Add osv-scanner bootstrap, passthrough, and JSON reports

AGENTS.md

@@ -26,5 +26,5 @@ This file is for agents changing the gatecheck repository. To use the gatecheck
 - Check `gatecheck <command> --help` before describing a flag. `docs/cli-reference.md` matches the CLI on main.
 - Report type detection is a lowercase substring of the filename. See `docs/supported-reports.md`.
 - Coverage thresholds and EPSS scores are ratios from 0 to 1.
-- Exit codes from `cmd/gatecheck`: 0 success, 1 threshold failure (`gatecheck.ErrValidationFailure`), 255 any other error (`os.Exit(-1)`). `grype`, `syft`, `gitleaks`, `semgrep`, `osemgrep`, and `trivy` return the scanner's status. A missing scanner still exits 255.
+- Exit codes from `cmd/gatecheck`: 0 success, 1 threshold failure (`gatecheck.ErrValidationFailure`), 255 any other error (`os.Exit(-1)`). `grype`, `syft`, `gitleaks`, `semgrep`, `osemgrep`, `trivy`, and `osv-scanner` return the scanner's status. A missing scanner still exits 255.
 - Do not add copyright notices.

CHANGELOG.md

@@ -11,6 +11,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `gatecheck bootstrap` installs pinned Trivy 0.76.1, and `gatecheck trivy` runs it.
 - Trivy JSON reports work with `list`, `validate`, and `bundle`. Severity limits and CVE allow and deny lists follow the Grype rules.
+- `gatecheck bootstrap` installs pinned osv-scanner 2.7.0, and `gatecheck osv-scanner` runs it.
+- osv-scanner JSON reports work with `list`, `validate`, and `bundle`. Severity limits and CVE allow and deny lists follow the Grype rules.
+
+### Changed
+
+- `gatecheck bootstrap --list` widens the tool column so `osv-scanner` fits.
 
 ## [0.9.0] - 2026-10-23
 

README.md

@@ -44,15 +44,15 @@ gatecheck validate --config gatecheck.yaml grype-report.json
 
 `gatecheck agent-guide` (alias `llm`) prints a markdown guide for coding agents. The same text is `docs/agent-guide.md`.
 
-`gatecheck bootstrap` installs pinned Grype, Syft, Gitleaks, semgrep's experimental osemgrep CLI, and Trivy. `gatecheck grype`, `gatecheck syft`, `gatecheck gitleaks`, `gatecheck semgrep`, `gatecheck osemgrep`, and `gatecheck trivy` run them.
+`gatecheck bootstrap` installs pinned Grype, Syft, Gitleaks, semgrep's experimental osemgrep CLI, Trivy, and osv-scanner. `gatecheck grype`, `gatecheck syft`, `gatecheck gitleaks`, `gatecheck semgrep`, `gatecheck osemgrep`, `gatecheck trivy`, and `gatecheck osv-scanner` run them.
 
 ### Summarize Reports with List
 
 ```shell
 gatecheck ls --help
 ```
 
-List with EPSS scores is supported for Grype and CycloneDX reports.
+List with EPSS scores is supported for Grype, CycloneDX, Trivy, and osv-scanner reports.
 
 ![Gatecheck List](https://static.gatecheck.dev/gatecheck-list.gif)
 

cmd/bootstrap.go

@@ -39,7 +39,7 @@ func newBootstrapCommand() *cobra.Command {
 			})
 		},
 	}
-	cmd.Flags().String("tools", "", "comma-separated scanners to install (default grype,syft,gitleaks,semgrep,trivy)")
+	cmd.Flags().String("tools", "", "comma-separated scanners to install (default grype,syft,gitleaks,semgrep,trivy,osv-scanner)")
 	cmd.Flags().Bool("force", false, "reinstall even when the pinned version is already present")
 	cmd.Flags().Bool("list", false, "print pinned versions, installed versions, and paths")
 	return cmd

cmd/bootstrap_test.go

@@ -39,7 +39,7 @@ func TestBootstrapCommandListAndPassthrough(t *testing.T) {
 	if err := root.Execute(); err != nil {
 		t.Fatal(err)
 	}
-	for _, version := range []string{bootstrap.GrypeVersion, bootstrap.SyftVersion, bootstrap.GitleaksVersion, bootstrap.SemgrepVersion, bootstrap.TrivyVersion} {
+	for _, version := range []string{bootstrap.GrypeVersion, bootstrap.SyftVersion, bootstrap.GitleaksVersion, bootstrap.SemgrepVersion, bootstrap.TrivyVersion, bootstrap.OSVScannerVersion} {
 		if !strings.Contains(out.String(), version) {
 			t.Fatalf("list missing %s\n%s", version, out.String())
 		}

cmd/list.go

@@ -12,7 +12,7 @@ import (
 	"github.com/spf13/cobra"
 )
 
-var supportedTypes = []string{"grype", "semgrep", "gitleaks", "syft", "cyclonedx", "bundle", "gatecheck", "trivy"}
+var supportedTypes = []string{"grype", "semgrep", "gitleaks", "syft", "cyclonedx", "bundle", "gatecheck", "trivy", "osv"}
 
 var listCmd = &cobra.Command{
 	Use:     "list",
@@ -121,7 +121,7 @@ var listAllCmd = &cobra.Command{
 			}
 			opts = append(opts, displayOpt)
 
-			if epss && slices.ContainsFunc([]string{"grype", "cyclonedx", "trivy"}, supportedFunc) {
+			if epss && slices.ContainsFunc([]string{"grype", "cyclonedx", "trivy", "osv"}, supportedFunc) {
 				epssOpt, err := gatecheck.WithEPSS(epssFile, epssURL, epssCacheOptions()...)
 				if err != nil {
 					slog.Error("epss fetch failure, skip", "filename", filename, "error", err)
@@ -157,7 +157,7 @@ func newListAllCommand() *cobra.Command {
 }
 
 func newListCommand() *cobra.Command {
-	listCmd.Flags().StringP("input-type", "i", "", "the input filetype if using STDIN [grype|semgrep|gitleaks|syft|bundle|trivy]")
+	listCmd.Flags().StringP("input-type", "i", "", "the input filetype if using STDIN [grype|semgrep|gitleaks|syft|bundle|trivy|osv]")
 	listCmd.Flags().Bool("markdown", false, "print as a markdown table")
 	listCmd.Flags().Bool("epss", false, "List with EPSS data")
 	RuntimeConfig.EPSSURL.SetupCobra(listCmd)

cmd/root.go

@@ -106,6 +106,7 @@ func NewGatecheckCommand() *cobra.Command {
 			newPassthroughCommand("semgrep", "Run osemgrep from the managed semgrep wheel"),
 			newPassthroughCommand("osemgrep", "Run osemgrep from the managed semgrep wheel"),
 			newPassthroughCommand("trivy", "Run the managed trivy scanner"),
+			newPassthroughCommand("osv-scanner", "Run the managed osv-scanner"),
 		)
 		addCommandOnce(gatecheckCmd, updateCmd)
 	})