SCA Guardrails

Enforces Software Composition Analysis (SCA) scanning standards for dependency security.

Overview

This policy validates that SCA scanning is configured and enforces vulnerability thresholds for dependencies. It works with any SCA scanner that writes to the normalized .sca path in the Component JSON (Snyk, Semgrep Supply Chain, Dependabot, Grype, etc.).

Policies

This plugin provides the following policies (use include to select a subset):

Required Data

This policy reads from the following Component JSON paths:

Note: If collectors don't yet write vulnerability counts, the max-severity and max-total checks will fail. Use include: [executed] to only verify the scanner ran until collectors are enhanced.

Installation

Add to your lunar-config.yml:

policies:
  - uses: github://earthly/lunar-lib/policies/sca@main
    on: ["domain:your-domain"]
    enforcement: report-pr
    # include: [executed, max-severity]  # Only run specific checks
    with:
      min_severity: "high"        # Fail on critical and high findings
      max_total_threshold: "10"   # Fail if more than 10 total findings

Examples

Passing Example

{
  "sca": {
    "source": { "tool": "snyk", "integration": "github_app" },
    "vulnerabilities": { "critical": 0, "high": 0, "medium": 3, "total": 8 },
    "summary": { "has_critical": false, "has_high": false }
  }
}

Failing Example

{
  "sca": {
    "source": { "tool": "snyk", "integration": "github_app" },
    "vulnerabilities": { "critical": 2, "high": 5, "medium": 10, "total": 25 },
    "summary": { "has_critical": true, "has_high": true }
  }
}

Failure messages:

• executed: "No SCA scanning data found. Ensure a scanner (Snyk, Semgrep, etc.) is configured."
• max-severity: "Critical vulnerability findings detected (2 found)"
• max-total: "Total vulnerability findings (25) exceeds threshold (10)"

Remediation

When this policy fails, you can resolve it by:

1. executed failure: Configure an SCA scanner (Snyk, Semgrep Supply Chain, Dependabot) in your CI pipeline or as a GitHub App integration.
2. max-severity failure: Review and remediate the flagged vulnerabilities by updating to patched versions or using your scanner's ignore feature for accepted risks.
3. max-total failure: Reduce total vulnerability count by updating dependencies.