Dependency Security Scanning in GitHub Actions

Add automatic CVE scanning to your GitHub Actions pipeline. Catch vulnerable dependencies on every push before they reach production.

Option 1 — OSV Scanner (recommended)

Google's OSV Scanner uses the same database as PackageFix. Works for all 7 ecosystems.

name: Dependency Security Scan
on: [push, pull_request]

jobs:
  osv-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google/osv-scanner-action@v2
        with:
          scan-args: |-
            --lockfile=package-lock.json

Option 2 — npm audit (npm projects)

name: npm Security Scan
on: [push, pull_request]

jobs:
  npm-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm audit --audit-level=high

Option 3 — pip-audit (Python projects)

name: Python Security Scan
on: [push, pull_request]

jobs:
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
      - run: pip install pip-audit
      - run: pip-audit -r requirements.txt --fail-on critical

Option 4 — bundle-audit (Ruby projects)

name: Ruby Security Scan
on: [push, pull_request]

jobs:
  bundle-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
      - run: gem install bundler-audit
      - run: bundle audit check --update