govulncheck-action/example/main.go

package main

import (
	"strings"

	"golang.org/x/net/html"
)

func main() {
	// html.Parse in x/net/html has a vulnerability in the version we depend on. The action should find it.
	_, err := html.Parse(strings.NewReader(`<html><body><p>hello</p></body></html>`))
	if err != nil {
		panic(err)
	}
}
Initial implementation of govulncheck GitHub Action This action runs govulncheck on Go projects and creates GitHub annotations for vulnerabilities found in dependencies and code paths. Features: - Automated vulnerability scanning with govulncheck - Smart annotations on go.mod for vulnerable dependencies - Annotations on source code lines that call vulnerable functions - Configurable working directory - Output variables for vulnerability detection The implementation includes: - Modular architecture with separate concerns (execution, parsing, annotation) - Comprehensive test suite with 100% function coverage - Example vulnerable Go module for demonstration - GitHub workflow example - Full documentation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> 2025-06-06 23:41:03 -04:00			`package main`

			`import (`
			`"strings"`

			`"golang.org/x/net/html"`
			`)`

			`func main() {`
			`// html.Parse in x/net/html has a vulnerability in the version we depend on. The action should find it.`
Fix: Parser fails to detect vulnerabilities in multi-line JSON output ## Problem The govulncheck action was incorrectly reporting "no vulnerabilities found" even when vulnerabilities were present. This was happening because govulncheck outputs pretty-printed JSON (multi-line format) rather than JSON lines format. ## Root Cause The parser had a logic bug where it would set `parsedAsJsonLines = true` whenever it encountered ANY valid JSON line, including trivial ones like `{`. This prevented the multi-line JSON parser from ever running, causing all findings to be missed. ## Solution Changed the parser to only skip multi-line parsing if it actually found meaningful data (OSV details or findings) in JSON lines format. Now it correctly falls back to multi-line JSON parsing when needed. ## Additional Changes Updated the example workflow to fail if no vulnerabilities are detected, since we know the example code contains vulnerabilities. This serves as a regression test to ensure the parser continues to work correctly. ## Testing - Verified the parser now correctly identifies 8 vulnerabilities in the example code - The action now properly reports vulnerabilities instead of false negatives - CI checks are now working correctly - Example workflow now fails if the parser bug resurfaces This is a critical bug fix that prevents false "no vulnerabilities" reports. Signed-off-by: Jason Hall <jason@chainguard.dev> 2025-06-07 02:26:48 -04:00			_, err := html.Parse(strings.NewReader(`<html><body><p>hello</p></body></html>`))
Initial implementation of govulncheck GitHub Action This action runs govulncheck on Go projects and creates GitHub annotations for vulnerabilities found in dependencies and code paths. Features: - Automated vulnerability scanning with govulncheck - Smart annotations on go.mod for vulnerable dependencies - Annotations on source code lines that call vulnerable functions - Configurable working directory - Output variables for vulnerability detection The implementation includes: - Modular architecture with separate concerns (execution, parsing, annotation) - Comprehensive test suite with 100% function coverage - Example vulnerable Go module for demonstration - GitHub workflow example - Full documentation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com> 2025-06-06 23:41:03 -04:00			`if err != nil {`
			`panic(err)`
			`}`
			`}`