98 lines
2.6 KiB
Bash
Executable File
98 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Security Scan Go Vulnerability - Execution Script
|
|
#
|
|
# This script wraps the Go vulnerability checker (govulncheck) to detect
|
|
# known vulnerabilities in Go code and dependencies.
|
|
|
|
set -euo pipefail
|
|
|
|
# Source helper scripts
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
SKILLS_SCRIPTS_DIR="$(cd "${SCRIPT_DIR}/../scripts" && pwd)"
|
|
|
|
# shellcheck source=../scripts/_logging_helpers.sh
|
|
source "${SKILLS_SCRIPTS_DIR}/_logging_helpers.sh"
|
|
# shellcheck source=../scripts/_error_handling_helpers.sh
|
|
source "${SKILLS_SCRIPTS_DIR}/_error_handling_helpers.sh"
|
|
# shellcheck source=../scripts/_environment_helpers.sh
|
|
source "${SKILLS_SCRIPTS_DIR}/_environment_helpers.sh"
|
|
|
|
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
|
|
|
|
# Validate environment
|
|
log_step "ENVIRONMENT" "Validating prerequisites"
|
|
validate_go_environment "1.23" || error_exit "Go 1.23+ is required"
|
|
|
|
# Set defaults
|
|
set_default_env "GOVULNCHECK_FORMAT" "text"
|
|
|
|
# Parse arguments
|
|
FORMAT="${1:-${GOVULNCHECK_FORMAT}}"
|
|
MODE="${2:-source}"
|
|
|
|
# Validate format
|
|
case "${FORMAT}" in
|
|
text|json|sarif)
|
|
;;
|
|
*)
|
|
log_error "Invalid format: ${FORMAT}. Must be one of: text, json, sarif"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# Validate mode
|
|
case "${MODE}" in
|
|
source|binary)
|
|
;;
|
|
*)
|
|
log_error "Invalid mode: ${MODE}. Must be one of: source, binary"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
# Change to backend directory
|
|
cd "${PROJECT_ROOT}/backend"
|
|
|
|
# Check for go.mod
|
|
if [[ ! -f "go.mod" ]]; then
|
|
log_error "go.mod not found in backend directory"
|
|
exit 1
|
|
fi
|
|
|
|
# Execute govulncheck
|
|
log_step "SCANNING" "Running Go vulnerability check"
|
|
log_info "Format: ${FORMAT}"
|
|
log_info "Mode: ${MODE}"
|
|
log_info "Working directory: $(pwd)"
|
|
|
|
# Build govulncheck command
|
|
GOVULNCHECK_CMD="go run golang.org/x/vuln/cmd/govulncheck@latest"
|
|
|
|
# Add format flag if not text (text is default)
|
|
if [[ "${FORMAT}" != "text" ]]; then
|
|
GOVULNCHECK_CMD="${GOVULNCHECK_CMD} -format=${FORMAT}"
|
|
fi
|
|
|
|
# Add mode flag if not source (source is default)
|
|
if [[ "${MODE}" != "source" ]]; then
|
|
GOVULNCHECK_CMD="${GOVULNCHECK_CMD} -mode=${MODE}"
|
|
fi
|
|
|
|
# Add target (all packages)
|
|
GOVULNCHECK_CMD="${GOVULNCHECK_CMD} ./..."
|
|
|
|
# Execute the scan
|
|
if eval "${GOVULNCHECK_CMD}"; then
|
|
log_success "No vulnerabilities found"
|
|
exit 0
|
|
else
|
|
exit_code=$?
|
|
if [[ ${exit_code} -eq 3 ]]; then
|
|
log_error "Vulnerabilities detected (exit code 3)"
|
|
log_info "Review the output above for details and remediation advice"
|
|
else
|
|
log_error "Vulnerability scan failed with exit code: ${exit_code}"
|
|
fi
|
|
exit "${exit_code}"
|
|
fi
|