onflow / atree

Atree provides scalable arrays and scalable ordered maps.
https://onflow.org
Apache License 2.0
39 stars 16 forks source link

Add CI to check for vulnerabilities affecting Go code #293

Closed fxamacker closed 8 months ago

fxamacker commented 1 year ago

Issue To Be Solved

We should automatically check for vulnerabilities that affect Go code.

Suggested Solution

Add GitHub Actions workflow to use govulncheck.

According to govulncheck docs:

Govulncheck reports known vulnerabilities that affect Go code. It uses static analysis of source code or a binary's symbol table to narrow down reports to only those that could affect the application.

By default, govulncheck makes requests to the Go vulnerability database at https://vuln.go.dev. Requests to the vulnerability database contain only module paths, not code or other properties of your program.

More info at:

fxamacker commented 8 months ago

Closing this for reasons mentioned in feedback to PR #294.