Add scheduled OSV-Scanner workflow for existing dependency vulnerabilities #2017

Activity

1. optimization2026 commented on Jun 30, 2026

   

   optimization2026

   on Jun 30, 2026

   More actions

   I think this fits well as a scheduled security workflow, but it should have a clear contract.

   A scheduled OSV scanner should define:

   trigger
     -> dependency inventory
     -> scan
     -> classify findings
     -> deduplicate
     -> create/update issue or report
     -> avoid alert spam
   

   A standard AISP-style contract could look like:

   [
     {
       "role": "system",
       "content": {
         "protocol": "AISP V1.0.0",
         "axiom_0": "Human_Sovereignty_and_Wellbeing",
         "id": "gstack_scheduled_osv_scan_aisp",
         "name": "gstack Scheduled OSV Scan Workflow",
         "version": "1.0.0",
         "license": "MIT",
         "summary": "Machine-checkable contract for scheduled OSV dependency vulnerability scans.",
         "flow_format": "mermaid",
         "loading_mode": "node",
         "tools": ["filesystem", "shell", "github"],
         "params": {
           "repo_root": "string",
           "schedule": "string"
         },
         "system_prompt": ""
       }
     },
     {
       "role": "user",
       "content": {
         "instruction": "STRICTLY OBEY aisp_contract; its non_negotiable rules are inviolable; then RUN aisop.main",
         "user_input": "{user_input}",
         "aisp_contract": {
           "profile": "aisp.skill.v1",
           "invocation": {
             "mode": "scheduled_security_workflow",
             "when_to_use": [
               "on scheduled dependency security scan",
               "before release gate",
               "when dependency manifests change"
             ],
             "when_not_to_use": [
               "non-security dependency update with no scan requested"
             ]
           },
           "non_negotiable": [
             {
               "rule": "Do not create duplicate alerts for the same OSV finding.",
               "enforced_by": "dedupe.step2:sys.assert"
             },
             {
               "rule": "Critical findings must be surfaced with affected package, version, advisory, and remediation path.",
               "enforced_by": "report.step2:sys.assert"
             },
             {
               "rule": "Scheduled scanner must record scan timestamp and dependency manifest hash.",
               "enforced_by": "trace.step2:sys.assert"
             }
           ],
           "discovery": {
             "category": "security_workflow",
             "tags": ["gstack", "osv", "dependencies", "security", "scheduled", "aisp"]
           },
           "risk_level": "high",
           "resources": [
             {
               "id": "repo",
               "path": "{repo_root}",
               "kind": "repository",
               "mode": "read_only",
               "when": "Read during dependency scan.",
               "scope": "skill"
             }
           ]
         },
         "aisop": {
           "main": "graph TD\n    inventory[Build dependency inventory] --> scan[Run OSV scan]\n    scan --> classify[Classify findings]\n    classify --> dedupe[Deduplicate existing alerts]\n    dedupe --> report[Report or update issue]\n    report --> trace[Record scan trace]\n    trace --> end_node((End))"
         },
         "functions": {
           "inventory": {
             "step1": "Find dependency manifests and compute manifest hashes.",
             "output_mapping": "dependency_inventory"
           },
           "scan": {
             "step1": "Run OSV scanner against dependency_inventory.",
             "output_mapping": "osv_findings"
           },
           "classify": {
             "step1": "Classify findings by severity, exploitability, affected package, and fix availability.",
             "output_mapping": "classified_findings"
           },
           "dedupe": {
             "step1": "Compare classified_findings against existing reports/issues.",
             "step2": "sys.assert('duplicate findings are not re-reported', 'OSV scan must deduplicate repeated findings')",
             "output_mapping": "deduped_findings"
           },
           "report": {
             "step1": "Create or update report with affected package, version, advisory, severity, and remediation.",
             "step2": "sys.assert('critical findings include remediation path', 'Critical OSV findings require remediation guidance')",
             "output_mapping": "security_report"
           },
           "trace": {
             "step1": "Record scan timestamp, manifest hashes, scanner version, finding count, and report destination.",
             "step2": "sys.assert('scan trace includes timestamp and manifest hash', 'Scheduled scan must be traceable')",
             "output_mapping": "osv_scan_trace"
           },
           "end_node": {
             "step1": "Return security_report and osv_scan_trace."
           }
         }
       }
     }
   ]

   This keeps the workflow useful without alert spam.

   The key invariant:

   scheduled security scans should be traceable, deduplicated, and actionable.
   
2. capy-ai commented on Oct 2, 2026

   

   capy-aiBot

   on Oct 2, 2026 – with Capy AI

   Contributor

   More actions

   Verified on main (v1.91.13.0): .github/workflows/osv-scanner.yml runs OSV-Scanner on a weekly schedule (cron: '23 7 * * 1') using the pinned reusable workflow, with an ignore ledger for justified exceptions. Added in v1.65.0.0 (#2577). Thanks for the suggestion! Reply here if you'd like something more from it and we'll reopen.
3. capy-ai

   closed this as completedon Oct 2, 2026