Documentation
¶
Overview ¶
vulncheck-gate decides whether a govulncheck run should fail the build.
It fails only on vulnerabilities that are both reachable from our code and have a published fix, because those are the only ones anyone can act on: the fix is a module bump. A reachable vulnerability with no fix available is reported prominently and allowed through. Blocking on it would wedge every branch in the repository for as long as upstream takes to publish a fix, which can be indefinitely, while changing nothing about our exposure.
That trade is deliberate and it has a cost: a serious vulnerability with no upstream fix will pass this gate every day without anyone being forced to look at it. The report exists so that "nobody was forced to" does not become "nobody knew". Acting on those means dropping or replacing the dependency, which is a judgment call this tool cannot make.
Input is the JSON stream from `govulncheck -format json`. That format is the documented programmatic interface; the human-readable output is not, and the previous incarnation of this gate parsed it and broke the first time the finding count changed.
Source Files