CodeGuard

CodeGuard is a dependency vulnerability scanner for CI pipelines.

Current MVP capabilities:

• Parses npm lockfiles (package-lock.json, npm-shrinkwrap.json).
• Queries OSV (/v1/querybatch and /v1/vulns/{id}).
• Cross-references CISA KEV for actively exploited CVEs.
• Pulls EPSS scores for CVE exploitability signal.
• Computes a risk score and priority per finding.
• Produces:
  • JSON report (codeguard-report.json by default).
  • Markdown report (codeguard-summary.md by default).
  • Optional GitHub job summary output.

CLI Usage

Run from the repository root:

python -m src.main --repo-path .

Common options:

python -m src.main \
	--repo-path . \
	--lockfile-path package-lock.json \
	--output-json-path codeguard-report.json \
	--output-markdown-path codeguard-summary.md \
	--fail-threshold HIGH \
	--fail-on-findings

GitHub Action Usage

Use the action from a workflow:

name: CodeGuard Scan

on:
	pull_request:
	push:

jobs:
	scan:
		runs-on: ubuntu-latest
		permissions:
			contents: read
			pull-requests: write
			issues: write

		steps:
			- uses: actions/checkout@v4

			- name: Run CodeGuard
				id: codeguard
				uses: ./
				with:
					fail-threshold: "HIGH"
					fail-on-findings: "false"
					comment-mode: "sticky"

			- name: Print outputs
				run: |
					echo "status=${{ steps.codeguard.outputs.scan_status }}"
					echo "findings=${{ steps.codeguard.outputs.findings_total }}"
					echo "comment=${{ steps.codeguard.outputs.pr_comment_url }}"

Action Inputs

• repo-path
• lockfile-path
• output-json-path
• output-markdown-path
• max-visible-findings
• fail-on-findings
• fail-threshold
• comment-mode
• comment-tag
• kev-url
• epss-url
• python-version
• job-summary