constellation/bazel/ci/govulncheck.sh.in
Paul Meyer 6352d8005d bazel: use -C flag in govulncheck ci
Signed-off-by: Paul Meyer <49727155+katexochen@users.noreply.github.com>
2023-08-15 16:29:56 +02:00

51 lines
946 B
Bash

#!/usr/bin/env bash
###### script header ######
lib=$(realpath @@BASE_LIB@@) || exit 1
stat "${lib}" >> /dev/null || exit 1
# shellcheck source=../sh/lib.bash
if ! source "${lib}"; then
echo "Error: could not find import"
exit 1
fi
go=$(realpath @@GO@@)
stat "${go}" >> /dev/null
govulncheck=$(realpath @@GOVULNCHECK@@)
stat "${govulncheck}" >> /dev/null
cd "${BUILD_WORKSPACE_DIRECTORY}"
###### script body ######
submodules=$(${go} list -f '{{.Dir}}' -m)
PATH=$(dirname "${go}"):${PATH}
check() {
err=0
echo "Scanning Go vulnerability DB for knwon vulnerabilities in modules:"
for mod in ${submodules}; do
echo " ${mod}"
echo -n " "
CGO_ENABLED=0 ${govulncheck} -C "${mod}" "./..." |
tail -n 2 | # Providing some nice output...
tr '\n' ' ' |
sed s/" your code and"// &&
printf "\n" ||
err=$?
done
exit "${err}"
}
if test -v SILENT; then
check > /dev/null
else
check
fi