Open-Source Component Vulnerability Scan

About 590 wordsAbout 2 min

The Open-Source Component Vulnerability Scan plugin checks dependency vulnerabilities, provides fixed versions and upgrade advice, and supports severity-based gates. By default it checks vulnerabilities newly introduced by the PR; set scanMode: full to check all dependency vulnerabilities of the current Commit.

Usage in CNB

Add the following configuration to .cnb.yml at the root of your repository to run a full scan on push and upload the report attachment:

.cnb.yml
main:
  push:
    - stages:
        - name: Full Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
          timeout: 15m
          settings:
            scanMode: full
            failOnSeverity: high
            publish: true

This configuration checks all dependency vulnerabilities of the current Commit and fails the check for High or Critical vulnerabilities. failOnSeverity is optional. If omitted, the plugin scans without applying a gate.

The following example gates a PR incrementally and uploads no report attachment:

.cnb.yml
main:
  pull_request.target:
    - stages:
        - name: Open-Source Component Vulnerability Scan
          image: cnbcool/sca-vulnerability:latest
          timeout: 15m
          settings:
            failOnSeverity: high

The configuration above fails the check when the PR introduces a High or Critical vulnerability.

Difference between pull_request and pull_request.target

For detailed differences, please refer to Code Version Selection.

Parameters

Plugin parameters are passed through settings:

Parameter	Description	Default
`scanMode`	Scan mode: `diff` for an incremental PR scan, `full` for a full scan of the current `CNB_COMMIT`	`diff`
`failOnSeverity`	Minimum severity that fails the check: `low`, `medium`, `high`, or `critical`; no gate runs if unset	none
`publish`	Whether to generate and upload report attachments; uploading requires a trusted event	`false`

To scan without blocking on vulnerabilities, omit failOnSeverity. The log will list all vulnerabilities within the scan scope. See Scan modes and Gates for shared behavior.

Incremental rules

The same component with the same CVE that already exists is not blocked again;
A new component or a new CVE forms a new vulnerability;
Deleting a file does not produce a new vulnerability;
Renaming a file whose content is unchanged does not reproduce a vulnerability.

Output

The following incremental scan log uses failOnSeverity: high and prints only High and Critical vulnerabilities:

go.mod: HIGH CVE-2025-10002
  component: github.com/example/library@v1.2.0
  fixed-version: v1.3.0
  message: example vulnerability
  action: upgrade github.com/example/library to v1.3.0 or later

SCA gate failed: 1 new risk findings, 1 matched gate

With publish: true, the plugin also generates an XLSX report and uploads it as a Commit attachment named security-vulnerability-<scanMode>-<commit>.xlsx. The report contains the vulnerability name, risk level, component name and version, affected/fixed versions, path, CVE/CNNVD/CNVD/CWE, CVSS, and the solution and patch links. See Report attachments for file naming and download details.

Commit metadata

The plugin writes the vulnerability counts and gate result to the annotations of the publish target Commit:

sca.vulnerability.full.reporter=https://...
sca.vulnerability.full.gate=gate
sca.vulnerability.full.critical.count=0
sca.vulnerability.full.high.count=3
sca.vulnerability.full.medium.count=8
sca.vulnerability.full.low.count=5

See Commit metadata for field descriptions.

Exit codes

Exit code	Description
`0`	Scan succeeded with no gate matched or no gate configured
`1`	A vulnerability matched the gate
`2`	Configuration error or scan failure; with `publish: true`, failure to publish the attachment or metadata

Next steps

License Scan — License risk gate
SBOM Generation — component inventory and standard formats