Commit-aware SCA for forked dependencies.

---

ForkGuard is part of the ForkGuard multi-repository project from Ozark Security Labs. It exists to make vulnerability analysis for forked open-source dependencies evidence-based, reproducible, and auditable.

Go CLI, local SQLite store, OSV ingestion, git ancestry checks, patch-id equivalence, JSON/SARIF/table reporting, and optional rule registry consumption.

Quickstart

This repository is currently bootstrapped with planning, governance, and issue tracking. The implementation milestones are tracked in GitHub Issues.

make demo

Sample output

Expected command shape once the implementation milestones land:

forkguard scan --fork mycompany/openssl-internal
forkguard report --scan 1 --format table

What you get

• A public, Apache-2.0 project with a documented milestone plan.
• Deterministic dependency and workflow policy from day one.
• GitHub Issues sized for autonomous and community contributors.
• Cross-repository coordination contracts for the CLI, rulegen toolkit, and benchmark harness.

Output formats

Format	Use it for
Markdown	Human review, documentation, and PR summaries
JSON	Automation, IPC, and downstream tooling
SARIF	GitHub code scanning and security dashboards

CI integration

Repository workflows use fixed runner labels and full-SHA-pinned GitHub Actions. Dependency determinism runs in enforce mode at low severity.

- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
- uses: Ozark-Security-Labs/deterministic-deps@838ba7893ec59d17e7883fbc1629a222dacb431b
  with:
    mode: enforce
    severity-threshold: low

See docs/dependency-policy.md and docs/SUPPLY_CHAIN.md.

Project status

Planning and bootstrap. v0.1 PoC work is tracked in milestones M1–M6.

Documentation

Document	Contents
docs/architecture.md	Primary design and implementation plan
docs/cross-repo-dependencies.md	Coordination points across the ForkGuard repos
docs/dependency-policy.md	Deterministic dependency and workflow pinning policy
docs/SUPPLY_CHAIN.md	Supply-chain review and CI security expectations
docs/RELEASES.md	Versioning and release process
CONTRIBUTING.md	Contribution workflow and DCO sign-off

Security

This project is intended for authorized, defensive security analysis. Report vulnerabilities privately via GitHub Security Advisories or the process in SECURITY.md.

Supply-chain posture:

• GitHub Actions are pinned to full commit SHAs.
• Package manager lockfiles are committed and reviewed once implementation dependencies are introduced.
• deterministic-deps runs in enforce mode with severity-threshold: low.
• CI permissions are least-privilege and SARIF upload scopes are isolated.

Contributing

Contributions are welcome. Start with issues labeled good-first-issue or help-wanted.

• CONTRIBUTING.md — contribution flow and DCO sign-off
• CODE_OF_CONDUCT.md — community standards
• GOVERNANCE.md — maintainership and decision-making
• SUPPORT.md — getting help

Non-goals

This repository will not provide exploit automation, live attack workflows, credential collection, or claims unsupported by verifiable evidence.

License

ForkGuard is licensed under the Apache License 2.0.