Vulnerability Exemptions Collector
Collect approved vulnerability exemptions, such as a CVE with no fix that has a recorded risk acceptance, from a register in one compliance repository, and share them with every service so the CVE policies can honor them.
vulnerability-exemptions to your lunar-config.yml:uses: github://earthly/lunar-lib/collectors/vulnerability-exemptions@v1.0.5
What This Integration Collects
This integration includes 3 collectors that gather metadata from your systems.
records
Reads the exemption register, a YAML list of cve, component, reason and until
entries, from the repository it runs on. Run it on the compliance repository only.
Entries missing a field or with an unparseable until go to errors[] instead.
Writes nothing when no register file is found.
import
Copies the register entries for this component from the Component JSON of
source_component, read with lunar component get-json instead of a clone. Runs on
every commit, pull requests included. Writes nothing when source_component is unset
or no entry names this component.
refresh
Runs the same copy as import on a schedule, so a service with no new commits still
picks up new entries. A removed entry keeps applying until the service's next commit
and the refresh after it (see the README). Exits non-zero when source_component
can't be read, so a failed read keeps the previous run's entries.
How Collectors Fit into Lunar
Lunar watches your code and CI/CD systems to collect SDLC data from config files, test results, IaC, deployment configurations, security scans, and more.
Collectors are the automatic data-gathering layer. They extract structured metadata from your repositories and pipelines, feeding it into Lunar's centralized database where guardrails evaluate it to enforce your engineering standards.
Learn How Lunar Works →Example Collected Data
This collector writes structured metadata to the Component JSON. Here's an example of the data it produces:
{
"compliance": {
"vulnerability_exemptions": {
"source_component": "github.com/acme/compliance",
"records": [
{
"cve": "CVE-2026-10536",
"component": "github.com/acme/api",
"reason": "No Debian fix for curl, and the service never runs curl.",
"until": "2027-02-04"
}
]
}
}
}Configuration
Configure this collector in your lunar-config.yml.
Inputs
| Input | Required | Default | Description |
|---|---|---|---|
register_paths
|
Optional |
vulnerability-exemptions.yml
|
Comma-separated candidate paths for the register file (first match wins) |
source_component
|
Required | — | The component that holds the register, such as `github.com/acme/compliance`. `import` and `refresh` write nothing until it is set. |
refresh_schedule
|
Optional |
30 1 * * *
|
When `refresh` runs, as a cron expression in UTC. Run it before your nightly CVE rescans. |
Documentation
View on GitHubVulnerability Exemptions Collector
Collects approved vulnerability exemptions from a register in one compliance repository and shares them with every service.
Overview
Some vulnerabilities have no fix yet, so teams accept the risk and record it. This collector reads those decisions from one register file in a compliance repository. records reads the register on that repository; import and refresh copy each service's entries from the compliance repository's Component JSON, so services never clone it. The container-scan and sca policies read the result at run time, so a new or expired exemption needs no config change.
Collected Data
The register is one YAML file (default: vulnerability-exemptions.yml), a list with one entry per CVE and component. Approving the pull request that changes it is the approval, so require a review on the compliance repository's default branch, and give the register a CODEOWNERS entry for whoever owns security:
- cve: CVE-2026-10536
component: github.com/acme/api
reason: No Debian fix for curl, and the service never runs curl.
until: 2027-02-04
All four fields are required. An entry stops applying after until (YYYY-MM-DD), and once the finding has a fix.
Every sub-collector writes the same paths: records on the compliance repository, import and refresh on each service.
| Path | Type | Description |
|---|---|---|
.compliance.vulnerability_exemptions.records[] |
array | One entry per register entry: cve, component, reason, until |
.compliance.vulnerability_exemptions.path |
string | Where records found the register (records only) |
.compliance.vulnerability_exemptions.source_component |
string | Where the entries were copied from (import and refresh only) |
.compliance.vulnerability_exemptions.errors[] |
array | Entries that couldn't be used, with their position and the error (records only) |
Collectors
This integration provides the following collectors (use include to select a subset):
| Collector | Description |
|---|---|
records |
Reads the register from the repository it runs on |
import |
Copies this component's entries from source_component on every commit |
refresh |
Copies them again on a schedule, for services with no new commits |
Installation
Add to your lunar-config.yml:
collectors:
# On the compliance repository: read the register on every commit.
- uses: github://earthly/lunar-lib/collectors/vulnerability-exemptions@v1.0.0
name: exemption-records
on: ["component:github.com/acme/compliance"]
include: [records]
# with:
# register_paths: "vulnerability-exemptions.yml"
# On every service the CVE policies check: copy its entries.
- uses: github://earthly/lunar-lib/collectors/vulnerability-exemptions@v1.0.0
name: exemption-import
on: ["soc2"]
include: [import, refresh]
with:
source_component: "github.com/acme/compliance"
# refresh_schedule: "30 1 * * *"
import gives each commit the entries current when it was collected, pull requests included. refresh covers services with no new commits. Both copies count, so removing an entry or shortening its until reaches a service's default branch only after a new commit there and a refresh run after that; until then the old entry still applies. On a pull request it takes effect at the next push.
Open Source
This collector is open source and available on GitHub. Contribute improvements, report issues, or fork it for your own use.
Ready to Automate Your Standards?
See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 300+ built-in guardrails.
AI agent rules & prompt files
Post-mortem action items
Security & compliance policies
Testing & quality requirements