIED_COUNT} ${VULN_WORD} resolved)"

        PKG_LINES=$(jq -r '.applied[] | "- **\(.package)**: `\(.from)` -> `\(.to)`\(if (.advisories | length) > 0 then " (" + (.advisories | join(", ")) + ")" else "" end)"' "${FIX_RESULT}")

        BODY_INTRO="Automated security fixes applied by [CVE Lite CLI](https://owasp.org/cve-lite-cli), an OWASP Lab Project for JS/TS dependency vulnerability scanning."
        BODY_TAIL="Only validated direct dependency upgrades are included. Transitive vulnerabilities require parent package upgrades or upstream releases."
        BODY=$(printf '%s\n\n## Fixed packages\n\n%s\n\n## Scan results\n\n- Findings before: **%s**\n- Findings after: **%s**\n\n%s' \
          "${BODY_INTRO}" "${PKG_LINES}" "${BEFORE}" "${AFTER}" "${BODY_TAIL}")

        for f in package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lock bun.lockb npm-shrinkwrap.json; do
          [ -f "$f" ] && git add -- "$f"
        done

        if [ -z "$(git diff --cached --name-only)" ]; then
          echo "::notice::No dependency files staged - nothing to commit"
          exit 0
        fi

        git commit -m "${TITLE}"

        OPEN_PR_NUMBER=$(gh pr list --head "${BRANCH}" --state open --json number --jq '.[0].number // empty' 2>/dev/null || true)

        git push origin "HEAD:refs/heads/${BRANCH}" --force

        if [ -n "${OPEN_PR_NUMBER}" ]; then
          gh pr edit "${OPEN_PR_NUMBER}" --title "${TITLE}" --body "${BODY}"
          if [ -n "${INPUT_LABELS}" ]; then
            IFS=',' read -ra LABEL_ARRAY <<< "${INPUT_LABELS}"
            for label in "${LABEL_ARRAY[@]}"; do
              label=$(echo "$label" | xargs)
              COLOR="0075ca"
              [ "$label" = "security" ] && COLOR="e11d48"
              gh label create "$label" --color "$COLOR" --force 2>/dev/null || true
              gh pr edit "${OPEN_PR_NUMBER}" --add-label "$label" 2>/dev/null || true
            done
          fi
          echo "::notice::Updated fix PR #${OPEN_PR_NUMBER}"
        else
          PR_URL=$(gh pr create --base "${BASE_BRANCH}" --head "${BRANCH}" --title "${TITLE}" --body "${BODY}")
          PR_NUMBER="${PR_URL##*/}"
          if [ -n "${INPUT_LABELS}" ]; then
            IFS=',' read -ra LABEL_ARRAY <<< "${INPUT_LABELS}"
            for label in "${LABEL_ARRAY[@]}"; do
              label=$(echo "$label" | xargs)
              COLOR="0075ca"
              [ "$label" = "security" ] && COLOR="e11d48"
              gh label create "$label" --color "$COLOR" --force 2>/dev/null || true
              gh pr edit "${PR_NUMBER}" --add-label "$label" 2>/dev/null || true
            done
          fi
          echo "::notice::Created fix PR: ${PR_URL}"
        fi

    - name: Run override hygiene audit
      if: ${{ inputs.overrides == 'true' }}
      shell: bash
      working-directory: ${{ github.workspace }}
      env:
        PROJECT_PATH: ${{ steps.resolve.outputs.project-path }}
        INPUT_OVERRIDES_FAIL_ON: ${{ inputs.overrides-fail-on }}
        INPUT_CHECK_NETWORK: ${{ inputs.check-network }}
        INPUT_AUDIT_LOG: ${{ inputs.audit-log }}
      run: |
        set -euo pipefail

        args=(overrides "${PROJECT_PATH}")

        if [[ -n "${INPUT_OVERRIDES_FAIL_ON}" ]]; then
          args+=("--fail-on" "${INPUT_OVERRIDES_FAIL_ON}")
        fi

        if [[ "${INPUT_CHECK_NETWORK}" == "true" ]]; then
          args+=("--check-network")
        fi

        if [[ -n "${INPUT_AUDIT_LOG}" ]]; then
          args+=("--audit-log" "${INPUT_AUDIT_LOG}")
        fi

        cve-lite "${args[@]}"