I wanted to add Govulncheck to our security scanning and have the vulnerabilities output to the scan results, but they are not showing up as expected. I am running this within Github and came across no errors when CodeQL was running.
When running the scan locally, I get 4 vulnerabilities. I.e
Scanning for dependencies with known vulnerabilities...
Found 4 known vulnerabilities.
Vulnerability #1: GO-2022-0524
Calling Reader.Read on an archive containing a large number of
concatenated 0-length compressed files can cause a panic due to
stack exhaustion.
Call stacks in your code:
pkg/keycloak/client.go:263:30: github.com/aaa-ncnu/mem-join-service/pkg/keycloak.Client.VerifyToken calls io/ioutil.ReadAll, which eventually calls compress/gzip.Reader.Read
Found in: compress/[email protected]
Fixed in: compress/[email protected]
More info: https://pkg.go.dev/vuln/GO-2022-0524
But when the scan finishes, it doesn't report on these vulnerabilties.
I have added the following to the bottom of my codeql config
- name: Golang Vulncheck
uses: Templum/[email protected]
The task finishes successfully with the following:
Running govulncheck for package ./... in dir /github/workspace
Successfully parsed report
Converted Report to Sarif format
Preparing Report for commit b31c5397a6c5ba55f1c7159679c3cdc130090077 on ref refs/pull/78/merge
Successfully uploaded Report to Github it received ID 15d3a094-32ca-11ed-80[22](https://github.com/aaa-ncnu/mem-join-service/actions/runs/3039702339/jobs/4894928655#step:7:23)-63891b3c3dea
Successfully processed uploaded vulncheck report to Github
And the report is blank, I would expect that 4 vulnerabilities show up right?
![Screen Shot 2022-09-12 at 11 55 40 AM](https://user-images.githubusercontent.com/35661365/189733778-f02c2fbb-ddd3-4851-8f4c-bc2598c3e2e2.png)
Also I checked and verified this is the same output that github's api has as well:
{
"processing_status": "complete",
"errors": null,
"analyses_url": "https://api.github.com/repos/x/y/code-scanning/analyses?sarif_id=15d3a094-32ca-11ed-8022-63891b3c3dea"
}