ci: Integrate vet for scanning OSS components during PR

[abhisek]

Integrate vet to automate vetting of OSS packages for security vulnerabilities and other risks. The policy is configured to be minimal, checking only for critical & high risk vulnerabilities, malicious libraries. The policy can be fine tuned / improved based on usage.

Example

For PRs raised from a branch in this repository, vet will add a PR comment with vetting results. Example:

For PRs raised from forked repositories, GitHub by default offer a read only GITHUB_TOKEN to actions. This is a security feature to prevent malicious actions to perform write operations in a repository through forks. When such a PR is raised, vet cannot add a PR comment without compromising on security (possible with pull_request_target but it has a security cost). Instead, the action will fail on policy violation and the policy violation is visible in the action output.

Our Usage

We use vet to vet our own packages.

Example PR vetted by vet:

safedep/vet#239 (comment)

Example policy using which the vetting was done:

https://github.com/safedep/vet/blob/main/.github/vet/policy.yml

Support

If you need help with fine tuning policy or have any questions, please tag @abhisek and I am happy to contribute to your project.

[changeset-bot]

⚠️ No Changeset found

Latest commit: c98e568

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR