GitHub action for govulncheck

Clone this repo:

Branches

Tags

  1. 87b6cbd README.md: update content by Julie Qiu · 14 days ago master v0.1.0
  2. e03a9cb README.md: wrap text by Julie Qiu · 14 days ago
  3. 714f1ec govulncheck-action: rename to golang-govulncheck-action by Julie Qiu · 14 days ago
  4. 36fe93a govulncheck-action: Adding the initial version of the govulncheck github action & README by Brandon Kessler · 3 weeks ago
  5. a197ae3 initial commit by Carlos Amedee · 4 weeks ago

GitHub Action for govulncheck

This repository holds the GitHub Action for govulncheck.

Govulncheck provides a low-noise, reliable way for Go users to learn about known vulnerabilities that may affect their dependencies. See details on Go's support for vulnerability management.

The govulncheck GitHub Action is currently experimental and is under active development.

Using the govulncheck GitHub Action

To use the govulncheck GitHub Action add the following step to your workflow:

- id: govulncheck
  uses: golang/govulncheck-action@v0.1.0

By default the govulncheck Github Action will run with the latest version of Go and analyze all packages in the provided Go module. Assuming you have the latest Go version installed locally, this is equivalent to running the following on your command line:

$ govulncheck ./...

To specify a specific Go version or package pattern, use the following syntax:

- id: govulncheck
  uses: golang/govulncheck-action@v0.1.0
  with:
     go-version-input: <your-Go-version>
     go-package: <your-package-pattern>

For example, the code snippet below can be used to run govulncheck against a repository on every push:

on: [push]

jobs:
  govulncheck_job:
    runs-on: ubuntu-latest
    name: Run govulncheck
    steps:
      - id: govulncheck
        uses: golang/govulncheck-action@v0.1.0
        with:
           go-version-input: 1.20.4
           go-package: ./...

When a vulnerability is found, an error will be displayed for that GitHub job with information about the vulnerability and how to fix it. For example:

image

Contributing

Our canonical Git repository is located at https://go.googlesource.com/govulncheck-action. There is a mirror of the repository at https://github.com/golang/govulncheck-action. See https://go.dev/doc/contribute.html for details on how to contribute.

Feedback

The main issue tracker for the time repository is located at

If you want to report a bug or have a feature suggestion, please file an issue at https://github.com/golang/go/issues, prefixed with govulncheck-action: in the title.

License

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.