From c07265b1cd305e67c23e67fa06e969733a8e34d7 Mon Sep 17 00:00:00 2001 From: pkuzco Date: Mon, 15 Jun 2026 15:00:35 +0200 Subject: [PATCH] website: add ossrisk to ecosystem (#8780) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What Adds [ossrisk](https://github.com/depkeep/ossrisk) to the OPA ecosystem page. ossrisk is a CLI and GitHub Action that scans npm and PyPI dependency trees for supply-chain and long-term viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment signals, typosquatting, license compliance, and maintainer-takeover patterns. Beyond a `--fail-on ` threshold, ossrisk integrates with OPA via the `opa` CLI: the scan result JSON is passed as `input` to `opa eval`, and policies in `package ossrisk` add messages to a `deny` set to gate the build. This enables cross-signal rules a threshold alone cannot express — for example blocking packages with install scripts published by a brand-new maintainer (the event-stream takeover pattern). The JSON output also pipes cleanly into conftest. ## Changes - `docs/src/data/ecosystem/entries/ossrisk.md` — entry with `category: security`, `layer: cicd`, `type: poweredbyopa` - `docs/static/img/ecosystem-entry-logos/ossrisk.svg` — logo --------- Signed-off-by: glimm-no Signed-off-by: pkuzco Co-authored-by: glimm-no Co-authored-by: Charlie Egan --- docs/src/data/ecosystem/entries/ossrisk.md | 31 +++++++++++++++++++ .../img/ecosystem-entry-logos/ossrisk.svg | 13 ++++++++ 2 files changed, 44 insertions(+) create mode 100644 docs/src/data/ecosystem/entries/ossrisk.md create mode 100644 docs/static/img/ecosystem-entry-logos/ossrisk.svg diff --git a/docs/src/data/ecosystem/entries/ossrisk.md b/docs/src/data/ecosystem/entries/ossrisk.md new file mode 100644 index 0000000000..b71f31322a --- /dev/null +++ b/docs/src/data/ecosystem/entries/ossrisk.md @@ -0,0 +1,31 @@ +--- +title: ossrisk +subtitle: Dependency supply-chain risk scanner with Rego policy gates +labels: + category: security + layer: cicd + type: poweredbyopa +inventors: +- depkeep +code: +- https://github.com/depkeep/ossrisk +tutorials: +- https://github.com/depkeep/ossrisk#policy-as-code-opa +software: +- npm +- pypi +- github-actions +--- + +ossrisk scans npm and PyPI dependency trees for supply-chain and long-term +viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment +signals, typosquatting, license compliance, maintainer-takeover patterns, and +install scripts. + +Beyond a simple `--fail-on ` threshold, ossrisk delegates gating +decisions to OPA. The scan result is passed to `opa eval` as `input`; policies +live in `package ossrisk` and add human-readable messages to a `deny` set, and +any violation fails the scan. This enables cross-signal rules a severity +threshold cannot express - for example "no strong-copyleft licenses in direct +dependencies" or "block packages that add install scripts under a brand-new +publisher" (the event-stream takeover pattern). diff --git a/docs/static/img/ecosystem-entry-logos/ossrisk.svg b/docs/static/img/ecosystem-entry-logos/ossrisk.svg new file mode 100644 index 0000000000..4cd0a04679 --- /dev/null +++ b/docs/static/img/ecosystem-entry-logos/ossrisk.svg @@ -0,0 +1,13 @@ + + + + + + + + + + + + +