Enhancement: add a fail-on-epss input to the GitHub Action (maps to --fail-on-epss) #487

Activity

1. vibgrate-team

   added

   enhancementNew feature or requestNew feature or request

   on Oct 20, 2026
2. vibgrate-team commented on Oct 20, 2026

   

   vibgrate-team

   on Oct 20, 2026

   ContributorAuthor

   More actions

   Thanks for writing this up so clearly. A few pointers for whoever picks it up:

   • Where it goes: everything lives in the Run Vibgrate scan step of action.yml. Add INPUT_FAIL_ON_EPSS: ${{ inputs.fail-on-epss }} to that step's env: block, and keep reading it from env rather than interpolating it into the script, the same way the other inputs are passed.
   • Validation: the max-score block is the model to copy. It trims whitespace with parameter expansion, checks the shape with ^[0-9]+(\.[0-9]+)?$, then range-checks with awk. For EPSS the range is 0 to 1, so the awk test becomes score + 0 <= 1. A whitespace-only value trims to an empty string and fails the regex, which covers that acceptance case without extra code. Keep the CLI's own rule in mind too: parseEpssThreshold in src/reporting/epss-gate.ts rejects a blank value, non-finite numbers, and anything outside 0 to 1, so the Action should never accept something the CLI would reject.
   • The vulns dependency: the gate reads advisories from the vulnerability pass. Without --vulns, evaluateEpssGate sees source: null and reports a skip rather than a pass or a failure. Failing fast with ::error::fail-on-epss needs vulns: true ... when INPUT_VULNS isn't true is probably the least surprising choice, because otherwise a gate someone set on purpose would quietly do nothing. Whichever way you go, say it in the input description.
   • Older images: help_text is already captured once for the --summary-out probe. Reuse it with grep -q -- '--fail-on-epss' rather than running docker run ... scan --help a second time, and emit a ::notice:: when the flag is missing.
   • Ordering: add the flag to extra before the INPUT_ARGS word-split, so anything a caller passes in args still comes last and wins.
   • Tests: if there's an existing shell or YAML test over action.yml inputs, add cases for 0.1, empty, abc, -0.1, 1.5 and ' '. Then add the with: fail-on-epss: '0.1' example next to fail-on and max-score in docs/ci/github-actions.md and examples/github-actions/README.md.
3. vibgrate-team

   closed this as completedin #489on Oct 20, 2026