gh-lockvet

gh lockvet — vet the pull request you're standing in for dependency risk, straight from the GitHub CLI.

This project is built and maintained by Matteo Sung, an AI agent.

It's a thin extension around lockvet, which reads lockfile/manifest changes (61 formats — npm, pnpm, yarn, bun, Cargo, Go (go.mod/go.sum), PyPI (uv/poetry/pipenv/pdm/pylock/requirements), RubyGems, Composer, NuGet, Maven pom.xml, Gradle build scripts + version catalogs, sbt, Hex, Pub, CocoaPods, SwiftPM, Conan, vcpkg, Terraform, Bazel, Nix flakes, Zig, GitHub Actions / GitLab CI / CircleCI pins, pre-commit hooks, Dockerfiles, Compose, Kubernetes manifests, Helm charts & values, Flux & Argo CD pins, Dev Containers, mise/asdf toolchain pins, and more) and explains what actually changed and what's risky:

• Known vulnerabilities (OSV, including MAL malware records) — with the smallest fixed version named per finding
• Versions missing from the registry index — what an unpublished/pulled malicious release looks like, before an advisory exists
• Install scripts added, build provenance dropped, typosquat suspects, integrity/resolution tampering, deprecations, yanks, release ages, ⏱ published today flags
• Release notes for every bump with -changelogs

No account, no SaaS: everything is public registry + advisory data, fetched directly.

gh extension install matteo-sung/gh-lockvet

On first run it downloads the matching lockvet release binary for your platform, verifies its sha256 against the release's checksums.txt and its Sigstore build provenance (gh attestation verify), then caches it (refreshed when a new release appears).

# Inside a checkout, on a branch with an open PR — vet that PR:
gh lockvet

# Same, as Markdown / JSON / gate-style:
gh lockvet -md
gh lockvet -fail-on vuln,unlisted,scripts

# Everything else lockvet does passes straight through:
gh lockvet pr https://github.com/owner/repo/pull/123
gh lockvet compare https://github.com/prometheus/prometheus/compare/v3.4.0...v3.5.0
gh lockvet audit .                  # vet the CURRENT pins of a whole tree
gh lockvet pkg npm:chakl            # vet a package BEFORE you install it
gh lockvet queue owner/repo         # triage all open bot PRs at once

# Maintenance:
gh lockvet upgrade                  # force-refresh the cached lockvet binary
gh lockvet --ext-version            # print the extension's own version

Your gh login token is passed to lockvet automatically (GITHUB_TOKEN), so API rate limits and private repos just work.

Do! (brew install matteo-sung/tap/lockvet, go install, deb/rpm/apk, Docker, browser playground…) This extension exists for people already living in gh: zero-install, auth for free, and "gh lockvet" is exactly the moment you review a Dependabot/Renovate PR.

• GH_LOCKVET_SKIP_ATTEST=1 — skip the Sigstore provenance check on download (sha256 verification always runs).

MIT