[seantronsen]

Description

govulncheck now writes its findings as SARIF and uploads them to GitHub Advanced Security, like trivy-image-scan, scorecard, zizmor (lint-ci) and lint-docs already do. Findings appear as code scanning alerts in the Security tab, and as annotations on PRs where they land on changed lines.

• govulncheck.yml: output-format: sarif, plus an upload-sarif step (category govulncheck) and security-events: write. SARIF mode exits 0 on findings, so a jq step after the upload fails the job on called vulnerabilities (SARIF level error), as text mode did before.
• Docs: the caller example grants contents: read and security-events: write.

Stacked on #52.

Breaking changes

• Callers must grant security-events: write to the govulncheck job, or the run fails to start.

Caveats

• On pull_request runs from forks, the token is read-only and the SARIF upload fails. trivy-image-scan has the same gap.

Testing

Testbed: OpenCHAMI/github-actions-testbed#16 (a follow-up commit there calls a known-vulnerable symbol).

Locally: govulncheck v1.9.0 -format sarif in a golang:1.26 container. On a module that calls a vulnerable symbol it exits 0 and reports the finding at level error, and the jq check fails; on a clean module it reports only stdlib note findings, and the check passes. Text mode exits non-zero and zero on the same two modules. The workflow itself has not run on GitHub yet: still to check are the action's output-format/output-file inputs, the upload, and the PR display.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.

[seantronsen]

failed experiment. I would prefer if the behavior for this was more like lint-docs. I'll have to revisit it on Monday.

[seantronsen]

do not delete this branch or the PR. just closing for now to lessen noise.