From 2bafa826c55124f66a5e44067a1a46bce20eebe7 Mon Sep 17 00:00:00 2001 From: Sergio Castillo Date: Mon, 22 Sep 2025 10:40:17 +0200 Subject: [PATCH 1/2] fix: make 128 no packages found not return an error --- internal/scanner/osv.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/internal/scanner/osv.go b/internal/scanner/osv.go index fa56b3a..8f7ff21 100644 --- a/internal/scanner/osv.go +++ b/internal/scanner/osv.go @@ -13,6 +13,7 @@ import ( ) type osvReferenceKind string +type osvReturnCode int const ( OsvCommandName = "osv-scanner" @@ -20,6 +21,10 @@ const ( WebKind osvReferenceKind = "WEB" PackageKind osvReferenceKind = "PACKAGE" osvTimeout = 5 * time.Minute + // https://google.github.io/osv-scanner/output/#return-codes + osvReturnCodeSuccess osvReturnCode = 0 + osvReturnCodeVulnsFound osvReturnCode = 1 + osvReturnCodeNoPackages osvReturnCode = 128 ) type osvSource struct { @@ -116,10 +121,13 @@ func (s *osvScanner) Scan(dir string) (*OsvReport, error) { ) //Handle exit codes according to https://google.github.io/osv-scanner/output/#return-codes - if cmdOut.ExitCode == 0 && err == nil { + if cmdOut.ExitCode == int(osvReturnCodeSuccess) && err == nil { // Successful run of osv-scanner, no report because no vulnerabilities found log.Debug().Int("exitCode", cmdOut.ExitCode).Msg("osv-scanner did not find vulnerabilities") return nil, nil + } else if cmdOut.ExitCode == int(osvReturnCodeNoPackages) { + log.Warn().Int("exitCode", cmdOut.ExitCode).Msg("osv-scanner did not find any packages to scan") + return nil, nil } else if cmdOut.ExitCode > 1 || cmdOut.ExitCode == -1 { // Failed to run osv-scanner at all, or it returned an error log.Debug().Int("exitCode", cmdOut.ExitCode).Msg("osv-scanner failed to run") From 537c77d0334f1b4f5f78239babecb18083277f47 Mon Sep 17 00:00:00 2001 From: Sergio Castillo Date: Mon, 22 Sep 2025 10:55:17 +0200 Subject: [PATCH 2/2] fix: remove custom type for codes --- internal/scanner/osv.go | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/internal/scanner/osv.go b/internal/scanner/osv.go index 8f7ff21..ac7f9a0 100644 --- a/internal/scanner/osv.go +++ b/internal/scanner/osv.go @@ -13,7 +13,6 @@ import ( ) type osvReferenceKind string -type osvReturnCode int const ( OsvCommandName = "osv-scanner" @@ -22,9 +21,9 @@ const ( PackageKind osvReferenceKind = "PACKAGE" osvTimeout = 5 * time.Minute // https://google.github.io/osv-scanner/output/#return-codes - osvReturnCodeSuccess osvReturnCode = 0 - osvReturnCodeVulnsFound osvReturnCode = 1 - osvReturnCodeNoPackages osvReturnCode = 128 + osvReturnCodeSuccess int = 0 + osvReturnCodeVulnsFound int = 1 + osvReturnCodeNoPackages int = 128 ) type osvSource struct { @@ -121,11 +120,11 @@ func (s *osvScanner) Scan(dir string) (*OsvReport, error) { ) //Handle exit codes according to https://google.github.io/osv-scanner/output/#return-codes - if cmdOut.ExitCode == int(osvReturnCodeSuccess) && err == nil { + if cmdOut.ExitCode == osvReturnCodeSuccess && err == nil { // Successful run of osv-scanner, no report because no vulnerabilities found log.Debug().Int("exitCode", cmdOut.ExitCode).Msg("osv-scanner did not find vulnerabilities") return nil, nil - } else if cmdOut.ExitCode == int(osvReturnCodeNoPackages) { + } else if cmdOut.ExitCode == osvReturnCodeNoPackages { log.Warn().Int("exitCode", cmdOut.ExitCode).Msg("osv-scanner did not find any packages to scan") return nil, nil } else if cmdOut.ExitCode > 1 || cmdOut.ExitCode == -1 {