From bc1eb17c2f6731aa982bf5583333e16b6bc3f39b Mon Sep 17 00:00:00 2001 From: casjay Date: Fri, 3 Jul 2026 11:14:46 -0400 Subject: [PATCH] =?UTF-8?q?=E2=9C=A8=20Add=20govulncheck=20to=20default=20?= =?UTF-8?q?go-workflow=20=E2=9C=A8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Scan Go dependencies against the vulnerability database automatically on every run, between vet and test. Fail fast on known CVEs before spending time running the full test suite. - rootfs/usr/local/bin/go-workflow: add govulncheck ./... as step 4; renumber build to step 6 - README.md: update default workflow diagram to include govulncheck README.md rootfs/usr/local/bin/go-workflow --- README.md | 2 +- rootfs/usr/local/bin/go-workflow | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index b9b706a..c9f8b36 100644 --- a/README.md +++ b/README.md @@ -25,7 +25,7 @@ Mount your project at `/app` and run with no arguments. The container automatically runs the full Go workflow: ``` -go mod tidy → gofmt -w . → go vet ./... → go test ./... → go build ./... +go mod tidy → gofmt -w . → go vet ./... → govulncheck ./... → go test ./... → go build ./... ``` ```shell diff --git a/rootfs/usr/local/bin/go-workflow b/rootfs/usr/local/bin/go-workflow index 21c1cd4..14e2c1c 100755 --- a/rootfs/usr/local/bin/go-workflow +++ b/rootfs/usr/local/bin/go-workflow @@ -61,9 +61,11 @@ run_step "go mod tidy" go mod tidy run_step "gofmt -w ." gofmt -w . # 3. Catch suspicious constructs run_step "go vet ./..." go vet ./... -# 4. Run tests — fail fast before wasting time on a build +# 4. Scan dependencies against the Go vulnerability database +run_step "govulncheck ./..." govulncheck ./... +# 5. Run tests — fail fast before wasting time on a build run_step "go test ./..." go test ./... -# 5. Build all main packages; output lands alongside source in each package dir +# 6. Build all main packages; output lands alongside source in each package dir run_step "go build ./..." go build "${BUILD_FLAGS[@]}" ./... echo "✅ Done."