Documentation
¶
Overview ¶
vulncheck-gate decides whether a govulncheck run should fail the build.
It fails only on vulnerabilities that are both reachable from our code and have a final-release fix, because those are the only ones anyone can act on with a production module bump. A reachable vulnerability with no final fix is reported prominently and allowed through. Prereleases and Go pseudo-versions are reported as such rather than forcing unstable dependency versions into the build.
That trade is deliberate and it has a cost: a serious vulnerability with no final-release fix will pass this gate every day without anyone being forced to look at it. The report exists so that "nobody was forced to" does not become "nobody knew". Adopting an unstable fix, replacing the dependency, or waiting for a final release is a judgment call this tool cannot make.
Input is the JSON stream from `govulncheck -format json`. That format is the documented programmatic interface; the human-readable output is not, and the previous incarnation of this gate parsed it and broke the first time the finding count changed.
Source Files