GitHub Action

The Setup Vulnlog CLI action installs the Vulnlog CLI on a GitHub Actions runner and puts it on PATH. Install it once per job, every later step calls vulnlog directly.

The action is published on the GitHub Marketplace and developed at vulnlog/setup-vulnlog.

Usage

steps:
  - uses: actions/checkout@v4

  - name: Set up Vulnlog CLI
    uses: vulnlog/setup-vulnlog@v1
    with:
      version: 0.18.0

  - run: vulnlog validate vulnlog.yaml --strict

  - run: vulnlog report impact vulnlog.yaml

The action needs no token and no permissions block. It only downloads public release assets from GitHub.

Inputs

Input Default Description

version

latest

Version to install, for example 0.18.0 or v0.18.0. latest resolves the newest stable release and never selects a pre-release.

Pin version in every pipeline you rely on. latest picks up a new release the moment it ships, which suits a nightly job and not a release pipeline.

Outputs

Output Description

version

The installed version, without the leading v.

distribution

native or jvm.

path

Absolute path to the vulnlog executable.

cache-hit

true when the version came from the runner tool cache and nothing was downloaded.

Runner support

The action installs the native binary where one exists, and the JVM distribution everywhere else.

Runner Distribution Java required

ubuntu-latest, ubuntu-24.04 (x64)

native

No

macos-latest, macos-14 and later (arm64)

native

No

windows-latest (x64)

native

No

ubuntu-24.04-arm (arm64)

jvm

Yes

macos-15-intel (Intel x64)

jvm

Yes

On a runner without a native build, install Java 21 or later first. Otherwise the step fails and tells you to:

- uses: actions/setup-java@v6
  with:
    distribution: temurin
    java-version: '21'

- uses: vulnlog/setup-vulnlog@v1

Vulnlog releases do not yet publish checksums or build attestations, so the action cannot verify the download. It will verify by default once they are published.

See also