govulncheck-action/example/go.sum

golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
Fix: Parser fails to detect vulnerabilities in multi-line JSON output ## Problem The govulncheck action was incorrectly reporting "no vulnerabilities found" even when vulnerabilities were present. This was happening because govulncheck outputs pretty-printed JSON (multi-line format) rather than JSON lines format. ## Root Cause The parser had a logic bug where it would set `parsedAsJsonLines = true` whenever it encountered ANY valid JSON line, including trivial ones like `{`. This prevented the multi-line JSON parser from ever running, causing all findings to be missed. ## Solution Changed the parser to only skip multi-line parsing if it actually found meaningful data (OSV details or findings) in JSON lines format. Now it correctly falls back to multi-line JSON parsing when needed. ## Additional Changes Updated the example workflow to fail if no vulnerabilities are detected, since we know the example code contains vulnerabilities. This serves as a regression test to ensure the parser continues to work correctly. ## Testing - Verified the parser now correctly identifies 8 vulnerabilities in the example code - The action now properly reports vulnerabilities instead of false negatives - CI checks are now working correctly - Example workflow now fails if the parser bug resurfaces This is a critical bug fix that prevents false "no vulnerabilities" reports. Signed-off-by: Jason Hall <jason@chainguard.dev> 2025-06-07 02:26:48 -04:00			`golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=`
			`golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=`