imjasonh/govulncheck-action
1
0
Fork 0
mirror of https://github.com/imjasonh/govulncheck-action synced 2026-07-17 14:14:55 +00:00
Code Activity
57 commits 16 branches 1 tag 2.8 MiB
Commit graph

12 commits

Author SHA1 Message Date
dependabot[bot]
831f6a106c
chore(deps-dev): bump the npm-dependencies group with 2 updates (#32) 
Bumps the npm-dependencies group with 2 updates: [eslint](https://github.com/eslint/eslint) and [lint-staged](https://github.com/lint-staged/lint-staged).


Updates `eslint` from 9.32.0 to 9.33.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.32.0...v9.33.0)

Updates `lint-staged` from 16.1.4 to 16.1.5
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lint-staged/lint-staged/compare/v16.1.4...v16.1.5)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 9.33.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: lint-staged
  dependency-version: 16.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-08-12 06:10:27 +00:00
dependabot[bot]
0364208e90
chore(deps-dev): bump lint-staged in the npm-dependencies group (#31) 
Bumps the npm-dependencies group with 1 update: [lint-staged](https://github.com/lint-staged/lint-staged).


Updates `lint-staged` from 16.1.2 to 16.1.4
- [Release notes](https://github.com/lint-staged/lint-staged/releases)
- [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md)
- [Commits](https://github.com/lint-staged/lint-staged/compare/v16.1.2...v16.1.4)

---
updated-dependencies:
- dependency-name: lint-staged
  dependency-version: 16.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-08-05 03:23:57 +00:00
dependabot[bot]
5cb6fb26c4
chore(deps-dev): bump the npm-dependencies group with 2 updates (#30) 
Bumps the npm-dependencies group with 2 updates: [eslint](https://github.com/eslint/eslint) and [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest).


Updates `eslint` from 9.30.0 to 9.32.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.30.0...v9.32.0)

Updates `jest` from 30.0.3 to 30.0.5
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.0.5/packages/jest)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 9.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
- dependency-name: jest
  dependency-version: 30.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2025-07-30 19:39:25 +00:00
Jason Hall
294e12fa6f
Merge pull request #14 from imjasonh/dependabot/npm_and_yarn/jest-30.0.3 
chore(deps-dev): bump jest from 30.0.0 to 30.0.3
 2025-07-05 13:37:44 -04:00
Jason Hall
595aead66a
Merge pull request #15 from imjasonh/dependabot/npm_and_yarn/prettier-3.6.2 
chore(deps-dev): bump prettier from 3.5.3 to 3.6.2
 2025-07-05 13:37:32 -04:00
dependabot[bot]
40b2cfab7c
chore(deps-dev): bump eslint from 9.29.0 to 9.30.0 
---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 9.30.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-07-01 00:58:54 +00:00
dependabot[bot]
9efbeb21b0
chore(deps-dev): bump prettier from 3.5.3 to 3.6.2 
---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-07-01 00:47:36 +00:00
dependabot[bot]
3b444171fd
chore(deps-dev): bump jest from 30.0.0 to 30.0.3 
---
updated-dependencies:
- dependency-name: jest
  dependency-version: 30.0.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-07-01 00:45:34 +00:00
dependabot[bot]
db6833340d
chore(deps-dev): bump jest from 29.7.0 to 30.0.0 
Bumps [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) from 29.7.0 to 30.0.0.
- [Release notes](https://github.com/jestjs/jest/releases)
- [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md)
- [Commits](https://github.com/jestjs/jest/commits/v30.0.0/packages/jest)

---
updated-dependencies:
- dependency-name: jest
  dependency-version: 30.0.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-06-17 18:25:28 +00:00
Jason Hall
e846b15dea
Add pre-commit setup with husky, eslint, and prettier 
- Install husky, lint-staged, eslint, and prettier dev dependencies
- Configure ESLint with basic Node.js rules
- Configure Prettier for consistent code formatting
- Set up husky pre-commit hook to run lint-staged
- Fix build script to use correct path (index.js not src/index.js)

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-06-17 14:21:49 -04:00
Jason Hall
f4a3fa7150
Fix action runtime by bundling dependencies with ncc 
The action was failing with "Cannot find module '@actions/core'" because
node_modules weren't available at runtime. This commit fixes the issue by:

- Adding @vercel/ncc to bundle all dependencies into a single dist/index.js file
- Updating action.yml to point to the bundled dist/index.js
- Adding a build script to compile the action
- Including the dist/ directory in the repository (standard for GitHub Actions)

This is the recommended approach for JavaScript-based GitHub Actions to ensure
all dependencies are available at runtime without requiring npm install.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-06-06 23:46:19 -04:00
Jason Hall
39e329ab61
Initial implementation of govulncheck GitHub Action 
This action runs govulncheck on Go projects and creates GitHub annotations
for vulnerabilities found in dependencies and code paths.

Features:
- Automated vulnerability scanning with govulncheck
- Smart annotations on go.mod for vulnerable dependencies
- Annotations on source code lines that call vulnerable functions
- Configurable working directory
- Output variables for vulnerability detection

The implementation includes:
- Modular architecture with separate concerns (execution, parsing, annotation)
- Comprehensive test suite with 100% function coverage
- Example vulnerable Go module for demonstration
- GitHub workflow example
- Full documentation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
 2025-06-06 23:41:03 -04:00