Open Source Vulnerabilities (OSV) step configuration

Scan code repositories with OSV

You can scan your code repositories using Open Source Vulnerabilities (OSV) and ingest your results into Harness STO. OSV supports a variety of languages and lockfiles.

Important notes for running OSV scans in STO

Root access requirements

For more information

OSV step settings for STO scans

The recommended workflow is to add an OSV step to a Security or Build stage and then configure it as described below.

Scan

Scan Mode

Scan Configuration

Target

Type

Target and Variant Detection

Name

Variant

Ingestion

Ingestion File

Log Level

Additional CLI flags

Use this field to run the osv scanner with flags such as:

--lockfile=/path/to/your/package-lock.json --lockfile=/path/to/another/Cargo.lock

With these flags, the osv scanner scans vulnerabilities in the two specified lockfiles.

Fail on Severity

Settings

Additional Configuration

Advanced settings

Configure OSV as a Built-in Scanner

The OSV scanner is available as a built-in scanner in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for SCA in the step palette or navigate to the Built-in Scanners section and select the SCA step.

2. Select OSV from the list of scanners.

3. Expand the Additional CLI Flags section if you want to configure optional CLI flags.

4. Click Add Scanner to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.

Proxy settings

YAML pipeline example

If you copy and paste the following example, make sure you update the placeholders for your project, Git connector, and build infrastructure.

pipeline:
  projectIdentifier: YOUR_HARNESS_PROJECT
  orgIdentifier: default
  tags: {}
  properties:
    ci:
      codebase:
        connectorRef: YOUR_GITHUB_CONNECTOR
        repoName: <+stage.variables.GITHUB_REPO>
        build: <+input>
  stages:
    - stage:
        name: osv_scan
        identifier: osv_scan
        type: SecurityTests
        spec:
          cloneCodebase: true
          infrastructure:
            type: KubernetesDirect
            spec:
              connectorRef: YOUR_KUBERNETES_CLUSTER_CONNECTOR_ID
              namespace: YOUR_NAMESPACE
              automountServiceAccountToken: true
              nodeSelector: {}
              os: Linux
          sharedPaths:
            - /var/run
          execution:
            steps:
              - step:
                  type: OsvScanner
                  name: OsvScanner_1
                  identifier: OsvScanner_1
                  spec:
                    mode: orchestration
                    config: default
                    target:
                      type: repository
                      detection: manual
                      name: <+stage.variables.GITHUB_REPO>
                      variant: <+stage.variables.GITHUB_BRANCH>
                    advanced:
                      log:
                        level: info
                      fail_on_severity: medium
          slsa_provenance:
            enabled: false
          caching:
            enabled: false
            paths: []
        variables:
          - name: GITHUB_REPO
            type: String
            description: ""
            required: false
            value: <+input>
          - name: GITHUB_BRANCH
            type: String
            description: ""
            required: false
            value: <+input>
        when:
          pipelineStatus: Success
        description: ""
  identifier: osvnodegoat
  name: osv-nodegoat