Add Govulncheck as a new securityTest

fguisso commented 2 years ago

Motivation

Golang Security team has developed a new tool to detect vulnerable packages in Golang code and it will be a great addition to huskyCI analysis.

We have all the necessary code to run this scan!

A working container of Govulncheck that outputs a JSON after running the analysis in a particular folder. Similar to this to be uploaded to Docker Hub as huskyci/govulncheck:latest.
Add into config.yaml commands needed to run inside the securityTest container.
Adjust context.go to have the new Govulncheck securityTest configs.
Add new error messages related to Govulncheck in messagecodes.go.
Add a new file into securitytest package and adjust its logic to now handle Govulncheck output.
Add new code into client analysis package to print to STDOUT Govulncheck results.

Search how a particular securityTest work and apply the same logic (Ctrl + F + "bandit" will do 🙃).

vitorduarte commented 2 years ago

config.yaml file doesn't seem to be available

fguisso commented 1 year ago

We are testing a more complete solution for SCA, probably we will drop this issue beside the implement anti on of osvscanner + cdxgen