mirror of
https://github.com/imjasonh/govulncheck-action
synced 2026-07-08 00:35:45 +00:00
39e329ab61
This action runs govulncheck on Go projects and creates GitHub annotations for vulnerabilities found in dependencies and code paths. Features: - Automated vulnerability scanning with govulncheck - Smart annotations on go.mod for vulnerable dependencies - Annotations on source code lines that call vulnerable functions - Configurable working directory - Output variables for vulnerability detection The implementation includes: - Modular architecture with separate concerns (execution, parsing, annotation) - Comprehensive test suite with 100% function coverage - Example vulnerable Go module for demonstration - GitHub workflow example - Full documentation 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
77 lines
No EOL
2.6 KiB
YAML
77 lines
No EOL
2.6 KiB
YAML
name: Example Vulnerability Check
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
workflow_dispatch: # Allow manual triggering
|
|
|
|
jobs:
|
|
check-example:
|
|
name: Check Example for Vulnerabilities
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: stable
|
|
|
|
- name: Run govulncheck on example
|
|
id: govulncheck
|
|
uses: ./
|
|
with:
|
|
working-directory: './example'
|
|
|
|
- name: Report vulnerability scan results
|
|
if: always()
|
|
run: |
|
|
echo "## Vulnerability Scan Results"
|
|
echo "- Vulnerabilities found: ${{ steps.govulncheck.outputs.vulnerabilities-found }}"
|
|
echo "- Vulnerability count: ${{ steps.govulncheck.outputs.vulnerability-count }}"
|
|
|
|
if [ "${{ steps.govulncheck.outputs.vulnerabilities-found }}" == "true" ]; then
|
|
echo ""
|
|
echo "⚠️ Security vulnerabilities were detected in the example code."
|
|
echo "This is expected! The example intentionally uses a vulnerable version of golang.org/x/net"
|
|
echo "to demonstrate how the action creates annotations."
|
|
else
|
|
echo ""
|
|
echo "✅ No vulnerabilities found (this would be unexpected for the example)."
|
|
fi
|
|
|
|
# Note: We don't fail the workflow here since the example is intentionally vulnerable
|
|
- name: Demonstrate conditional failure
|
|
run: |
|
|
echo "In a real workflow, you might want to fail if vulnerabilities are found:"
|
|
echo "if: steps.govulncheck.outputs.vulnerabilities-found == 'true'"
|
|
echo "run: exit 1"
|
|
|
|
check-action-itself:
|
|
name: Check Action Code for Vulnerabilities
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: stable
|
|
|
|
# Check if the action itself has any Go code with vulnerabilities
|
|
# This should pass since our action is written in JavaScript
|
|
- name: Run govulncheck on root
|
|
id: govulncheck-root
|
|
uses: ./
|
|
with:
|
|
working-directory: '.'
|
|
continue-on-error: true # Don't fail if no go.mod found
|
|
|
|
- name: Report results
|
|
if: always()
|
|
run: |
|
|
echo "Action code scan complete."
|
|
echo "Since this action is written in JavaScript, govulncheck won't find Go vulnerabilities here." |