mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-03-15 03:26:45 -04:00
ci: ignore GO-2024-3166 in govulncheck (#3404)
* ci: ignore GO-2024-3166 in govulncheck
This commit is contained in:
parent
1561d67a12
commit
60dcac1f1b
@ -4,6 +4,7 @@ bazel_dep(name = "aspect_bazel_lib", version = "2.9.0")
|
||||
|
||||
bazel_lib = use_extension("@aspect_bazel_lib//lib:extensions.bzl", "toolchains")
|
||||
bazel_lib.yq()
|
||||
use_repo(bazel_lib, "jq_toolchains")
|
||||
use_repo(bazel_lib, "yq_toolchains")
|
||||
|
||||
bazel_dep(name = "bazel_skylib", version = "1.7.1")
|
||||
|
@ -288,11 +288,13 @@ sh_template(
|
||||
name = "govulncheck",
|
||||
data = [
|
||||
":go_bin_for_host",
|
||||
"@jq_toolchains//:resolved_toolchain",
|
||||
"@org_golang_x_vuln//cmd/govulncheck",
|
||||
],
|
||||
substitutions = {
|
||||
"@@GO@@": "$(rootpath :go_bin_for_host)",
|
||||
"@@GOVULNCHECK@@": "$(rootpath @org_golang_x_vuln//cmd/govulncheck:govulncheck)",
|
||||
"@@JQ@@": "$(rootpath @jq_toolchains//:resolved_toolchain)",
|
||||
},
|
||||
template = "govulncheck.sh.in",
|
||||
)
|
||||
|
@ -15,6 +15,8 @@ go=$(realpath @@GO@@)
|
||||
stat "${go}" >> /dev/null
|
||||
govulncheck=$(realpath @@GOVULNCHECK@@)
|
||||
stat "${govulncheck}" >> /dev/null
|
||||
jq=$(realpath @@JQ@@)
|
||||
stat "${jq}" >> /dev/null
|
||||
|
||||
cd "${BUILD_WORKSPACE_DIRECTORY}"
|
||||
|
||||
@ -24,6 +26,18 @@ submodules=$(${go} list -f '{{.Dir}}' -m)
|
||||
|
||||
PATH=$(dirname "${go}"):${PATH}
|
||||
|
||||
check_module() {
|
||||
# shellcheck disable=SC2016 # The $ sign in the single quoted string is correct.
|
||||
CGO_ENABLED=0 ${govulncheck} -C "$1" -format json "./..." |
|
||||
"${jq}" -sr '
|
||||
(map(select(.osv) | {"key": .osv.id, "value": .osv.summary}) | from_entries) as $osvs |
|
||||
map(select( .finding and .finding.osv != "GO-2024-3166" ) | .finding | select( .trace[-1].module | startswith("github.com/edgelesssys/") )) |
|
||||
group_by(.osv) |
|
||||
map( {"osv": .[0].osv, "summary": $osvs[.[0].osv], "traces": [.[] | [.trace[] | .module]]} ) |
|
||||
if length > 0 then halt_error(1) else .[] end'
|
||||
|
||||
}
|
||||
|
||||
check() {
|
||||
err=0
|
||||
|
||||
@ -31,7 +45,7 @@ check() {
|
||||
for mod in ${submodules}; do
|
||||
echo " ${mod}"
|
||||
echo -n " "
|
||||
CGO_ENABLED=0 ${govulncheck} -C "${mod}" "./..." || err=$?
|
||||
check_module "${mod}"
|
||||
done
|
||||
|
||||
exit "${err}"
|
||||
|
Loading…
x
Reference in New Issue
Block a user