|
| 1 | +name: 'govulncheck' |
| 2 | +description: 'Differential govulncheck analysis — scans the current branch and optionally compares against a base branch, failing only on newly introduced vulnerabilities' |
| 3 | +inputs: |
| 4 | + govulncheck-version: |
| 5 | + description: 'Version of govulncheck to use' |
| 6 | + required: false |
| 7 | + default: 'v1.1.4' |
| 8 | + base-sha: |
| 9 | + description: >- |
| 10 | + Base branch SHA for differential comparison. Automatically detected on |
| 11 | + pull_request and merge_group events. When empty (e.g., on push), all |
| 12 | + findings are treated as new. Override to compare against a specific commit. |
| 13 | + required: false |
| 14 | + default: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }} |
| 15 | +outputs: |
| 16 | + new-count: |
| 17 | + description: 'Number of newly introduced vulnerabilities' |
| 18 | + value: ${{ steps.report.outputs.new-count }} |
| 19 | + has-new-vulns: |
| 20 | + description: 'Whether new vulnerabilities were found (true/false)' |
| 21 | + value: ${{ steps.report.outputs.has-new-vulns }} |
| 22 | +runs: |
| 23 | + using: "composite" |
| 24 | + steps: |
| 25 | + - name: Install govulncheck |
| 26 | + shell: bash |
| 27 | + env: |
| 28 | + GOVULNCHECK_VERSION: ${{ inputs.govulncheck-version }} |
| 29 | + # Override GOTOOLCHAIN so Go can fetch the toolchain govulncheck needs, |
| 30 | + # even if the project's go.mod pins an older Go version. |
| 31 | + GOTOOLCHAIN: auto |
| 32 | + run: go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" |
| 33 | + |
| 34 | + - name: Scan current branch |
| 35 | + shell: bash |
| 36 | + run: | |
| 37 | + set +e |
| 38 | + govulncheck -json ./... > "${RUNNER_TEMP}/pr-vulns.json" 2>"${RUNNER_TEMP}/pr-vulns.stderr" |
| 39 | + exit_code=$? |
| 40 | + set -e |
| 41 | + # Exit code 3 = vulnerabilities found (expected). Anything else is a real error. |
| 42 | + if [ "$exit_code" -ne 0 ] && [ "$exit_code" -ne 3 ]; then |
| 43 | + if [ -s "${RUNNER_TEMP}/pr-vulns.stderr" ]; then |
| 44 | + echo "::group::govulncheck stderr (current branch)" |
| 45 | + cat "${RUNNER_TEMP}/pr-vulns.stderr" |
| 46 | + echo "::endgroup::" |
| 47 | + fi |
| 48 | + exit "$exit_code" |
| 49 | + fi |
| 50 | +
|
| 51 | + - name: Scan base branch |
| 52 | + if: ${{ inputs.base-sha != '' }} |
| 53 | + shell: bash |
| 54 | + env: |
| 55 | + BASE_SHA: ${{ inputs.base-sha }} |
| 56 | + run: | |
| 57 | + # Best-effort: failure here should not block the report. |
| 58 | + # Composite actions don't support continue-on-error, so we handle it inline. |
| 59 | + HEAD_SHA=$(git rev-parse HEAD) |
| 60 | + # --force: the base branch checkout may leave go.mod/go.sum in a modified state. |
| 61 | + restore_head() { git checkout --force --quiet "$HEAD_SHA" 2>/dev/null || true; } |
| 62 | + trap restore_head EXIT |
| 63 | +
|
| 64 | + if git fetch --depth=1 origin "$BASE_SHA" && git checkout --quiet "$BASE_SHA"; then |
| 65 | + set +e |
| 66 | + govulncheck -json ./... > "${RUNNER_TEMP}/base-vulns.json" 2>"${RUNNER_TEMP}/base-vulns.stderr" |
| 67 | + scan_exit=$? |
| 68 | + set -e |
| 69 | + if [ "$scan_exit" -ne 0 ] && [ "$scan_exit" -ne 3 ] && [ -s "${RUNNER_TEMP}/base-vulns.stderr" ]; then |
| 70 | + echo "::group::govulncheck stderr (base branch)" |
| 71 | + cat "${RUNNER_TEMP}/base-vulns.stderr" |
| 72 | + echo "::endgroup::" |
| 73 | + fi |
| 74 | + else |
| 75 | + echo "::warning::Failed to checkout base branch — differential comparison will treat all findings as new" |
| 76 | + fi |
| 77 | +
|
| 78 | + # restore_head runs via the EXIT trap. Always exit 0 — this step is best-effort. |
| 79 | + exit 0 |
| 80 | +
|
| 81 | + - name: Compare and report |
| 82 | + id: report |
| 83 | + shell: bash |
| 84 | + run: | |
| 85 | + # Ensure base scan file exists even if the base scan step was skipped or failed. |
| 86 | + touch "${RUNNER_TEMP}/base-vulns.json" |
| 87 | + "$GITHUB_ACTION_PATH/scripts/govulncheck-report.sh" "${RUNNER_TEMP}/pr-vulns.json" "${RUNNER_TEMP}/base-vulns.json" |
0 commit comments