From 9658881ffacd923f9a94972a5533f4dc762ce46f Mon Sep 17 00:00:00 2001
From: Jason Hall <jason@chainguard.dev>
Date: Fri, 6 Jun 2025 23:50:57 -0400
Subject: [PATCH] Fix working-directory handling to always run govulncheck on
 ./...
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The action was incorrectly passing the working-directory value as an argument
to govulncheck. This fix ensures that:

- The action changes into the specified working-directory
- govulncheck always runs on './...' from within that directory
- Annotations use relative paths from the working directory

This matches the expected behavior where working-directory controls where
govulncheck runs, but govulncheck itself always scans the entire module
tree from that location.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
---
 dist/index.js            |  8 ++++----
 index.js                 |  4 ++--
 lib/govulncheck.js       |  4 ++--
 test/govulncheck.test.js | 14 +-------------
 test/index.test.js       |  2 +-
 5 files changed, 10 insertions(+), 22 deletions(-)

diff --git a/dist/index.js b/dist/index.js
index 0343dd9..51bd215 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -29,7 +29,7 @@ async function run(dependencies = {}) {
 
     // Run govulncheck with JSON output
     core.info('Running govulncheck...');
-    const { output, errorOutput } = await govulncheck.run('./...');
+    const { output, errorOutput } = await govulncheck.run();
 
     if (errorOutput) {
       core.warning(`govulncheck stderr: ${errorOutput}`);
@@ -39,7 +39,7 @@ async function run(dependencies = {}) {
     const vulnerabilities = parser.parse(output);
 
     // Create annotations
-    await annotator.createAnnotations(vulnerabilities, parser, workingDirectory);
+    await annotator.createAnnotations(vulnerabilities, parser, '.');
 
     // Set outputs
     const hasVulnerabilities = vulnerabilities.length > 0;
@@ -177,7 +177,7 @@ class GovulncheckRunner {
     await this.exec.exec('go', ['install', 'golang.org/x/vuln/cmd/govulncheck@latest']);
   }
 
-  async run(workingDirectory = './...') {
+  async run() {
     let output = '';
     let errorOutput = '';
     
@@ -193,7 +193,7 @@ class GovulncheckRunner {
       ignoreReturnCode: true
     };
     
-    const exitCode = await this.exec.exec('govulncheck', ['-json', workingDirectory], options);
+    const exitCode = await this.exec.exec('govulncheck', ['-json', './...'], options);
     
     return {
       output,
diff --git a/index.js b/index.js
index 064f0ea..94b7e05 100644
--- a/index.js
+++ b/index.js
@@ -23,7 +23,7 @@ async function run(dependencies = {}) {
 
     // Run govulncheck with JSON output
     core.info('Running govulncheck...');
-    const { output, errorOutput } = await govulncheck.run('./...');
+    const { output, errorOutput } = await govulncheck.run();
 
     if (errorOutput) {
       core.warning(`govulncheck stderr: ${errorOutput}`);
@@ -33,7 +33,7 @@ async function run(dependencies = {}) {
     const vulnerabilities = parser.parse(output);
 
     // Create annotations
-    await annotator.createAnnotations(vulnerabilities, parser, workingDirectory);
+    await annotator.createAnnotations(vulnerabilities, parser, '.');
 
     // Set outputs
     const hasVulnerabilities = vulnerabilities.length > 0;
diff --git a/lib/govulncheck.js b/lib/govulncheck.js
index 0ccdae4..13129a0 100644
--- a/lib/govulncheck.js
+++ b/lib/govulncheck.js
@@ -9,7 +9,7 @@ class GovulncheckRunner {
     await this.exec.exec('go', ['install', 'golang.org/x/vuln/cmd/govulncheck@latest']);
   }
 
-  async run(workingDirectory = './...') {
+  async run() {
     let output = '';
     let errorOutput = '';
     
@@ -25,7 +25,7 @@ class GovulncheckRunner {
       ignoreReturnCode: true
     };
     
-    const exitCode = await this.exec.exec('govulncheck', ['-json', workingDirectory], options);
+    const exitCode = await this.exec.exec('govulncheck', ['-json', './...'], options);
     
     return {
       output,
diff --git a/test/govulncheck.test.js b/test/govulncheck.test.js
index 138fabb..f02f5b3 100644
--- a/test/govulncheck.test.js
+++ b/test/govulncheck.test.js
@@ -80,7 +80,7 @@ describe('GovulncheckRunner', () => {
       expect(result.errorOutput).toBe('error: vulnerabilities found');
     });
 
-    it('should use default working directory', async () => {
+    it('should always run on ./...', async () => {
       mockExec.exec.mockResolvedValue(0);
       
       await runner.run();
@@ -92,18 +92,6 @@ describe('GovulncheckRunner', () => {
       );
     });
 
-    it('should use custom working directory', async () => {
-      mockExec.exec.mockResolvedValue(0);
-      
-      await runner.run('./cmd/...');
-      
-      expect(mockExec.exec).toHaveBeenCalledWith(
-        'govulncheck',
-        ['-json', './cmd/...'],
-        expect.any(Object)
-      );
-    });
-
     it('should handle execution errors', async () => {
       mockExec.exec.mockRejectedValue(new Error('Command not found'));
       
diff --git a/test/index.test.js b/test/index.test.js
index 5c95a2a..cdd1b4f 100644
--- a/test/index.test.js
+++ b/test/index.test.js
@@ -65,7 +65,7 @@ describe('GitHub Action Integration', () => {
     expect(core.info).toHaveBeenCalledWith('No vulnerabilities found');
 
     expect(mockGovulncheck.install).toHaveBeenCalled();
-    expect(mockGovulncheck.run).toHaveBeenCalledWith('./...');
+    expect(mockGovulncheck.run).toHaveBeenCalled();
 
     expect(core.setOutput).toHaveBeenCalledWith('vulnerabilities-found', 'false');
     expect(core.setOutput).toHaveBeenCalledWith('vulnerability-count', '0');