feat: add scheduled OSV-Scanner vulnerability workflow

[kpj2006]

Addressed Issues:

Fixes #(issue number)

Screenshots/Recordings:

Additional Notes:

Checklist

• My code follows the project's code style and conventions
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have joined the Discord server and I will share a link to this PR with the project maintainers there
• I have read the Contributing Guidelines

⚠️ AI Notice - Important!

We encourage contributors to use AI tools responsibly when creating Pull Requests. While AI can be a valuable aid, it is essential to ensure that your contributions meet the task requirements, build successfully, include relevant tests, and pass all linters. Submissions that do not meet these standards may be closed without warning to maintain the quality and integrity of the project. Please take the time to understand the changes you are proposing and their impact.

Summary by CodeRabbit

• Chores
  • Updated scheduled security scanning so vulnerability findings are reported without failing the workflow.

[coderabbitai]

Caution

Review failed

Failed to post review comments.

GitHub was unavailable or timed out while CodeRabbit was posting the review. Please request a new review later if the pull request still needs one. This happened while posting 1 inline comment. Use @coderabbitai full review to retry the review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0ae10d3f-388a-42b9-889b-8459d323abcd

📥 Commits

Reviewing files that changed from the base of the PR and between 250b6d1 and dca8b8a.

📒 Files selected for processing (1)

• .github/workflows/osv-scanner-scheduled.yml

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: scan-pr / osv-scan
• GitHub Check: Socket Security: Pull Request Alerts

⚠️ CI failures not shown inline (4)

GitHub Actions: Dependency Review / 0_Dependency & License Review.txt: feat: add scheduled OSV-Scanner vulnerability workflow

Conclusion: failure

View job details

##[group]Run actions/dependency-review-action@v5
 with:
   fail-on-severity: moderate
   fail-on-scopes: runtime
   allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, Unlicense, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, MPL-2.0, EUPL-1.2, Python-2.0, PSF-2.0
   warn-only: false
   show-openssf-scorecard: true
   warn-on-openssf-scorecard-level: 3
   repo-***REDACTED***
 ##[endgroup]
 ##[error]Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled, see https://github.com/AOSSIE-Org/Zplit-Website/settings/security_analysis

---

GitHub Actions: Dependency Review / Dependency & License Review: feat: add scheduled OSV-Scanner vulnerability workflow

Conclusion: failure

View job details

##[group]Run actions/dependency-review-action@v5
 with:
   fail-on-severity: moderate
   fail-on-scopes: runtime
   allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, CC0-1.0, Unlicense, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later, MPL-2.0, EUPL-1.2, Python-2.0, PSF-2.0
   warn-only: false
   show-openssf-scorecard: true
   warn-on-openssf-scorecard-level: 3
   repo-***REDACTED***
 ##[endgroup]
 ##[error]Dependency review is not supported on this repository. Please ensure that Dependency graph is enabled, see https://github.com/AOSSIE-Org/Zplit-Website/settings/security_analysis

---

GitHub Actions: gitleaks / gitleaks: feat: add scheduled OSV-Scanner vulnerability workflow

Conclusion: failure

View job details

##[group]Run gitleaks/gitleaks-action@v3
 env:
   GITHUB_***REDACTED***
   GITLEAKS_LICENSE:
 ##[endgroup]
 (node:2294) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
 (Use `node --trace-deprecation ...` to show where the warning was created)
 (node:2294) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
 [AOSSIE-Org] is an organization. License key is required.
 ##[error]🛑 missing gitleaks license. Go grab one at gitleaks.io and store it as a GitHub Secret named GITLEAKS_LICENSE. For more info about the recent breaking update, see [here](https://github.com/gitleaks/gitleaks-action#-announcement).

---

GitHub Actions: gitleaks / 0_gitleaks.txt: feat: add scheduled OSV-Scanner vulnerability workflow

Conclusion: failure

View job details

##[group]Run gitleaks/gitleaks-action@v3
 env:
   GITHUB_***REDACTED***
   GITLEAKS_LICENSE:
 ##[endgroup]
 (node:2294) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
 (Use `node --trace-deprecation ...` to show where the warning was created)
 (node:2294) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
 [AOSSIE-Org] is an organization. License key is required.
 ##[error]🛑 missing gitleaks license. Go grab one at gitleaks.io and store it as a GitHub Secret named GITLEAKS_LICENSE. For more info about the recent breaking update, see [here](https://github.com/gitleaks/gitleaks-action#-announcement).

🧰 Additional context used

🪛 zizmor (1.26.1)

.github/workflows/osv-scanner-scheduled.yml

[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

Walkthrough

The scheduled OSV-Scanner workflow now explicitly configures its reusable workflow with fail-on-vuln: false, allowing vulnerability findings without failing the workflow.

Changes

Scheduled OSV scan configuration

Layer / File(s)	Summary
Configure scheduled scan .github/workflows/osv-scanner-scheduled.yml	The scan-scheduled job passes fail-on-vuln: false to the reusable OSV scanner workflow.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: m4dhav

Poem

A rabbit hopped through scans at night,
And set the failure switch just right.
Vulns may appear, the job runs on,
Till moonlit CI greets the dawn. 🐇

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR’s main change: adding a scheduled OSV-Scanner vulnerability workflow.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

	Messages
📖	⚠️ PR Template Check These are non-blocking, but please fix: Please replace the placeholder Fixes #(issue number) with the actual issue number (e.g. Fixes #42). Some required checklist items are not completed: My PR addresses a single issue My code follows the project's code style My changes generate no new warnings or errors

Generated by 🚫 dangerJS against dca8b8a