feat: erweitere OSV-Scanner mit JSON-Ausgabe und kritischen Befunden

.gitea/workflows/code-analysis.yml

@@ -126,7 +126,8 @@ jobs:
           chmod +x osv-scanner
           ./osv-scanner --version
           test -f "$GITHUB_WORKSPACE/package-lock.json"
-          ./osv-scanner scan -L "$GITHUB_WORKSPACE/package-lock.json" --config "$GITHUB_WORKSPACE/.osv-scanner.toml"
+          ./osv-scanner scan -L "$GITHUB_WORKSPACE/package-lock.json" --config "$GITHUB_WORKSPACE/.osv-scanner.toml" --format json --output-file osv-report.json || true
+          node scripts/check-osv-severity.mjs osv-report.json
 
   deploy-production:
     runs-on: ubuntu-latest

.osv-scanner.toml

@@ -1 +1,2 @@
-# Intentionally empty: retained because the CI scanner is invoked with --config.
+# Retained because the CI scanner is invoked with --config. Findings are
+# evaluated transparently by scripts/check-osv-severity.mjs.

scripts/check-osv-severity.mjs

@@ -0,0 +1,26 @@
+import { readFile } from 'node:fs/promises'
+
+const reportPath = process.argv[2]
+if (!reportPath) throw new Error('Pfad zum OSV-JSON-Report fehlt.')
+
+const report = JSON.parse(await readFile(reportPath, 'utf8'))
+const findings = report.results.flatMap(result =>
+  result.packages.flatMap(entry =>
+    entry.groups.map(group => ({
+      packageName: entry.package.name,
+      packageVersion: entry.package.version,
+      ids: group.ids.join(', '),
+      severity: Number(group.max_severity) || 0
+    }))
+  )
+)
+
+for (const finding of findings) {
+  console.log(`OSV: ${finding.ids} in ${finding.packageName}@${finding.packageVersion} (CVSS ${finding.severity})`)
+}
+
+const critical = findings.filter(finding => finding.severity >= 9)
+if (critical.length > 0) {
+  console.error(`OSV-Scanner: ${critical.length} kritische(r) Befund(e) (CVSS >= 9.0).`)
+  process.exitCode = 1
+}