Lockhound

GitHub pull request checks

Stop risky dependencies at the pull request

A GitHub check on every pull request that fails only when the pull request adds a vulnerable, exploited or malicious dependency, or a file that looks like malware, never because of the backlog already on main.

Check a lockfile, no sign-upStart free

The cheapest moment to stop a vulnerable dependency is before it is merged. But a check that fails on every pull request because the main branch already has forty open findings gets ignored, then disabled. Lockhound's check only judges what the pull request changes.

How it decides

When a pull request into your default branch changes a dependency file, Lockhound scans the head commit and compares the result with the findings already on the default branch.

  • Fails if the pull request introduces:
    • a malicious package;
    • a vulnerability CISA lists as exploited in the wild;
    • a vulnerability at or above your workspace's severity threshold (by default high or worse);
    • a dependency file it can no longer read, so nothing slips through unchecked;
    • a file that looks like committed malware, among the files the pull request changes.
  • Passes, and says how many existing findings the pull request fixes, when it adds nothing that crosses the line.
  • Passes immediately when no dependency file changed.
  • Reports neutral, never failure, if Lockhound itself can't complete the scan. An outage on our side shouldn't block your merges.

The threshold is set per workspace: critical, high, medium, low, or "only malicious and exploited". Malicious packages, exploited vulnerabilities and malware always fail, whatever the setting.

What the check shows

The check run lists each new finding with its severity, whether it is direct or transitive, and the version that fixes it. In simplified form:

Lockhound: 1 vulnerability to fix before merging
This pull request adds 2 known vulnerabilities. 1 is high or worse,
malicious, or exploited in the wild.

[email protected] (transitive) · CVE-2021-44906 · critical · Upgrade to 1.2.6

Making it a gate

In your repository settings, add a branch protection rule (or ruleset) for the default branch, turn on Require status checks to pass before merging, and add Lockhound. No GitHub Actions workflow, token or CI minutes are needed. The check comes from the GitHub App.

Permissions

The check needs the App's Checks: read and write and Pull requests: read-only permissions, on top of read-only access to contents. It reads pull request metadata (branch names and commit IDs), never comments or code beyond dependency files and the few files the malware check looks at. It can't merge, comment or change code. See exactly what Lockhound can access.

Read next