Jason Hall fe5af5345a Fix: Parser fails to detect vulnerabilities in multi-line JSON output ... ## Problem The govulncheck action was incorrectly reporting "no vulnerabilities found" even when vulnerabilities were present. This was happening because govulncheck outputs pretty-printed JSON (multi-line format) rather than JSON lines format. ## Root Cause The parser had a logic bug where it would set `parsedAsJsonLines = true` whenever it encountered ANY valid JSON line, including trivial ones like `{`. This prevented the multi-line JSON parser from ever running, causing all findings to be missed. ## Solution Changed the parser to only skip multi-line parsing if it actually found meaningful data (OSV details or findings) in JSON lines format. Now it correctly falls back to multi-line JSON parsing when needed. ## Additional Changes Updated the example workflow to fail if no vulnerabilities are detected, since we know the example code contains vulnerabilities. This serves as a regression test to ensure the parser continues to work correctly. ## Testing - Verified the parser now correctly identifies 8 vulnerabilities in the example code - The action now properly reports vulnerabilities instead of false negatives - CI checks are now working correctly - Example workflow now fails if the parser bug resurfaces This is a critical bug fix that prevents false "no vulnerabilities" reports. Signed-off-by: Jason Hall <jason@chainguard.dev>		2025-06-07 02:30:32 -04:00
..
annotator.js	Add vulnerable example and enhance action features	2025-06-07 00:58:11 -04:00
govulncheck.js	Fix parser to handle multi-line JSON format and add local testing	2025-06-07 00:14:39 -04:00
parser.js	Fix: Parser fails to detect vulnerabilities in multi-line JSON output	2025-06-07 02:30:32 -04:00
summary.js	Add vulnerable example and enhance action features	2025-06-07 00:58:11 -04:00