[seantronsen]

Description

govulncheck now writes its findings as SARIF and uploads them to GitHub Advanced Security, like trivy-image-scan, scorecard, zizmor (lint-ci) and lint-docs already do. Findings appear as code scanning alerts in the Security tab, and as annotations on PRs where they land on changed lines.

• govulncheck.yml: output-format: sarif, plus an upload-sarif step (category govulncheck) and security-events: write. SARIF mode exits 0 on findings, so a jq step after the upload fails the job on called vulnerabilities (SARIF level error), as text mode did before.
• Docs: the caller example grants contents: read and security-events: write.

Stacked on #52.

Breaking changes

• Callers must grant security-events: write to the govulncheck job, or the run fails to start.

Caveats

• On pull_request runs from forks, the token is read-only and the SARIF upload fails. trivy-image-scan has the same gap.

Testing

Testbed: OpenCHAMI/github-actions-testbed#16 (a follow-up commit there calls a known-vulnerable symbol).

Locally: govulncheck v1.9.0 -format sarif in a golang:1.26 container. On a module that calls a vulnerable symbol it exits 0 and reports the finding at level error, and the jq check fails; on a clean module it reports only stdlib note findings, and the check passes. Text mode exits non-zero and zero on the same two modules. The workflow itself has not run on GitHub yet: still to check are the action's output-format/output-file inputs, the upload, and the PR display.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[seantronsen]

failed experiment. I would prefer if the behavior for this was more like lint-docs. I'll have to revisit it on Monday.

[seantronsen]

do not delete this branch or the PR. just closing for now to lessen noise.

[synackd]

Thanks for removing the public issue and report artifact. One disclosure path remains: this step writes vulnerability IDs, descriptions, and exact call-site links to the workflow run summary on every run, including default-branch scans. Readers of a public repository can view that summary, while the default-branch code scanning alert details require write access. Could the default-branch summary be generic, with the detailed findings kept in code scanning? PR summaries and inline annotations are public too. If that is the intended tradeoff for PR feedback, we'll need to document it explicitly.