Skip to content
This repository was archived by the owner on Aug 16, 2025. It is now read-only.

Commit f2c5c96

Browse files
alexcoderabbitaialexcoderabbitai
committed
adding osv-scanner
1 parent bf13a49 commit f2c5c96

File tree

3 files changed

+80
-42
lines changed

3 files changed

+80
-42
lines changed

‎docs/changelog.md

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,14 @@ description: The latest updates and changes to CodeRabbit.
55
sidebar_position: 13
66
---
77

8+
## August 14, 2025
9+
10+
### OSV-Scanner Integration
11+
12+
We've added support for [OSV-Scanner](https://github.com/google/osv-scanner), Google's vulnerability scanner that identifies security vulnerabilities in your project's dependencies and installed packages using the [OSV.dev](https://osv.dev) database.
13+
14+
OSV-Scanner requires an `osv-scanner.toml` configuration file to run. See our [OSV-Scanner documentation](/tools/osv-scanner) for more details.
15+
816
## August 4, 2025
917

1018
### Model Context Protocol (MCP) Server Integration - Early Access

‎docs/tools/list.md

Lines changed: 43 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -9,48 +9,48 @@ For more information about fine-tuning the CodeRabbit configuration of a tool, c
99

1010
For an overview of how CodeRabbit uses these tools when generating code reviews, as well as general information about controlling their use, see [Configure third-party tools](/tools/).
1111

12-
| Technology | Tools | Category |
13-
| :-------------------------- | :--------------------------------------------------------- | :-------------------------------------------------- |
14-
| All | [Gitleaks][Gitleaks], [Pipeline Remediation][Pipeline] | Code Security, CI/CD |
15-
| Azure DevOps Pipelines | [Pipeline Remediation][Pipeline] | CI/CD Failure Remediation |
16-
| CircleCI | [CircleCI][CircleCI], [Pipeline Remediation][Pipeline] | Configuration Validation, CI/CD Failure Remediation |
17-
| CloudFormation | [Checkov][Checkov] | Code Security |
18-
| Cppcheck | [Cppcheck][Cppcheck] | Code Quality |
19-
| CSS | [Biome][Biome] | Code Quality |
20-
| Docker | [Hadolint][Hadolint], [Checkov][Checkov] | Code Quality, Code Security |
21-
| Environment Files (.env) | [Dotenv Linter][DotenvLinter] | Code Quality |
22-
| GitHub Actions | [actionlint][actionlint], [Pipeline Remediation][Pipeline] | Code Quality, CI/CD Failure Remediation |
23-
| GitLab Pipelines | [Pipeline Remediation][Pipeline] | CI/CD Failure Remediation |
24-
| Go | [golangci-lint][golangci-lint] | Code Quality |
25-
| Helm | [Checkov][Checkov] | Code Security |
26-
| HTML | [HTMLHint][HTMLHint] | Code Quality |
27-
| Javascript | [Biome][Biome], [oxlint][oxlint] | Code Quality |
28-
| JSON, JSONC | [Biome][Biome] | Code Quality |
29-
| JSX | [Biome][Biome], [oxlint][oxlint] | Code Quality |
30-
| Kotlin | [detekt][detekt] | Code Quality |
31-
| Kubernetes | [Checkov][Checkov] | Code Security |
32-
| Lua | [Luacheck][Luacheck] | Code Quality |
33-
| Makefile | [Checkmake][Checkmake] | Code Quality |
34-
| Markdown | [markdownlint][markdownlint], [LanguageTool][LanguageTool] | Code Quality, Grammar Checking |
35-
| PHP | [PHPStan][PHPStan], [PHPMD][PHPMD], [PHPCS][PHPCS] | Code Quality |
36-
| Plaintext | [LanguageTool][LanguageTool] | Grammar and Spell Checking |
37-
| Java | [PMD][PMD] | Code Quality |
38-
| Protobuf | [Buf][Buf] | Code Quality |
39-
| Python | [Ruff][Ruff], [Pylint][Pylint], [Flake8][Flake8] | Code Quality |
40-
| Jupyter Notebooks | [Ruff][Ruff], [Pylint][Pylint], [Flake8][Flake8] | Code Quality |
41-
| Regal | [Regal][Regal] | Code Quality |
42-
| Ruby | [RuboCop][RuboCop], [Brakeman][Brakeman] | Code Quality, Code Security |
43-
| Rust | [Clippy][Clippy] | Code Quality |
44-
| Semgrep | [Semgrep][Semgrep] | Code Security |
45-
| Shell (sh, bash, ksh, dash) | [ShellCheck][ShellCheck] | Code Quality |
46-
| Shopify | [Shopify CLI][ShopifyCLI] | Code Quality |
47-
| SQL | [SQLFluff][SQLFluff] | Code Quality |
48-
| Swift | [SwiftLint][SwiftLint] | Code Quality |
49-
| Terraform | [Checkov][Checkov] | Code Security |
50-
| TSX | [Biome][Biome], [oxlint][oxlint] | Code Quality |
51-
| Typescript | [Biome][Biome], [oxlint][oxlint] | Code Quality |
52-
| YAML | [YAMLlint][YAMLlint] | Code Quality |
53-
| Prisma | [Prisma Lint][PrismaLint] | Code Quality |
12+
| Technology | Tools | Category |
13+
| :-------------------------- | :-------------------------------------------------------------------------------- | :-------------------------------------------------- |
14+
| All | [Gitleaks][Gitleaks], [OSV-Scanner][OSVScanner], [Pipeline Remediation][Pipeline] | Code Security, CI/CD |
15+
| Azure DevOps Pipelines | [Pipeline Remediation][Pipeline] | CI/CD Failure Remediation |
16+
| CircleCI | [CircleCI][CircleCI], [Pipeline Remediation][Pipeline] | Configuration Validation, CI/CD Failure Remediation |
17+
| CloudFormation | [Checkov][Checkov] | Code Security |
18+
| Cppcheck | [Cppcheck][Cppcheck] | Code Quality |
19+
| CSS | [Biome][Biome] | Code Quality |
20+
| Docker | [Hadolint][Hadolint], [Checkov][Checkov] | Code Quality, Code Security |
21+
| Environment Files (.env) | [Dotenv Linter][DotenvLinter] | Code Quality |
22+
| GitHub Actions | [actionlint][actionlint], [Pipeline Remediation][Pipeline] | Code Quality, CI/CD Failure Remediation |
23+
| GitLab Pipelines | [Pipeline Remediation][Pipeline] | CI/CD Failure Remediation |
24+
| Go | [golangci-lint][golangci-lint] | Code Quality |
25+
| Helm | [Checkov][Checkov] | Code Security |
26+
| HTML | [HTMLHint][HTMLHint] | Code Quality |
27+
| Javascript | [Biome][Biome], [oxlint][oxlint] | Code Quality |
28+
| JSON, JSONC | [Biome][Biome] | Code Quality |
29+
| JSX | [Biome][Biome], [oxlint][oxlint] | Code Quality |
30+
| Kotlin | [detekt][detekt] | Code Quality |
31+
| Kubernetes | [Checkov][Checkov] | Code Security |
32+
| Lua | [Luacheck][Luacheck] | Code Quality |
33+
| Makefile | [Checkmake][Checkmake] | Code Quality |
34+
| Markdown | [markdownlint][markdownlint], [LanguageTool][LanguageTool] | Code Quality, Grammar Checking |
35+
| PHP | [PHPStan][PHPStan], [PHPMD][PHPMD], [PHPCS][PHPCS] | Code Quality |
36+
| Plaintext | [LanguageTool][LanguageTool] | Grammar and Spell Checking |
37+
| Java | [PMD][PMD] | Code Quality |
38+
| Protobuf | [Buf][Buf] | Code Quality |
39+
| Python | [Ruff][Ruff], [Pylint][Pylint], [Flake8][Flake8] | Code Quality |
40+
| Jupyter Notebooks | [Ruff][Ruff], [Pylint][Pylint], [Flake8][Flake8] | Code Quality |
41+
| Regal | [Regal][Regal] | Code Quality |
42+
| Ruby | [RuboCop][RuboCop], [Brakeman][Brakeman] | Code Quality, Code Security |
43+
| Rust | [Clippy][Clippy] | Code Quality |
44+
| Semgrep | [Semgrep][Semgrep] | Code Security |
45+
| Shell (sh, bash, ksh, dash) | [ShellCheck][ShellCheck] | Code Quality |
46+
| Shopify | [Shopify CLI][ShopifyCLI] | Code Quality |
47+
| SQL | [SQLFluff][SQLFluff] | Code Quality |
48+
| Swift | [SwiftLint][SwiftLint] | Code Quality |
49+
| Terraform | [Checkov][Checkov] | Code Security |
50+
| TSX | [Biome][Biome], [oxlint][oxlint] | Code Quality |
51+
| Typescript | [Biome][Biome], [oxlint][oxlint] | Code Quality |
52+
| YAML | [YAMLlint][YAMLlint] | Code Quality |
53+
| Prisma | [Prisma Lint][PrismaLint] | Code Quality |
5454

5555
[ShellCheck]: /tools/shellcheck.md
5656
[SQLFluff]: /tools/sqlfluff.md
@@ -88,3 +88,4 @@ For an overview of how CodeRabbit uses these tools when generating code reviews,
8888
[PHPMD]: /tools/phpmd.md
8989
[PHPCS]: /tools/phpcs.md
9090
[Flake8]: /tools/flake8.md
91+
[OSVScanner]: /tools/osv-scanner.md

‎docs/tools/osv-scanner.md

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
---
2+
title: OSV-Scanner
3+
sidebar_label: OSV-Scanner
4+
description: CodeRabbit's guide to OSV-Scanner.
5+
---
6+
7+
```mdx-code-block
8+
import ProPlanNotice from '@site/src/components/ProPlanNotice.mdx';
9+
10+
<ProPlanNotice />
11+
```
12+
13+
[OSV-Scanner](https://github.com/google/osv-scanner) is Google's vulnerability scanner that identifies vulnerabilities in your project's dependencies using the [OSV.dev](https://osv.dev) database.
14+
15+
## Configuration
16+
17+
OSV-Scanner requires an `osv-scanner.toml` configuration file to run.
18+
19+
:::note
20+
21+
CodeRabbit will only run OSV-Scanner if your repository contains an `osv-scanner.toml` configuration file.
22+
23+
:::
24+
25+
## Links
26+
27+
- [OSV-Scanner GitHub Repository](https://github.com/google/osv-scanner)
28+
- [OSV-Scanner Documentation](https://google.github.io/osv-scanner/)
29+
- [OSV.dev Database](https://osv.dev)

0 commit comments

Comments
 (0)