Run OSV-Scanner as direct action

Author: CommanderK5

.github/workflows/osv-scanner.yaml

@@ -20,10 +20,31 @@ concurrency:
 jobs:
   scan-vulnerable-lockfile:
     name: Scan vulnerable lockfile with OSV-Scanner
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.0
-    with:
-      scan-args: |-
-        --lockfile=./fixtures/vulnerable/package-lock.json
-      results-file-name: osv-results-vuln.sarif
-      upload-sarif: true
-      fail-on-vuln: false
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Run OSV-Scanner
+        id: osv
+        continue-on-error: true
+        uses: google/osv-scanner-action/osv-scanner-action@v2.3.1
+        with:
+          scan-args: |-
+            --lockfile=./fixtures/vulnerable/package-lock.json
+            --format=sarif
+            --output=./osv-results-vuln.sarif
+
+      - name: Upload SARIF to GitHub Security
+        if: always()
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: ./osv-results-vuln.sarif
+
+      - name: Upload SARIF artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: osv-results-vuln-sarif
+          path: ./osv-results-vuln.sarif
+          if-no-files-found: error

fixtures/vulnerable/package-lock.json

@@ -11,6 +11,6 @@
   "license": "ISC",
   "type": "commonjs",
   "dependencies": {
-    "minimist": "^1.2.6"
+    "minimist": "0.0.8"
   }
 }