mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-13 03:42:35 -06:00
pkuzco
c07265b1cd
## What Adds [ossrisk](https://github.com/depkeep/ossrisk) to the OPA ecosystem page. ossrisk is a CLI and GitHub Action that scans npm and PyPI dependency trees for supply-chain and long-term viability risk: known CVEs (via OSV.dev), end-of-life versions, abandonment signals, typosquatting, license compliance, and maintainer-takeover patterns. Beyond a `--fail-on <severity>` threshold, ossrisk integrates with OPA via the `opa` CLI: the scan result JSON is passed as `input` to `opa eval`, and policies in `package ossrisk` add messages to a `deny` set to gate the build. This enables cross-signal rules a threshold alone cannot express — for example blocking packages with install scripts published by a brand-new maintainer (the event-stream takeover pattern). The JSON output also pipes cleanly into conftest. ## Changes - `docs/src/data/ecosystem/entries/ossrisk.md` — entry with `category: security`, `layer: cicd`, `type: poweredbyopa` - `docs/static/img/ecosystem-entry-logos/ossrisk.svg` — logo --------- Signed-off-by: glimm-no <admin@glimm.no> Signed-off-by: pkuzco <b.naamneh@gmail.com> Co-authored-by: glimm-no <admin@glimm.no> Co-authored-by: Charlie Egan <git@charlieegan3.com>