mirror of
https://github.com/imjasonh/govulncheck-action
synced 2026-07-07 00:12:55 +00:00
fe5af5345a
## Problem
The govulncheck action was incorrectly reporting "no vulnerabilities found" even when
vulnerabilities were present. This was happening because govulncheck outputs pretty-printed
JSON (multi-line format) rather than JSON lines format.
## Root Cause
The parser had a logic bug where it would set `parsedAsJsonLines = true` whenever it
encountered ANY valid JSON line, including trivial ones like `{`. This prevented the
multi-line JSON parser from ever running, causing all findings to be missed.
## Solution
Changed the parser to only skip multi-line parsing if it actually found meaningful data
(OSV details or findings) in JSON lines format. Now it correctly falls back to multi-line
JSON parsing when needed.
## Additional Changes
Updated the example workflow to fail if no vulnerabilities are detected, since we know
the example code contains vulnerabilities. This serves as a regression test to ensure
the parser continues to work correctly.
## Testing
- Verified the parser now correctly identifies 8 vulnerabilities in the example code
- The action now properly reports vulnerabilities instead of false negatives
- CI checks are now working correctly
- Example workflow now fails if the parser bug resurfaces
This is a critical bug fix that prevents false "no vulnerabilities" reports.
Signed-off-by: Jason Hall <jason@chainguard.dev>
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
name: Example Vulnerability Check
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
workflow_dispatch: # Allow manual triggering
|
|
|
|
jobs:
|
|
example:
|
|
name: Check Example for Vulnerabilities
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: stable
|
|
|
|
- name: Run govulncheck on example
|
|
id: govulncheck
|
|
uses: ./
|
|
with:
|
|
working-directory: './example'
|
|
|
|
# We expect the check to fail, since there are known vulnerabilities in the example code.
|
|
# Therefore, we fail if no vulnerabilities are found.
|
|
- name: Check for vulnerabilities
|
|
if: steps.govulncheck.outputs.vulnerabilities-found != 'true'
|
|
run: |
|
|
echo "No vulnerabilities found, but we expected some in the example code."
|
|
exit 1
|
|
|
|
- name: Demonstrate conditional failure
|
|
run: |
|
|
echo "In a real workflow, you might want to fail if vulnerabilities are found:"
|
|
echo "if: steps.govulncheck.outputs.vulnerabilities-found == 'true'"
|
|
echo "run: exit 1"
|