OSV Scanner Integration Guide

Integrate OSV Scanner with Vulnetix. Scan dependencies against the OSV database with native SARIF and CycloneDX output.

Install & scan

$ go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
$ osv-scanner scan -r --format sarif --output osv.sarif .

Run OSV Scanner in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install OSV Scanner
  run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
- name: Run OSV Scanner
  run: osv-scanner scan -r --format sarif --output osv.sarif .
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: osv-scanner
    path: osv.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under OSV Scanner's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace OSV Scanner. Keep running it. Vulnetix sits on top of OSV Scanner (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

OSV Scanner is strongest at its core category and also carries features in Container & Image Scanning, License Compliance, SBOM Generation, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What OSV Scanner does well

• Free, open-source Google scanner backed by the federated OSV.dev database aggregating GitHub Advisory, PyPI, npm, crates.io, Go, and NVD with precise machine-readable version ranges
• Layer-aware container image scanning that reports the layer and command that introduced each package plus detected base images and OS/distro
• Consumes CycloneDX and SPDX SBOMs as scan input and can emit SPDX 2.3 package lists; broad manifest and lockfile support via OSV-SCALIBR
• Experimental guided remediation suggests dependency upgrades and offline scanning for air-gapped CI, with SARIF output

Where Vulnetix adds to it: OSV-Scanner is a fast open-source SCA/container scanner keyed to OSV.dev. Vulnetix ingests and dedupes its SARIF output with other scanners into one prioritised queue and adds the prioritisation and governance layers OSV-Scanner does not have: exploit-intel (EPSS, KEV, ESS, CWSS, LEV), reachability, immutable versioned VEX with audit, mature autofix/Safe Harbour, EOL and SSVC policy, and an install-time package firewall across 25+ registries. Vulnetix orchestrates above OSV-Scanner rather than replacing it.

No migration, no rip-and-replace. OSV Scanner keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise OSV Scanner results in Vulnetix

Upload OSV Scanner SARIF, CycloneDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

OSV Scanner documentation ↗  ·  Source repository ↗

Wire OSV Scanner into your CI/CD pipeline →