Make govulncheck run more reliable

Author: pjanotti

.github/workflows/scripts/govulncheck-sarif.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -euo pipefail
+
+mkdir -p ./govulncheck 2>/dev/null
+
+# Get all package directories
+ALL_PKG_DIRS=$(go list ./...)
+
+# Initialize failure flag
+FAILED=0
+
+# Repository prefix to remove from package names
+REPO_PREFIX=$(go list -m)
+
+# Run govulncheck for each package
+for pkg in $ALL_PKG_DIRS; do
+  OUTPUT_FILE="./govulncheck/$(echo "$pkg" | sed "s|^$REPO_PREFIX/||" | tr '/' '_').sarif"
+  echo -e "\nRunning govulncheck for package $pkg"
+  if ! govulncheck ${GOVULN_OPT:-} "$pkg" > "$OUTPUT_FILE"; then
+    echo "govulncheck failed for package $pkg, output saved to $OUTPUT_FILE"
+    FAILED=1
+  else
+    echo "govulncheck succeeded for package $pkg, output saved to $OUTPUT_FILE"
+  fi
+done
+
+if [ $FAILED -ne 0 ]; then
+  echo -e "\ngovulncheck failed for one or more packages"
+  exit 1
+fi
+
+echo -e "\ngovulncheck completed successfully for all packages"

.github/workflows/vuln-scans.yml

@@ -280,9 +280,10 @@ jobs:
           cache-dependency-path: '**/go.sum'
       - name: Install Tools
         run: make install-tools
-      - name: Run `govulncheck`
-        run: govulncheck -format sarif ./... > govulncheck.sarif
+      - name: Run `govulncheck` script
+        run: ./.github/workflows/scripts/govulncheck-sarif.sh
       - name: Upload result to GitHub Code Scanning
+        if: always()
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: govulncheck.sarif
+          sarif_file: ./govulncheck/

Makefile.Common

@@ -136,5 +136,13 @@ moddownload:
 	$(GOCMD) mod download
 
 .PHONY: govulncheck
-govulncheck: install-tools
-	govulncheck ./...
+govulncheck:
+	@FAILED=0; \
+	@for pkg in $(shell $(GOCMD) list $(ALL_PKG_DIRS)); do \
+		echo "\nRunning govulncheck for package $$pkg\n"; \
+		govulncheck $${GOVULN_OPT} $$pkg || FAILED=1; \
+	done; \
+	@if [ $$FAILED -ne 0 ]; then \
+		echo "\ngovulncheck failed for one or more packages"; \
+		exit 1; \
+	fi