x/vulndb/cmd/vulnreport: include a link to the release for GHSA reports

golang / go

The Go programming language

https://go.dev

BSD 3-Clause "New" or "Revised" License

123.54k stars 17.6k forks source link

x/vulndb/cmd/vulnreport: include a link to the release for GHSA reports #54901

Open julieqiu opened 2 years ago

julieqiu commented 2 years ago

For example, for https://github.com/golang/vulndb/issues/829, there was no commit link in the GHSA. It would be helpful to include this link in the issue for triaging:

https://github.com/crypto-org-chain/cronos/releases/tag/v0.8.0

neild commented 2 years ago

Is there a simple, reliable way to map from a module name and version to a useful link?

We could perhaps say that if the module name begins with github.com, we link to https://${MODULE}/releases/tag/${VERSION}, but does that link reliably exist? And in the example here, does the page https://github.com/crypto-org-chain/cronos/releases/tag/v0.8.0 really contain that much useful information?