[seantronsen]

Description

Note

lint-makefile-common fails until v4.0 is released (see #11).

Testbed for OpenCHAMI/github-actions#53 (govulncheck findings uploaded as SARIF).

• govulncheck.yml: moves check to the #53 head and grants it security-events: write for the SARIF upload.
• README: adds a "Go vulnerabilities" testing note.

Expected:

1. Base commit: govulncheck passes and uploads its SARIF (category govulncheck). Any findings are stdlib notes for symbols the code doesn't call.
2. A follow-up commit adds github.com/dgrijalva/jwt-go v3.2.0+incompatible and calls MapClaims.VerifyAudience (GO-2020-0017) from an init in cmd/server/vulntest.go. The finding should show up in code scanning and on the PR, and govulncheck should fail on it.

Stacked on #15.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[seantronsen]

vulncheck confirmed. submitting faulty commit on purpose to test vulncheck sarif.

[github-actions]

Dependency Review

The following issues were found:

• ❌ 1 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Vulnerabilities

go.mod

Name	Version	Vulnerability	Severity
github.com/dgrijalva/jwt-go	3.2.0+incompatible	Authorization bypass in github.com/dgrijalva/jwt-go	high

Only included vulnerabilities with severity high or higher.

License Issues

.github/workflows/govulncheck.yml

Package	Version	License	Issue Type
OpenCHAMI/github-actions/.github/workflows/govulncheck.yml	9aa4f9e5a010d45cec4d108baacd1cdcb2aef40e	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
actions/OpenCHAMI/github-actions/.github/workflows/govulncheck.yml	9aa4f9e5a010d45cec4d108baacd1cdcb2aef40e	Unknown	Unknown
gomod/github.com/dgrijalva/jwt-go	3.2.0+incompatible	Unknown	Unknown

Scanned Files

• .github/workflows/govulncheck.yml
• go.mod