Skip to content

Commit 3eff0a2

Browse files
jamietannajamietanna
committed
build: capture govulncheck results as Code Scanning alerts
Related to [0] and regular questions we've had in the past, we don't have a clear answer for "are we vulnerable to a CVE" in a way that our users are clearly able to determine, as well as "will oapi-codegen fix it". As a step towards answering the former, and leading towards the latter, we can start running `govulncheck` in CI as a way to ensure that we always have that information to hand. This will re-run on commits to HEAD, as well as on a schedule, to make sure we're aware of new CVEs. By producing this in SARIF format, we can then have this uploaded to GitHub's Code Scanning alerts, which are more straightforward to validate. The Code Scanning alerts page is gated to maintainers, but doesn't (currently) hide anything that can't be seen by someone running `govulncheck` themselves on the project. We also make sure to explicitly note what permissions are required to handle the workflow. [0]: oapi-codegen/governance#11
1 parent bdc4edc commit 3eff0a2

1 file changed

Lines changed: 35 additions & 0 deletions

File tree

‎.github/workflows/govulncheck.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Determine known CVEs through `govulncheck`
2+
on:
3+
push:
4+
branches:
5+
- main
6+
schedule:
7+
# Mondays at 0000
8+
- cron: "0 0 * * 1"
9+
jobs:
10+
check-for-vulnerabilities:
11+
name: Check for vulnerabilities using `govulncheck`
12+
runs-on: ubuntu-latest
13+
permissions:
14+
security-events: write
15+
contents: read
16+
steps:
17+
- uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
18+
with:
19+
# to be explicit, we're only checking the top-level `oapi-codegen` package
20+
# we are intentionally NOT intending to keep on top of security updates in `internal/test` or `examples`, or any submodules thereof
21+
go-package: ./...
22+
# NOTE that we want to produce the SARIF-formatted report, which can then be consumed by other tools ...
23+
output-format: sarif
24+
output-file: govulncheck.sarif
25+
26+
# ... such as the Code Scanning tab (https://github.com/oapi-codegen/oapi-codegen/security/code-scanning?query=is%3Aopen+branch%3Amain+tool%3Agovulncheck)
27+
- name: Upload SARIF file
28+
uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.2
29+
with:
30+
sarif_file: govulncheck.sarif
31+
category: govulncheck
32+
33+
- name: Print code scanning results URL
34+
run: |
35+
echo "Results: https://github.com/${{ github.repository }}/security/code-scanning?query=is%3Aopen+branch%3Amain+tool%3Agovulncheck"

0 commit comments

Comments
 (0)