Documentation
¶
Overview ¶
Package vulncheck runs govulncheck for CI and normalizes its SARIF report so GitHub code scanning accepts it. It backs the `go tool mage ci:vulncheck` target used by .github/workflows/codeql.yml.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DedupeStacks ¶
DedupeStacks copies a SARIF report from r to w, removing exact duplicate objects from every result's `stacks` array. The scanner can emit identical stacks, but the SARIF schema requires the entries to be unique, so GitHub rejects the upload otherwise.
Only complete duplicates are removed: the first occurrence of each stack keeps its position, frame order and metadata, and findings, distinct stacks and all other properties pass through unchanged. Objects are compared independently of key order. Absent, null or non-array `stacks` values, and absent or null `runs`/`results`, are left as they are.
Malformed or empty input is an error, so a broken scan can never be replaced by an empty report.
func Scan ¶
Scan runs `govulncheck -format sarif` and writes the normalized report to params.Output. The tool must be on PATH. A failed scan, or output that is not a valid SARIF report, fails the scan and leaves any existing report untouched, so vulnerabilities can never be hidden by an empty upload.
Types ¶
type Params ¶
type Params struct {
// Output is the SARIF file to write. It is replaced only after the scan
// succeeds and the report has been normalized.
Output string
// Packages are the package patterns to scan. It defaults to ./...
Packages []string
// Stderr receives govulncheck's diagnostics. It defaults to os.Stderr.
Stderr io.Writer
}
Params configures Scan.
Source Files