From 9aa4f9e5a010d45cec4d108baacd1cdcb2aef40e Mon Sep 17 00:00:00 2001
From: Sean Tronsen <sean.tronsen@gmail.com>
Date: Thu, 22 Oct 2026 08:27:14 -0600
Subject: [PATCH] feat: enhance govulncheck workflow with SARIF output

Signed-off-by: Sean Tronsen <sean.tronsen@gmail.com>
---
 .github/workflows/govulncheck.yml | 17 ++++++++++++++++-
 docs/workflows.md                 |  3 +++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 865f4ef..7feb361 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -5,7 +5,8 @@ name: govulncheck
 
 # Reusable workflow that runs the Go team's vulnerability scanner against
 # the caller's module. Detects known CVEs in the import graph (including
-# transitive deps) and reports them as workflow annotations.
+# transitive deps), uploads them to GitHub Advanced Security as SARIF, and
+# fails the job when a vulnerable symbol is called.
 #
 # Pair with the actionlint/zizmor lint workflow for a "static security
 # baseline" wave; pair with dependency-review for PR-time gating.
@@ -31,6 +32,7 @@ on:
 
 permissions:
   contents: read   # baseline for checkout
+  security-events: write  # for SARIF upload to GHAS
 
 jobs:
   govulncheck:
@@ -44,3 +46,16 @@ jobs:
           go-version-file: ${{ inputs.go-version == '' && 'go.mod' || '' }}
           go-version-input: ${{ inputs.go-version }}
           go-package: ${{ inputs.go-package }}
+          output-format: sarif
+          output-file: govulncheck.sarif
+
+      - name: Upload SARIF to GHAS
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          sarif_file: govulncheck.sarif
+          category: govulncheck
+
+      # SARIF mode exits 0 on findings; fail on called vulnerabilities (level
+      # "error") like the default text mode does.
+      - name: Fail on called vulnerabilities
+        run: jq -e '[.runs[].results[]? | select(.level == "error")] | length == 0' govulncheck.sarif
diff --git a/docs/workflows.md b/docs/workflows.md
index 9bacec3..f1b55a0 100644
--- a/docs/workflows.md
+++ b/docs/workflows.md
@@ -355,6 +355,9 @@ on:
 jobs:
   govulncheck:
     uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@v4.0
+    permissions:
+      contents: read
+      security-events: write  # SARIF upload to GHAS
     # Optional overrides:
     # with:
     #   go-version: 1.26.7  # default: read from go.mod