Script to run govulncheck and cross-reference github security advisories and display in table

gistfile1.txt

#!/bin/bash

set -o pipefail

TEMP_JSON=$(mktemp)

govulncheck -format json ./... > "$TEMP_JSON"

PARSED_DATA=$(jq -r '.osv.aliases[] | select(startswith("GHSA-"))' "$TEMP_JSON" 2>/dev/null | sort -u)

rm -f "$TEMP_JSON"

if [ -z "$PARSED_DATA" ]; then
    echo "✅ No vulnerabilities detected by govulncheck."
    exit 0
fi

print_formatted_row() {
  printf "| %-10s | %-50s | %-40s | %-50s | %-20s | %s\n" "$@"
}

query_gh() {

    local ghsa="$1"

    local gh_resp=$(gh api "advisories/$ghsa")

    local api_sev
    api_sev=$(echo "$gh_resp" | jq -r '.severity')

    pkg_name=$(echo "$gh_resp" | jq -r '.vulnerabilities[0].package.name ')
    patch_ver=$(echo "$gh_resp" | jq -r '.vulnerabilities[0].first_patched_version')
    cve_id=$(echo "$gh_resp" | jq -r '.cve_id')

    local ghsa_col=$([[ -n "$ghsa" ]] && echo "https://github.com/advisories/$ghsa")
    print_formatted_row "$api_sev" "$pkg_name" " Req[$patch_ver] " " $ghsa_col " " $cve_id "
}

print_formatted_row " Sev " " Package " " Req Version " " GHSA Link " " CVE "
print_formatted_row " :--- " " :--- " " :--- " " :--- " " :--- "

for ghsa in $PARSED_DATA; do
    query_gh "$ghsa"
done