GitHub Dependency Risk Triage with OSV

Read pinned dependency versions from a GitHub repository through an Apify MCP connector, check them with the OSV Vulnerability Scraper, and create or update a source-linked GitHub issue for human review.

Why the connector matters

The Actor can read a private repository and write its review artifact without receiving or logging a GitHub token. The caller supplies one authorized connector; Apify keeps the credential server-side and exposes only three tools declared by the input schema:

• get_file_contents
• search_issues
• issue_write

The Actor cannot edit files, create branches, open pull requests, merge code, or call any other GitHub tool.

Supported manifests

• Exact versions in dependencies, devDependencies, and optionalDependencies in package.json.
• Pinned name==version entries in requirements files.

Ranges such as ^1.2.3, ~=2.0, and unpinned dependencies are skipped because OSV needs an installed version for a defensible version query. Missing manifests and parse failures are returned explicitly.

The Actor accepts at most five manifest paths, rejects files above 1 MB, caps exact packages, validates npm/PyPI names and versions, and writes at most one issue per run. Advisory strings are escaped for a Markdown table and only HTTPS source URLs become links.

Safe operating model

Dry run is the default. To post an issue, disable dry run and enter the exact owner/repo in confirmWriteTarget; use only a repository you own or are explicitly authorized to modify.

The issue is a triage queue. A published advisory does not prove the vulnerable code path is deployed; a missing advisory does not prove a package is safe. The Actor deliberately does not modify a dependency or open a pull request. On sequential runs it updates only an issue whose body contains the Actor's invisible marker; a human-authored title collision is never overwritten. Overlapping schedules for the same repository are unsupported.