govulncheck-filter

Overview ¶

govulncheck-filter reads `govulncheck -format json ./...` output from stdin, compares findings against .govulncheck-allow.yml, and exits non-zero on any unallowlisted finding or any allowlisted entry past its expiry date.

Usage:

govulncheck -format json ./... | govulncheck-filter
govulncheck -format json ./... | govulncheck-filter -allow=path/to/allow.yml

Exit codes:

0 - no findings, or every finding has a non-expired allowlist entry
1 - one or more findings with no allowlist entry, or expired entry
2 - filter itself failed (bad input, missing allowlist, etc.)