Documentation
¶
Overview ¶
govulncheck-filter turns `govulncheck -format json` output into a blocking CI gate with an auditable allowlist. It is invoked by hack/govulncheck.sh, never directly.
Two things it does that plain `govulncheck ./...` cannot:
Reports only findings govulncheck traced to a *called* symbol. The JSON stream carries one finding per reachability level for the same OSV: module-only ("this version is in your module graph"), package-level ("something imports it"), and symbol-level ("this function is reachable in the call graph"). Only the last is a vulnerability in this binary; the first two are inventory. `govulncheck ./...` in text mode already applies that rule, but exits 3 either way, so CI cannot tell the two apart. Here, a finding counts only when trace[0] names a function.
Drops OSV IDs listed in the allowlist (hack/govulncheck-allow.yaml), which is how the residue with no upstream fix stays off the red list without silencing everything else. govulncheck has no native suppression.
Exits 1 when anything survives both filters. A stale allowlist entry - an ID whose module is still in the scanned build but which no longer produces any finding - is a warning only, never a failure: an allowlist that fails closed on its own success would make dependency upgrades punish the upgrader.
Usage:
govulncheck -format json ./... | go run ./hack/govulncheck \ -allowlist hack/govulncheck-allow.yaml -label ./providers/edges
Source Files