GitHub Action Reference

CVE Lite CLI ships a first-party GitHub Action on the GitHub Marketplace.

- uses: OWASP/cve-lite-cli@v1
  with:
    fail-on: high
    sarif: "true"

All inputs are optional. The action installs CVE Lite CLI, runs the scan, and exits with the scan's exit code so CI fails the same way the CLI does.

For usage patterns and complete workflow examples, see Workflow Integration.

---

Scan inputs

Input	Default	Description	Example
path	.	Project path to scan	path: ./packages/app
fail-on	(none)	Exit non-zero at or above this severity (critical, high, medium, low)	fail-on: high
all	false	Show all findings regardless of severity threshold	all: "true"
verbose	false	Full output: severity table, fix plan, findings table, coverage notes	verbose: "true"
prod-only	false	Exclude dev dependencies where available	prod-only: "true"
no-cache	true	Skip the OSV query cache and fetch fresh results; defaults to true in CI. Ignored when offline mode is active (offline, offline-db, or sync-advisories) because the CLI rejects --no-cache with --offline/--offline-db	no-cache: "false"

---

Output inputs

Input	Default	Description	Example
sarif	false	Write SARIF 2.1.0 output to a timestamped .sarif file for GitHub Code Scanning upload	sarif: "true"
report	(none)	Write an HTML report to this directory path; --no-open is applied automatically	report: "./cve-report"
sbom	(none)	SBOM format to emit: cyclonedx (1.6), spdx or spdx2.3 (2.3). Takes precedence over cdx when set (not available in v1.38.0 or earlier tags)	sbom: spdx
sbom-inventory-only	false	Omit the vulnerability overlay from SPDX SBOM output, leaving a pure inventory (applies to sbom: spdx or spdx2.3; CycloneDX output is unchanged)	sbom-inventory-only: "true"
cdx	false	(Alias for sbom: cyclonedx.) Write a CycloneDX 1.6 SBOM to a timestamped .cdx.json file	cdx: "true"

---

Pull request delta inputs

Input	Default	Description	Example
delta	false	On pull_request events, scan the PR base commit (github.event.pull_request.base.sha) and post a single PR comment listing only the findings this PR introduced or resolved. Requires cve-lite-cli >= 1.36 (the version input) and pull-requests: write on the workflow. Fork PRs get the rendered delta in the job summary instead, because GITHUB_TOKEN is read-only there.	delta: "true"

name: Dependency Scan

on: pull_request

permissions:
  pull-requests: write  # required to post/update the delta comment
  contents: read        # required for actions/checkout and the base fetch

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: OWASP/cve-lite-cli@v1
        with:
          delta: "true"

• Only runs on pull_request events; on other events the step skips with a notice.
• Nothing is posted when the finding set did not change. On subsequent pushes, one comment (matched by the action's marker and the github-actions[bot] author) is updated in place.
• Fork PRs: the delta is written to the job summary only. The action deliberately does not use pull_request_target or an alternate token to post there.
• The base commit is fetched automatically when the checkout is shallow; if it cannot be obtained, the step fails with an explanation (check out with fetch-depth: 0).

---

Offline inputs

Input	Default	Description	Example
offline	false	Run using the local advisory database only - no OSV API calls	offline: "true"
offline-db	(empty)	Path to the advisory DB file; when offline mode is active and this is not set, defaults to ./.cache/cve-lite/advisories.db	offline-db: ./.cache/advisories.db
sync-advisories	false	Build or refresh the local advisory database before scanning	sync-advisories: "true"

---

Usage and reachability inputs

Input	Default	Description	Example
usage	false	Scan source files to detect which vulnerable packages are actually imported	usage: "true"
only-used	false	Only report findings for packages imported in source code (implies usage)	only-used: "true"

---

Override hygiene inputs

Input	Default	Description	Example
check-overrides	false	Run override hygiene checks (OA001-OA011, PD001-PD002) inline with the scan	check-overrides: "true"
check-maintenance	false	Run maintenance risk checks (DM001) inline with the scan	check-maintenance: "true"
overrides	false	Run a dedicated override audit as a separate step in addition to the scan	overrides: "true"
overrides-fail-on	(none)	Exit non-zero when the override audit finds an issue at or above this severity (used with overrides: true)	overrides-fail-on: high
check-network	false	Allow the network-backed override rules to make registry calls: OA007 (drift) and OA010 (floor admits a vulnerable version). Applies to the dedicated audit step only, so it needs overrides: "true". With check-overrides alone both rules are reported as skipped.	check-network: "true"
audit-log	(none)	Stream override detection and fix events as NDJSON to this path	audit-log: ./audit.ndjson

---

Network and proxy inputs

Input	Default	Description	Example
ca-cert	(none)	Path to a PEM CA certificate file for corporate SSL inspection proxies	ca-cert: ./certs/ca.pem

---

Fix mode inputs

Input	Default	Description	Example
fix	false	Apply validated direct dependency upgrades automatically. Only direct dependencies with OSV-validated fix versions are upgraded.	fix: "true"
create-pr	false	Open or update a single batched pull request with the applied fixes. Requires fix: true and contents: write + pull-requests: write permissions on the workflow.	create-pr: "true"
base-branch	(repo default)	Target branch for the fix PR. Defaults to the repository's default branch.	base-branch: main
labels	dependencies,security	Comma-separated labels applied to the fix PR. Labels are created in the repo if they do not exist.	labels: "deps,security,automated"
token	(workflow token)	GitHub token for PR creation. Leave empty to use the built-in workflow token. Must have contents: write and pull-requests: write.	token: ${{ secrets.GITHUB_TOKEN }}

---

Scheduled fix workflow (Dependabot alternative)

Add this file to your repository as .github/workflows/cve-lite-fix.yml to automatically open a pull request with validated dependency upgrades every week:

name: CVE Lite security fixes

on:
  schedule:
    - cron: '0 6 * * 1'  # every Monday at 6am UTC
  workflow_dispatch:      # allow manual runs

permissions:
  contents: write
  pull-requests: write

jobs:
  fix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.repository.default_branch }}

      - uses: OWASP/cve-lite-cli@v1
        with:
          fix: 'true'
          create-pr: 'true'

Three things to get right:

• No push trigger. The Action force-pushes to the cve-lite/fix branch. A push trigger would re-run the workflow on that push, causing an infinite loop.
• No persist-credentials: false on checkout. The default (credentials persisted) is required for git push to work. If your existing scan workflow uses persist-credentials: false, do not copy that flag here.
• No fail-on. Not appropriate in fix mode. Transitive findings will always remain after direct fixes are applied; failing the job on them would prevent the PR from being created.

How it behaves:

• If there are no direct dependency fixes available, the workflow exits silently with no PR.
• If a cve-lite/fix PR is already open, the next weekly run updates it in place with the latest findings.
• If the open PR was merged or closed, the next run creates a fresh PR.
• The PR body lists each upgraded package with its advisory IDs (GHSA-xxxx, CVE-xxxx) and before/after finding counts.

---

Action setup inputs

Input	Default	Description	Example
version	1	CVE Lite CLI version to install (1, 1.24.0, latest)	version: "1.24.0"
node-version	24	Node.js version used to install and run CVE Lite CLI	node-version: "26"