From 24718a71149fa1dc755aa01f460b342e4a1716ba Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Sat, 7 Jun 2025 02:08:43 -0400
Subject: [PATCH] Detect and fail on missing go.sum dependencies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, if go.sum was out of date or missing, govulncheck would fail
to analyze the code but the action would report "no vulnerabilities found"
which is misleading and dangerous.

This change:
- Detects specific error patterns in govulncheck stderr that indicate
  missing dependencies (missing go.sum entry, could not import, invalid package name)
- Throws a clear error message telling users to run 'go mod tidy'
- Prevents false "no vulnerabilities" reports when govulncheck can't analyze the code

Added tests to verify the behavior for both missing go.sum and import errors.

Fixes the issue where vulnerabilities could be missed due to dependency problems.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 dist/index.js      |  7 +++++++
 index.js           |  7 +++++++
 test/index.test.js | 28 ++++++++++++++++++++++++++++
 3 files changed, 42 insertions(+)

diff --git a/dist/index.js b/dist/index.js
index 5963160..aceca09 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -35,6 +35,13 @@ async function run(dependencies = {}) {
 
     if (errorOutput) {
       core.warning(`govulncheck stderr: ${errorOutput}`);
+      
+      // Check for critical errors that indicate govulncheck couldn't run properly
+      if (errorOutput.includes('missing go.sum entry') || 
+          errorOutput.includes('could not import') ||
+          errorOutput.includes('invalid package name')) {
+        throw new Error(`govulncheck failed due to missing dependencies. Please run 'go mod tidy' to update go.mod and go.sum files.\n\nError: ${errorOutput}`);
+      }
     }
 
     // Log raw output for debugging
diff --git a/index.js b/index.js
index 96a33a7..2fffab8 100644
--- a/index.js
+++ b/index.js
@@ -29,6 +29,13 @@ async function run(dependencies = {}) {
 
     if (errorOutput) {
       core.warning(`govulncheck stderr: ${errorOutput}`);
+      
+      // Check for critical errors that indicate govulncheck couldn't run properly
+      if (errorOutput.includes('missing go.sum entry') || 
+          errorOutput.includes('could not import') ||
+          errorOutput.includes('invalid package name')) {
+        throw new Error(`govulncheck failed due to missing dependencies. Please run 'go mod tidy' to update go.mod and go.sum files.\n\nError: ${errorOutput}`);
+      }
     }
 
     // Log raw output for debugging
diff --git a/test/index.test.js b/test/index.test.js
index 5d3ee04..d6b63cb 100644
--- a/test/index.test.js
+++ b/test/index.test.js
@@ -174,6 +174,34 @@ describe('GitHub Action Integration', () => {
     );
   });
 
+  it('should fail when go.sum is missing', async () => {
+    mockGovulncheck.run.mockResolvedValue({
+      output: '{"config": {}}',
+      errorOutput: 'missing go.sum entry for module providing package golang.org/x/net/html',
+      exitCode: 1
+    });
+
+    await expect(run({
+      govulncheck: mockGovulncheck,
+      parser: mockParser,
+      annotator: mockAnnotator
+    })).rejects.toThrow('govulncheck failed due to missing dependencies');
+  });
+
+  it('should fail when imports cannot be resolved', async () => {
+    mockGovulncheck.run.mockResolvedValue({
+      output: '{"config": {}}',
+      errorOutput: 'could not import golang.org/x/net/html (invalid package name: "")',
+      exitCode: 1
+    });
+
+    await expect(run({
+      govulncheck: mockGovulncheck,
+      parser: mockParser,
+      annotator: mockAnnotator
+    })).rejects.toThrow('govulncheck failed due to missing dependencies');
+  });
+
   it('should handle errors and set action as failed', async () => {
     const error = new Error('Failed to install govulncheck');
     mockGovulncheck.install.mockRejectedValue(error);