From ffae7d6686d6b1a0ef6ab0c2c71eb857496962cd Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Wed, 22 Apr 2026 16:00:29 +0200 Subject: [PATCH 1/8] ci(govulncheck): use official golang/govulncheck-action for SARIF analysis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace manual go install + govulncheck -format sarif with the official Go Security Team action. The action handles Go setup internally and always installs the latest govulncheck. Pin to upstream master (commit 31f7c546, 2026-02-26) rather than v1.0.4. The v1.0.4 release references its transitive actions (actions/checkout, actions/setup-go) by tag, which fails enterprise repos that enforce full SHA pinning for all workflow dependencies. Master fixed this in 31f7c546 by pinning actions/checkout@de0fac2e (v6.0.2) and actions/setup-go@7a3fe6cf (v6.2.0) to full commit SHAs. Upstream has not yet tagged a v1.0.5 release containing this fix — revisit to pin to a stable release tag once available. Ref: https://github.com/golang/govulncheck-action Ref: https://github.com/golang/govulncheck-action/commit/31f7c5463448f83528bd771c2d978d940080c9fd Signed-off-by: Kemal Akkoyun --- .github/workflows/govulncheck.yml | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 1641d42856b..d315ac8e8ae 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -40,8 +40,8 @@ permissions: jobs: # Non-blocking: generates SARIF and uploads to GitHub Code Scanning. # Replaces Dependabot Security Alerts with reachability-aware findings. - # Uses govulncheck@latest installed directly (golang/govulncheck-action is - # not in the DataDog enterprise action allowlist). + # Uses the official golang/govulncheck-action — see PR description for + # the enterprise allowlist request context. # NOTE: Only core packages are scanned here. Contrib modules (each with # their own go.mod) are scanned in govulncheck-tests, which blocks merges, # but contrib vulnerabilities do not appear in GitHub Code Scanning alerts. @@ -52,20 +52,16 @@ jobs: with: ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.ref }} persist-credentials: false - - name: Setup Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 - with: - go-version: stable - cache-dependency-path: '**/go.sum' - - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@latest - - name: Run govulncheck (SARIF) + - name: Run govulncheck + # golang/govulncheck-action is the official Go Security Team action. + # It handles Go setup internally and always uses the latest govulncheck. # -format sarif exits 0 even when vulnerabilities are found, so the # upload step always runs. The blocking check is in govulncheck-tests. - run: |- - govulncheck -format sarif \ - ./ddtrace/... ./appsec/... ./profiler/... ./internal/... ./instrumentation/... \ - > govulncheck.sarif || true + uses: golang/govulncheck-action@31f7c5463448f83528bd771c2d978d940080c9fd # master @ 2026-02-26 + with: + output-format: sarif + output-file: govulncheck.sarif + go-version-input: stable - name: Upload SARIF to GitHub Code Scanning if: always() uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1 From ee7994b6003c04ea98d855ac78c0154a56f463c5 Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Thu, 26 Mar 2026 11:21:58 +0100 Subject: [PATCH 2/8] ci(govulncheck): extend SARIF upload to cover contrib modules Add govulncheck-contribs-analysis job that scans each contrib module (each with its own go.mod) with govulncheck in SARIF format, merges the per-module results into a single SARIF file via jq, and uploads it to GitHub Code Scanning under a distinct 'govulncheck-contribs' category. This resolves the gap where contrib vulnerabilities were caught by the blocking govulncheck-tests job but never appeared in the Security tab. Both core and contrib findings are now visible in GitHub Code Scanning. The new govulncheck-contribs-sarif.sh mirrors the logic of the existing govulncheck-contribs-v2.sh but uses -format sarif and merges outputs. Signed-off-by: Kemal Akkoyun --- .../apps/govulncheck-contribs-sarif.sh | 45 +++++++++++++++++++ .github/workflows/govulncheck.yml | 36 +++++++++++++-- 2 files changed, 78 insertions(+), 3 deletions(-) create mode 100755 .github/workflows/apps/govulncheck-contribs-sarif.sh diff --git a/.github/workflows/apps/govulncheck-contribs-sarif.sh b/.github/workflows/apps/govulncheck-contribs-sarif.sh new file mode 100755 index 00000000000..dce2f49d03e --- /dev/null +++ b/.github/workflows/apps/govulncheck-contribs-sarif.sh @@ -0,0 +1,45 @@ +#!/bin/bash +set -euo pipefail + +# Scans each contrib module with govulncheck in SARIF format and merges the +# results into a single SARIF file for upload to GitHub Code Scanning. +# +# Usage: govulncheck-contribs-sarif.sh [output-file] +# output-file Path for the merged SARIF output (default: govulncheck-contribs.sarif) +# +# Requires: govulncheck, jq + +OUTPUT="${1:-govulncheck-contribs.sarif}" +SARIF_DIR=$(mktemp -d) +trap 'rm -rf "$SARIF_DIR"' EXIT + +count=0 +find ./contrib -mindepth 2 -type f -name go.mod -exec dirname {} \; | while read -r dir; do + echo "Scanning $dir" + # govulncheck requires at least one .go file in the target directory; + # fall back to the first subdirectory when the module root has none. + go_files=$(find "$dir" -maxdepth 1 -type f -name '*.go' | wc -l) + [[ $go_files -eq 0 ]] && dir=$(realpath "$(ls -d "$dir"/*/ | head -1)") + + safe_name=$(printf '%s' "$dir" | tr '/' '_' | sed 's/^_//') + # -format sarif exits 0 even when vulnerabilities are found. + govulncheck -format sarif -C "$dir" . >"$SARIF_DIR/${safe_name}.sarif" + count=$((count + 1)) +done + +sarif_files=("$SARIF_DIR"/*.sarif) +if [[ ! -e "${sarif_files[0]}" ]]; then + echo "No contrib modules found; skipping SARIF merge." + exit 0 +fi + +# Merge all per-module SARIF runs into one file. +# All runs share the same govulncheck schema version, so the first file's +# version and $schema fields are representative for the merged output. +jq -s '{ + "version": .[0].version, + "$schema": (.[0]."$schema" // ""), + "runs": [.[].runs[]] +}' "$SARIF_DIR"/*.sarif >"$OUTPUT" + +echo "Merged $(echo "$SARIF_DIR"/*.sarif | wc -w) SARIF files into $OUTPUT" diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index d315ac8e8ae..fd62a19eb36 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -9,6 +9,7 @@ on: - "go.work.sum" - ".github/workflows/govulncheck.yml" - ".github/workflows/apps/govulncheck-contribs-v2.sh" + - ".github/workflows/apps/govulncheck-contribs-sarif.sh" workflow_call: # allows to reuse this workflow inputs: ref: @@ -42,9 +43,9 @@ jobs: # Replaces Dependabot Security Alerts with reachability-aware findings. # Uses the official golang/govulncheck-action — see PR description for # the enterprise allowlist request context. - # NOTE: Only core packages are scanned here. Contrib modules (each with - # their own go.mod) are scanned in govulncheck-tests, which blocks merges, - # but contrib vulnerabilities do not appear in GitHub Code Scanning alerts. + # NOTE: Only core packages are scanned here. Contrib modules are scanned + # separately in govulncheck-contribs-analysis (SARIF, non-blocking) and + # in govulncheck-tests (blocking, sandboxed). govulncheck-analysis: runs-on: ubuntu-latest steps: @@ -69,6 +70,35 @@ jobs: sarif_file: govulncheck.sarif category: govulncheck + # Non-blocking: scans all contrib modules for vulnerabilities and uploads + # the merged SARIF to GitHub Code Scanning for Security tab visibility. + # Contrib vulns are also caught by govulncheck-tests (blocking, sandboxed). + govulncheck-contribs-analysis: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + ref: ${{ inputs.ref || github.event.pull_request.head.sha || github.ref }} + persist-credentials: false + - name: Setup Go + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + with: + go-version: stable + cache-dependency-path: '**/go.sum' + - name: Run govulncheck on contrib modules (SARIF) + # Installs govulncheck and runs govulncheck-contribs-sarif.sh, which + # scans each contrib module and merges results into one SARIF file. + # -format sarif exits 0 even when vulnerabilities are found. + run: | + go install golang.org/x/vuln/cmd/govulncheck@latest + ./.github/workflows/apps/govulncheck-contribs-sarif.sh govulncheck-contribs.sarif + - name: Upload contrib SARIF to GitHub Code Scanning + if: always() + uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1 + with: + sarif_file: govulncheck-contribs.sarif + category: govulncheck-contribs + # Blocking: fails the build if any reachable vulnerability is found. # Scans both core packages and all contrib modules (each with its own go.mod). govulncheck-tests: From f1d8ab71cbed38bbcb93c8a43206b7ca6d405543 Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Thu, 23 Apr 2026 10:12:55 +0200 Subject: [PATCH 3/8] fix(ci): use go.work as module source in govulncheck contrib scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace the find-based module discovery in govulncheck-contribs-sarif.sh and govulncheck-contribs-v2.sh with a grep over go.work. The find command (-mindepth 2, no -maxdepth) was picking up nested test-only go.mod files such as: contrib/aws/datadog-lambda-go/test/integration_tests/error/go.mod These directories are not workspace members and not scannable as standalone modules — govulncheck exits 1 with: "main module does not contain package ..." go.work is the authoritative list of workspace modules and naturally excludes nested test dirs. govulncheck-contribs-v2.sh had the same latent bug but swallowed it silently (no set -e); govulncheck-contribs-sarif.sh surfaced it because it uses set -euo pipefail. Signed-off-by: Kemal Akkoyun --- .github/workflows/apps/govulncheck-contribs-sarif.sh | 5 ++++- .github/workflows/apps/govulncheck-contribs-v2.sh | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/apps/govulncheck-contribs-sarif.sh b/.github/workflows/apps/govulncheck-contribs-sarif.sh index dce2f49d03e..e2065de0e2c 100755 --- a/.github/workflows/apps/govulncheck-contribs-sarif.sh +++ b/.github/workflows/apps/govulncheck-contribs-sarif.sh @@ -14,7 +14,10 @@ SARIF_DIR=$(mktemp -d) trap 'rm -rf "$SARIF_DIR"' EXIT count=0 -find ./contrib -mindepth 2 -type f -name go.mod -exec dirname {} \; | while read -r dir; do +# Use go.work as the authoritative module list — avoids picking up nested +# test-only go.mod files (e.g. contrib/aws/datadog-lambda-go/test/...) that +# are not workspace members and cause govulncheck package-load errors. +grep -E '^\s+\./contrib/' go.work | awk '{print $1}' | while read -r dir; do echo "Scanning $dir" # govulncheck requires at least one .go file in the target directory; # fall back to the first subdirectory when the module root has none. diff --git a/.github/workflows/apps/govulncheck-contribs-v2.sh b/.github/workflows/apps/govulncheck-contribs-v2.sh index fa5c2e03f22..803969529d2 100755 --- a/.github/workflows/apps/govulncheck-contribs-v2.sh +++ b/.github/workflows/apps/govulncheck-contribs-v2.sh @@ -1,6 +1,7 @@ #!/bin/bash -find ./contrib -mindepth 2 -type f -name go.mod -exec dirname {} \; | while read dir ; do +# Use go.work as the authoritative module list — avoids nested test go.mod files. +grep -E '^\s+\./contrib/' go.work | awk '{print $1}' | while read -r dir; do echo "Checking $dir" # govulncheck doesn't support modules with only a go.mod in the root go_files=$(find $dir -maxdepth 1 -type f -name '*.go' | wc -l) From 76535e312217cc4316a7b09575a3f9d20726907c Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Thu, 23 Apr 2026 10:33:12 +0200 Subject: [PATCH 4/8] fix(ci): merge govulncheck-contribs SARIF into a single run MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeQL upload-sarif rejects files containing multiple runs under the same category since July 2025 (see GitHub changelog 2025-07-21). The previous jq expression used '[.[].runs[]]' which produced N runs (one per contrib module). Replace with a single run whose results array is the union of all per-module results: runs[0].tool — shared govulncheck tool descriptor (same across all) results[]? — all findings merged; '?' handles modules with no findings govulncheck emits URI-based physicalLocation (not index-based), so merging results across runs requires no artifact re-indexing. Signed-off-by: Kemal Akkoyun --- .../workflows/apps/govulncheck-contribs-sarif.sh | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/.github/workflows/apps/govulncheck-contribs-sarif.sh b/.github/workflows/apps/govulncheck-contribs-sarif.sh index e2065de0e2c..44ae63c1a4e 100755 --- a/.github/workflows/apps/govulncheck-contribs-sarif.sh +++ b/.github/workflows/apps/govulncheck-contribs-sarif.sh @@ -36,13 +36,18 @@ if [[ ! -e "${sarif_files[0]}" ]]; then exit 0 fi -# Merge all per-module SARIF runs into one file. -# All runs share the same govulncheck schema version, so the first file's -# version and $schema fields are representative for the merged output. +# Merge all per-module SARIF files into one file with a single run. +# CodeQL upload-sarif rejects files with multiple runs under the same category +# (https://github.blog/changelog/2025-07-21-code-scanning-will-stop-combining-multiple-sarif-runs-uploaded-in-the-same-sarif-file/). +# govulncheck uses URI-based artifact locations (not index-based), so merging +# results across runs is safe — no artifact re-indexing required. jq -s '{ "version": .[0].version, "$schema": (.[0]."$schema" // ""), - "runs": [.[].runs[]] + "runs": [{ + "tool": .[0].runs[0].tool, + "results": [.[].runs[].results[]?] + }] }' "$SARIF_DIR"/*.sarif >"$OUTPUT" echo "Merged $(echo "$SARIF_DIR"/*.sarif | wc -w) SARIF files into $OUTPUT" From 52e6b9c825480e701cf8df1576873260c2ecb082 Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Thu, 23 Apr 2026 10:38:53 +0200 Subject: [PATCH 5/8] fix(ci): address govulncheck-action review comments - Add repo-checkout: false to golang/govulncheck-action to prevent the action from re-checking out the repo with default credentials/ref, which would diverge from inputs.ref on workflow_call. - Rewrite SARIF URIs to be repo-root-relative before merging: capture module_dir before fallback dir rewrite, prefix each %SRCROOT%-relative URI with the module path, and drop uriBaseId so Code Scanning annotations resolve to the correct files in the merged single-run output. Signed-off-by: Kemal Akkoyun --- .../apps/govulncheck-contribs-sarif.sh | 21 ++++++++++++++++++- .github/workflows/govulncheck.yml | 5 +++++ 2 files changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/apps/govulncheck-contribs-sarif.sh b/.github/workflows/apps/govulncheck-contribs-sarif.sh index 44ae63c1a4e..4c1647994b8 100755 --- a/.github/workflows/apps/govulncheck-contribs-sarif.sh +++ b/.github/workflows/apps/govulncheck-contribs-sarif.sh @@ -19,14 +19,33 @@ count=0 # are not workspace members and cause govulncheck package-load errors. grep -E '^\s+\./contrib/' go.work | awk '{print $1}' | while read -r dir; do echo "Scanning $dir" + # Capture the module path (repo-root-relative) before any fallback rewrites + # $dir — used as the URI prefix when rewriting SARIF paths below. + module_dir="${dir#./}" # strip leading "./" → "contrib/aws/aws-sdk-go" + # govulncheck requires at least one .go file in the target directory; # fall back to the first subdirectory when the module root has none. go_files=$(find "$dir" -maxdepth 1 -type f -name '*.go' | wc -l) [[ $go_files -eq 0 ]] && dir=$(realpath "$(ls -d "$dir"/*/ | head -1)") - safe_name=$(printf '%s' "$dir" | tr '/' '_' | sed 's/^_//') + safe_name=$(printf '%s' "$module_dir" | tr '/' '_') # -format sarif exits 0 even when vulnerabilities are found. govulncheck -format sarif -C "$dir" . >"$SARIF_DIR/${safe_name}.sarif" + + # Rewrite URIs to be repo-root-relative so Code Scanning annotations resolve + # correctly. govulncheck emits paths relative to the module dir with + # uriBaseId="%SRCROOT%". Prefix each with the module dir and drop uriBaseId + # so the merged single-run file has unambiguous repo-root-relative paths. + jq --arg prefix "${module_dir}/" ' + walk( + if type == "object" and (.uriBaseId? == "%SRCROOT%") and has("uri") + then .uri = ($prefix + .uri) | del(.uriBaseId) + else . + end + ) + ' "$SARIF_DIR/${safe_name}.sarif" >"$SARIF_DIR/${safe_name}.tmp" + mv "$SARIF_DIR/${safe_name}.tmp" "$SARIF_DIR/${safe_name}.sarif" + count=$((count + 1)) done diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index fd62a19eb36..c6586251510 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -63,6 +63,11 @@ jobs: output-format: sarif output-file: govulncheck.sarif go-version-input: stable + # Disable the action's implicit checkout — we already checked out the + # correct ref above with persist-credentials: false. Without this, the + # action re-runs actions/checkout with default credentials and the + # event ref, which can diverge from inputs.ref on workflow_call. + repo-checkout: false - name: Upload SARIF to GitHub Code Scanning if: always() uses: github/codeql-action/upload-sarif@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1 From 2aeaf4bf7c065d1f3a939822734022dd57282b57 Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Thu, 23 Apr 2026 11:58:30 +0200 Subject: [PATCH 6/8] fix(ci): merge tool.driver.rules from all contrib SARIF runs Each per-module govulncheck SARIF file only carries the rules referenced by its own results. The previous merge kept only .[0].runs[0].tool, dropping rule descriptors (title, help text) for vulnerabilities found exclusively in modules scanned after the first. Collect rules from all runs and deduplicate by id so every ruleId referenced in the merged results has a corresponding descriptor in tool.driver.rules. Signed-off-by: Kemal Akkoyun --- .../apps/govulncheck-contribs-sarif.sh | 26 +++++++++++++------ 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/.github/workflows/apps/govulncheck-contribs-sarif.sh b/.github/workflows/apps/govulncheck-contribs-sarif.sh index 4c1647994b8..d6f6f873e53 100755 --- a/.github/workflows/apps/govulncheck-contribs-sarif.sh +++ b/.github/workflows/apps/govulncheck-contribs-sarif.sh @@ -60,13 +60,23 @@ fi # (https://github.blog/changelog/2025-07-21-code-scanning-will-stop-combining-multiple-sarif-runs-uploaded-in-the-same-sarif-file/). # govulncheck uses URI-based artifact locations (not index-based), so merging # results across runs is safe — no artifact re-indexing required. -jq -s '{ - "version": .[0].version, - "$schema": (.[0]."$schema" // ""), - "runs": [{ - "tool": .[0].runs[0].tool, - "results": [.[].runs[].results[]?] - }] -}' "$SARIF_DIR"/*.sarif >"$OUTPUT" +# +# tool.driver.rules is merged and deduplicated across all runs: each run only +# carries the rules referenced by its own results, so a naïve first-wins merge +# would lose rule descriptors (title, help) for vulns found in later modules. +jq -s ' + . as $all | + { + "version": .[0].version, + "$schema": (.[0]."$schema" // ""), + "runs": [{ + "tool": ( + .[0].runs[0].tool | + .driver.rules = ([$all[].runs[].tool.driver.rules[]?] | unique_by(.id)) + ), + "results": [$all[].runs[].results[]?] + }] + } +' "$SARIF_DIR"/*.sarif >"$OUTPUT" echo "Merged $(echo "$SARIF_DIR"/*.sarif | wc -w) SARIF files into $OUTPUT" From 6a13d901dc8a1fa232d955928df29c146bbc082e Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Mon, 27 Apr 2026 17:53:56 +0200 Subject: [PATCH 7/8] ci(govulncheck): upload OpenVEX artifact Generate an OpenVEX govulncheck report for the core scan, patch the default author and product values, and publish the result as a workflow artifact for security review. --- .github/workflows/govulncheck.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index c6586251510..82323e245df 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -74,6 +74,31 @@ jobs: with: sarif_file: govulncheck.sarif category: govulncheck + - name: Run govulncheck (OpenVEX) + if: always() + run: |- + govulncheck -format openvex \ + ./ddtrace/... ./appsec/... ./profiler/... ./internal/... ./instrumentation/... \ + > govulncheck-raw.vex || true + - name: Patch OpenVEX author and product + if: always() && hashFiles('govulncheck-raw.vex') != '' + run: |- + MODULE_PATH=$(go list -m -f '{{ .Path }}' github.com/DataDog/dd-trace-go/v2) + PRODUCT="pkg:golang/${MODULE_PATH}" + if [[ "${GITHUB_REF_TYPE:-}" == "tag" && -n "${GITHUB_REF_NAME:-}" ]]; then + PRODUCT="${PRODUCT}@${GITHUB_REF_NAME}" + fi + jq --arg author "security@datadoghq.com" \ + --arg product "${PRODUCT}" \ + '.author = $author | (.statements[]?.products[]?["@id"]) = $product' \ + govulncheck-raw.vex > govulncheck.vex + - name: Upload OpenVEX artifact + if: always() + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: govulncheck-openvex + path: govulncheck.vex + if-no-files-found: warn # Non-blocking: scans all contrib modules for vulnerabilities and uploads # the merged SARIF to GitHub Code Scanning for Security tab visibility. From 65c5f236806046924166231e0cae4a424fda64b5 Mon Sep 17 00:00:00 2001 From: Kemal Akkoyun Date: Mon, 27 Apr 2026 18:10:37 +0200 Subject: [PATCH 8/8] ci(govulncheck): version OpenVEX product Resolve the checked-out module through go list at HEAD so the OpenVEX product PURL contains either the release tag or Go pseudo-version for the scanned commit. --- .github/workflows/govulncheck.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 82323e245df..45c3faa9c85 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -84,10 +84,9 @@ jobs: if: always() && hashFiles('govulncheck-raw.vex') != '' run: |- MODULE_PATH=$(go list -m -f '{{ .Path }}' github.com/DataDog/dd-trace-go/v2) - PRODUCT="pkg:golang/${MODULE_PATH}" - if [[ "${GITHUB_REF_TYPE:-}" == "tag" && -n "${GITHUB_REF_NAME:-}" ]]; then - PRODUCT="${PRODUCT}@${GITHUB_REF_NAME}" - fi + COMMIT=$(git rev-parse HEAD) + VERSION=$(GOPROXY=direct GONOSUMDB="${MODULE_PATH}" go list -m -json "${MODULE_PATH}@${COMMIT}" | jq -r .Version) + PRODUCT="pkg:golang/${MODULE_PATH}@${VERSION}" jq --arg author "security@datadoghq.com" \ --arg product "${PRODUCT}" \ '.author = $author | (.statements[]?.products[]?["@id"]) = $product' \