ci: added new govulncheck workflow
#5964
Conversation
Signed-off-by: Dwi Siswanto <[email protected]>
Signed-off-by: Dwi Siswanto <[email protected]>
WalkthroughThe pull request introduces two key improvements to the repository's security and dependency management. A new Dependabot configuration is added to Changes
Assessment against linked issues
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/govulncheck.yaml (1)
18-26: Add quotes to prevent globbing and pin govulncheck version.Two suggestions to improve robustness:
- Add quotes around
$OUTPUTto handle paths with spaces- Consider pinning govulncheck to a specific version instead of @latest
- - run: go install golang.org/x/vuln/cmd/govulncheck@latest + - run: go install golang.org/x/vuln/cmd/[email protected] - - run: govulncheck -scan package -format sarif ./... > $OUTPUT + - run: govulncheck -scan package -format sarif ./... > "$OUTPUT"🧰 Tools
🪛 actionlint (1.7.4)
22-22: shellcheck reported issue in this script: SC2086:info:1:49: Double quote to prevent globbing and word splitting
(shellcheck)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/dependabot.yml(1 hunks).github/workflows/govulncheck.yaml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/govulncheck.yaml
22-22: shellcheck reported issue in this script: SC2086:info:1:49: Double quote to prevent globbing and word splitting
(shellcheck)
🔇 Additional comments (3)
.github/workflows/govulncheck.yaml (3)
1-7: LGTM! Well-configured workflow triggers.The workflow is appropriately scheduled for weekly security scans with manual trigger option.
8-15: LGTM! Security-conscious job configuration.Good security practices:
- Repository check prevents unintended execution in forks
- Minimal required permissions following principle of least privilege
16-17: LGTM! Clear environment configuration.Good practice using environment variable for the SARIF output path.
Signed-off-by: Dwi Siswanto <[email protected]>
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/dependabot.yml (1)
Line range hint
1-48: Consider adding inline documentation for the exclusion patterns.The configuration is well-structured, but it would be helpful to document why projectdiscovery dependencies are excluded from security updates. This helps future maintainers understand the reasoning behind this decision.
Add a comment above the security group:
groups: modules: patterns: ["github.com/projectdiscovery/*"] + # Exclude projectdiscovery dependencies from security updates as they are handled by the modules group security: applies-to: "security-updates" patterns: ["*"] exclude-patterns: ["github.com/projectdiscovery/*"]
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/dependabot.yml(1 hunks)
🔇 Additional comments (1)
.github/dependabot.yml (1)
14-17: LGTM! Well-structured security group configuration.The security group is properly configured to:
- Handle only security-related updates
- Cover all dependencies except projectdiscovery ones, which prevents conflicts with the modules group
Proposed changes
Close #5963
Checklist
Summary by CodeRabbit