govulncheck-action/lib/summary.js

class SummaryGenerator {
  constructor(core) {
    this.core = core;
  }

  async generateSummary(vulnerabilities, parser, workingDirectory = '.') {
    const modules = parser.extractUniqueModules(vulnerabilities);
    const callSites = parser.extractCallSites(vulnerabilities);
    
    // Group vulnerabilities by module
    const vulnsByModule = new Map();
    for (const vuln of vulnerabilities) {
      if (vuln.finding.trace && vuln.finding.trace[0]) {
        const module = vuln.finding.trace[0].module;
        if (!vulnsByModule.has(module)) {
          vulnsByModule.set(module, []);
        }
        vulnsByModule.get(module).push(vuln);
      }
    }
    
    // Sort modules for consistent output
    const sortedModules = Array.from(vulnsByModule.keys()).sort();
    
    // Start building the summary
    await this.core.summary
      .addHeading('🔍 Govulncheck Security Report', 1)
      .addEOL();
    
    if (vulnerabilities.length === 0) {
      await this.core.summary
        .addRaw('✅ No vulnerabilities found!')
        .addEOL()
        .write();
      return;
    }
    
    // Add overview
    await this.core.summary
      .addHeading('📊 Overview', 2)
      .addList([
        `Total vulnerabilities found: ${vulnerabilities.length}`,
        `Vulnerable modules: ${modules.length}`,
        `Vulnerable code locations: ${callSites.length}`
      ])
      .addEOL();
    
    // Add vulnerable modules section
    await this.core.summary
      .addHeading('📦 Vulnerable Modules', 2)
      .addEOL();
    
    for (const module of sortedModules) {
      const moduleVulns = vulnsByModule.get(module);
      const moduleInfo = moduleVulns[0].finding.trace[0];
      
      await this.core.summary
        .addHeading(`${module}`, 3)
        .addRaw(`Current version: ${moduleInfo.version}`)
        .addEOL()
        .addEOL();
      
      // Sort vulnerabilities by OSV ID
      const sortedVulns = moduleVulns.sort((a, b) => {
        const aId = a.finding.osv || '';
        const bId = b.finding.osv || '';
        return aId.localeCompare(bId);
      });
      
      // Create a table of vulnerabilities
      const tableRows = [['Vulnerability', 'Summary', 'Fixed Version', 'Details']];
      
      for (const vuln of sortedVulns) {
        const osvId = vuln.finding.osv;
        const summary = vuln.osvDetails?.summary || 'No summary available';
        const fixedVersion = vuln.finding.fixed_version || 'Not specified';
        
        let details = [];
        if (vuln.osvDetails?.aliases) {
          const cves = vuln.osvDetails.aliases.filter(a => a.startsWith('CVE-'));
          if (cves.length > 0) {
            details.push(`CVE: ${cves.join(', ')}`);
          }
        }
        
        // For the link, we'll add it as a separate line after the table
        tableRows.push([
          osvId,
          summary.length > 60 ? summary.substring(0, 60) + '...' : summary,
          fixedVersion,
          details.join(', ')
        ]);
      }
      
      await this.core.summary.addTable(tableRows);
      
      // Add links separately since we can't put them in the table
      await this.core.summary.addEOL().addRaw('Links: ');
      for (let i = 0; i < sortedVulns.length; i++) {
        const vuln = sortedVulns[i];
        if (i > 0) await this.core.summary.addRaw(' | ');
        await this.core.summary.addLink(vuln.finding.osv, `https://pkg.go.dev/vuln/${vuln.finding.osv}`);
      }
      await this.core.summary.addEOL().addEOL();
    }
    
    // Add vulnerable code locations section
    if (callSites.length > 0) {
      await this.core.summary
        .addHeading('🚨 Vulnerable Code Locations', 2)
        .addEOL();
      
      // Group call sites by file
      const callSitesByFile = new Map();
      for (const site of callSites) {
        const filePath = workingDirectory === '.' ? site.filename : `${workingDirectory}/${site.filename}`;
        if (!callSitesByFile.has(filePath)) {
          callSitesByFile.set(filePath, []);
        }
        callSitesByFile.get(filePath).push(site);
      }
      
      // Sort files
      const sortedFiles = Array.from(callSitesByFile.keys()).sort();
      
      for (const file of sortedFiles) {
        await this.core.summary
          .addHeading(`📄 ${file}`, 3);
        
        const sites = callSitesByFile.get(file);
        
        for (const site of sites) {
          await this.core.summary
            .addRaw(`• Line ${site.line}: calls ${site.vulnerableFunction}`);
          
          if (site.osv) {
            await this.core.summary
              .addRaw(' - ')
              .addLink(site.osv, `https://pkg.go.dev/vuln/${site.osv}`);
          }
          
          await this.core.summary.addEOL();
        }
        
        await this.core.summary.addEOL();
      }
    }
    
    // Add recommendations section
    await this.core.summary
      .addHeading('💡 Recommendations', 2)
      .addEOL();
    
    const recommendations = [];
    
    // Find modules that need updates
    for (const module of sortedModules) {
      const moduleVulns = vulnsByModule.get(module);
      const fixedVersions = moduleVulns
        .map(v => v.finding.fixed_version)
        .filter(v => v)
        .sort();
      
      if (fixedVersions.length > 0) {
        // Get the latest fixed version
        const latestFix = fixedVersions[fixedVersions.length - 1];
        recommendations.push(
          `Update ${module} to version ${latestFix} or later`
        );
      }
    }
    
    if (recommendations.length > 0) {
      await this.core.summary.addList(recommendations);
    } else {
      await this.core.summary.addRaw('No specific version recommendations available.');
    }
    
    await this.core.summary
      .addEOL()
      .addSeparator()
      .addEOL()
      .addRaw('🔗 Learn more about these vulnerabilities:')
      .addEOL()
      .addRaw('• ')
      .addLink('Go Vulnerability Database', 'https://pkg.go.dev/vuln/')
      .addEOL()
      .addRaw('• ')
      .addLink('Govulncheck Documentation', 'https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck')
      .addEOL();
    
    // Write the summary
    await this.core.summary.write();
  }
}

module.exports = SummaryGenerator;