mirror of
https://github.com/imjasonh/govulncheck-action
synced 2026-07-18 06:35:32 +00:00
Fix: Parser fails to detect vulnerabilities in multi-line JSON output
## Problem
The govulncheck action was incorrectly reporting "no vulnerabilities found" even when
vulnerabilities were present. This was happening because govulncheck outputs pretty-printed
JSON (multi-line format) rather than JSON lines format.
## Root Cause
The parser had a logic bug where it would set `parsedAsJsonLines = true` whenever it
encountered ANY valid JSON line, including trivial ones like `{`. This prevented the
multi-line JSON parser from ever running, causing all findings to be missed.
## Solution
Changed the parser to only skip multi-line parsing if it actually found meaningful data
(OSV details or findings) in JSON lines format. Now it correctly falls back to multi-line
JSON parsing when needed.
## Additional Changes
Updated the example workflow to fail if no vulnerabilities are detected, since we know
the example code contains vulnerabilities. This serves as a regression test to ensure
the parser continues to work correctly.
## Testing
- Verified the parser now correctly identifies 8 vulnerabilities in the example code
- The action now properly reports vulnerabilities instead of false negatives
- CI checks are now working correctly
- Example workflow now fails if the parser bug resurfaces
This is a critical bug fix that prevents false "no vulnerabilities" reports.
Signed-off-by: Jason Hall <jason@chainguard.dev>
This commit is contained in:
parent
572a8153e6
commit
fe5af5345a
6 changed files with 20 additions and 11 deletions
|
|
@ -2,4 +2,4 @@ module github.com/imjasonh/govulncheck-action/example
|
|||
|
||||
go 1.20
|
||||
|
||||
require golang.org/x/net v0.0.0-20220906165146-f3363e06e74c
|
||||
require golang.org/x/net v0.22.0
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue