Skip to content

docs: document native GitHub Action inputs for override hygiene #910

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sonukapoor merged 1 commit into from
Jul 28, 2026
Merged

docs: document native GitHub Action inputs for override hygiene #910

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 38 additions & 4 deletions website/docs/override-hygiene/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,20 +122,54 @@ Most findings can be fixed automatically. `--fix` applies RFC 6902 JSON patches

## CI integration

### CLI

```bash
# Fail CI on any critical or high finding
# Append override hygiene to a regular CVE scan and fail on high or critical
cve-lite . --check-overrides --fail-on high

# Run as part of the regular CVE scan
cve-lite . --check-overrides --fail-on high
# Run a dedicated hygiene-only audit and fail on high or critical
cve-lite . overrides --fail-on high
```

Log every detection and fix event for compliance audit trails:

```bash
cve-lite overrides . --fix --audit-log ./override-audit.ndjson
cve-lite . overrides --fix --audit-log ./override-audit.ndjson
```

### GitHub Action

Override hygiene is available natively through the [CVE Lite CLI Action](../github-action.md) - you configure it with first-class inputs, not raw flags. There are two modes.

Run it inline with the CVE scan:

```yaml
- uses: OWASP/cve-lite-cli@v1
with:
check-overrides: 'true'
fail-on: 'high'
```

Or run a dedicated override audit as its own step, with its own severity gate:

```yaml
- uses: OWASP/cve-lite-cli@v1
with:
overrides: 'true'
overrides-fail-on: 'high'
check-network: 'true' # enable the OA007 registry-drift check
audit-log: './override-audit.ndjson' # NDJSON change-control trail
```

| Action input | What it does |
|---|---|
| `check-overrides` | Run override hygiene inline with the scan; findings appear in the same report |
| `overrides` | Run a dedicated `cve-lite overrides` audit as a separate step |
| `overrides-fail-on` | Exit non-zero when the dedicated audit finds an issue at or above this severity |
| `check-network` | Allow the override audit to make registry calls for the OA007 drift check (off by default in CI) |
| `audit-log` | Stream override detection and fix events as NDJSON for change-control |

---

## How this compares to other tools
Expand Down