lottie-player

lottie-player copied to clipboard

Integrate vet to automate vetting of OSS packages for security vulnerabilities and other risks. The policy is configured to be minimal, checking only for critical & high risk vulnerabilities, malicious libraries. The policy can be fine tuned / improved based on usage.

Example

For PRs raised from a branch in this repository, vet will add a PR comment with vetting results. Example:

For PRs raised from forked repositories, GitHub by default offer a read only GITHUB_TOKEN to actions. This is a security feature to prevent malicious actions to perform write operations in a repository through forks. When such a PR is raised, vet cannot add a PR comment without compromising on security (possible with pull_request_target but it has a security cost). Instead, the action will fail on policy violation and the policy violation is visible in the action output.

Our Usage

We use vet to vet our own packages.

Example PR vetted by vet:

https://github.com/safedep/vet/pull/239#issuecomment-2331412400

Example policy using which the vetting was done:

https://github.com/safedep/vet/blob/main/.github/vet/policy.yml

Support

If you need help with fine tuning policy or have any questions, please tag @abhisek and I am happy to contribute to your project.