35 lines
1.0 KiB
YAML
35 lines
1.0 KiB
YAML
name: Supply-Chain-Scan (Go)
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- "**/*.go"
|
|
- "go.mod"
|
|
- "go.sum"
|
|
pull_request: {}
|
|
|
|
jobs:
|
|
govulncheck:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: "1.22"
|
|
- name: govulncheck installieren
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
- name: Go-Module auf bekannte Schwachstellen pruefen
|
|
shell: bash
|
|
run: |
|
|
# pipefail ist Pflicht: sonst liefert "govulncheck | tee" den Exit-Code
|
|
# von tee (immer 0) statt den von govulncheck zurueck — der Gate-Zweck
|
|
# (Akzeptanzkriterium 3: Fund blockiert den Merge) waere sonst wirkungslos.
|
|
set -o pipefail
|
|
govulncheck ./... | tee govulncheck-report.txt
|
|
- name: Scan-Bericht als Artefakt ablegen
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: govulncheck-report
|
|
path: govulncheck-report.txt
|