Fail CI on OSV.dev HIGH/Critical Vulnerabilities with Webhook

Fail Your CI When OSV.dev Finds HIGH/Critical Vulnerabilities (Webhook-Based)

This n8n workflow turns OSV.dev vulnerability intelligence into a CI pass/fail gate—it receives a dependency manifest via webhook, checks exact versions against OSV.dev using an Apify Actor, and returns a CI-friendly summary that flags HIGH and CRITICAL findings.

What this workflow does

• Receives a POST request on a webhook with either:
  • {"manifestText":"..."} (e.g., raw lockfile/manifest text), or
  • {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}]} (an explicit package/version list).
• Normalizes and validates the payload, applying defaults such as minimum severity (HIGH) and whether to include dev dependencies, and ensures a manifest or package list is provided.
• Queries OSV.dev through the Apify actor fairquery/osv-dependency-vulnerability-check to retrieve vulnerability rows for the exact versions supplied.
• Aggregates results into a CI gate summary:
  • Counts packages checked and vulnerable packages
  • Counts HIGH/CRITICAL vulnerabilities
  • Lists top findings and suggested fixed versions
• Returns the summary as the webhook response, including a fail flag you can use to fail your CI job when HIGH/CRITICAL issues are found.

Use cases

• Gate a CI pipeline so builds fail if OSV.dev reports HIGH/CRITICAL vulnerabilities in dependency lockfiles.
• Validate dependency changes in PRs by posting the updated manifest text to the n8n webhook.
• Run security checks on selected package/version sets (e.g., during release workflows) and automatically surface the highest-risk fixes.

Technical details

• n8n nodes: code, webhook, sticky note, http request
• OSV.dev lookup: Apify Actor fairquery/osv-dependency-vulnerability-check
• Apify auth: set an Authorization: Bearer <YOUR_APIFY_TOKEN> header in the HTTP request step