ci: scan every manifest against OSV on pull requests

[ReneWerner87]

Stacked on #5297. Base is claude/cloudflare-workers-bun-security, so this diff shows only the CI change. Merging #5297 first retargets this to master automatically.

Stacking is what makes this check meaningful here: on master alone it fails on the four cloudflare-workers/bun.lock packages #5297 fixes. On top of #5297 it passes clean, so the check is green from the moment it lands.

Follow-up to #5290. This is the piece that stops the alerts from coming back rather than fixing another round of them.

Why alerts kept reappearing

Dependabot alerts are necessary but not sufficient here. They report drift after an advisory lands, and only for the ecosystems and manifests Dependabot is configured to see. Both limits bit this repository:

• cloudflare-workers/bun.lock had no matching package-ecosystem entry at all, invisible for months (fix(security): update cloudflare-workers dependencies and add bun ecosystem #5297)
• an allow: dependency-type: "direct" filter hid every transitive npm advisory (fixed in fix(security): resolve recurring Dependabot alerts in npm templates #5290)
• pnpm's auto-installed peer dependencies (esbuild, yaml, @sveltejs/vite-plugin-svelte) were never re-resolved once pinned

Nothing in CI would have caught any of those. The manifests sat frozen while the advisory database moved.

What this adds

A check that resolves every manifest in the tree (go.mod, pnpm-lock.yaml, package-lock.json and bun.lock) against OSV.dev on each pull request. A lockfile that quietly falls behind now fails a check instead of accumulating alerts nobody looks at.

It also runs weekly, so advisories published against unchanged manifests surface on their own rather than waiting for the next unrelated PR. That case is the one Dependabot handles worst and the one that produced most of the recent noise.

osv-scanner is pinned to v2.4.0 and installed via go install, so the version is reproducible and there is no action tag to drift.

Accepted findings

osv-scanner.toml holds the exceptions, currently exactly one:

ID	Reason
GO-2026-5932	"golang.org/x/crypto/openpgp is unmaintained." No fixed version (covers all releases, v0.54.0 is latest), no GHSA identifier, and scoped to import paths nothing here uses.

Keeping exceptions in a file that has to be edited to grow makes each accepted risk a deliberate decision, rather than an alert that silently stays open. The file's header asks for a reason and warns against ignoring anything that could simply be upgraded.

Verification

Run locally against this tree:

• on master alone: reports hono@4.11.9 (28), undici@7.18.2 (11), ws@8.18.0 (2), sharp@0.34.5 (1), exit 1
• on this stacked branch (with fix(security): update cloudflare-workers dependencies and add bun ecosystem #5297): No issues found, 88 filtered (the x/crypto entry across 88 modules), exit 0

It independently reproduced the findings from #5290 and #5297 without being given them, and correctly does not flag the Fiber v2 module-graph entry from #5300, since that one never reaches the build list.

[Copilot]

Pull request overview

Adds a new CI workflow that runs osv-scanner against all dependency manifests/lockfiles on pull requests (and weekly) to catch vulnerable/stale lockfiles early, plus a repository-scoped exceptions file for accepted findings.

Changes:

• Add .github/workflows/osv-scanner.yml to run osv-scanner scan source -r on PRs, pushes, and a weekly schedule.
• Add osv-scanner.toml to centrally track accepted/ignored findings with documented rationale.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
.github/workflows/osv-scanner.yml	Introduces an OSV scanning workflow for PR-time and scheduled dependency vulnerability detection.
osv-scanner.toml	Defines the ignore list and rationale for accepted OSV findings used by the workflow.

Suppressed comments (1)

.github/workflows/osv-scanner.yml:50

• Similarly, actions/setup-go is pinned by SHA elsewhere in this repo. Pinning here (and aligning to the same version) avoids unreviewed changes to the Go toolchain setup action.

      - name: Set up Go
        uses: actions/setup-go@v6
        with:
          go-version: stable
          cache: false

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/osv-scanner.yml:48

• This workflow uses floating action tags (actions/checkout@v6, actions/setup-go@v6). Elsewhere in this repo the same actions are pinned to a commit SHA (e.g. .github/workflows/codeql.yml and gobuild.yml), which avoids supply-chain risk and prevents unexpected changes from landing in CI. Please pin these actions to the same SHAs used elsewhere (or update consistently if you intend a newer version).

      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Go
        uses: actions/setup-go@v6
        with:

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[ReneWerner87]

Closing at the maintainer's request, not merging.

Worth recording for anyone reading this later: the structural fix for the recurring alerts does not depend on this PR. Both causes were configuration problems in .github/dependabot.yml, and both are already on master:

• the allow: dependency-type: "direct" filter, which suppressed security updates for every transitive npm package, removed in fix(security): resolve recurring Dependabot alerts in npm templates #5290
• the missing bun package-ecosystem entry, which left cloudflare-workers/bun.lock invisible to Dependabot entirely, added in fix(security): update cloudflare-workers dependencies and add bun ecosystem #5297

With those in place Dependabot can reach the packages it previously could not, which is what let the alerts accumulate in the first place. This PR would have added a second, independent check on top: a weekly scan catching advisories published against manifests that have not changed, which is the case Dependabot handles least well. That is defence in depth rather than a missing piece.

---

Generated by Claude Code