Add govulncheck presubmit to expose go vulnerabilities in a PR

[ArkaSaha30]

This PR will add a govulncheck presubmit to check for go vulnerabilities when a PR is opened for go module changes. It will trigger the script from sig-security/sig-security-tooling/govulncheck/hack/govulncheck-presubmit.sh kubernetes/hack/verify-govulncheck.sh.

Fixes: kubernetes/sig-security#99
Parent Issue: kubernetes/sig-security#95

[rjsadow]

I don't see any issues with this @ArkaSaha30. Would you be able to run this on the EKS cluster instead of the default cluster like it's currently set up? You can use https://github.com/kubernetes/test-infra/pull/30556/files as a guide on what updates are needed.

[rjsadow]

/hold until kubernetes/sig-security#101 is merged

[rjsadow]

/retest

[PushkarJ]

/assign @liggitt @PushkarJ

[rjsadow]

Will this job just create the vulnerability artifact that can be reviewed for informational purposes, or is the intent to have some kind of gatekeeping element to fail if (for example) there are any CVEs found? If it's for gatekeeping, I'm not currently understanding how/where the job will fail out of the test.

[PushkarJ]

Will this job just create the vulnerability artifact that can be reviewed for informational purposes, or is the intent to have some kind of gatekeeping element to fail if (for example) there are any CVEs found? If it's for gatekeeping, I'm not currently understanding how/where the job will fail out of the test.

This will be mostly for informational purposes (atleast for now) since we want the job to not block a PR right now. This will allow us to observe and iterate over the accuracy of the scan results and then potentially in future act as gatekeeping for a PR if needed

[rjsadow]

Awesome, thank you @ArkaSaha30 and @PushkarJ
/lgtm

[ArkaSaha30]

Made a small change to the presubmit after testing locally:

-          cd sig-security-tooling/govulncheck/hack/ && ./govulncheck-presubmit.sh
+          cd ../kubernetes
+          ../sig-security/sig-security-tooling/govulncheck/hack/govulncheck-presubmit.sh

The govulncheck-presubmit.sh needs to be triggered from inside kubernetes directory.
Ref: kubernetes/sig-security#101 (comment)

[BenTheElder]

kubernetes/sig-security#101 (review)
/hold

[ArkaSaha30]

Pushing the changes as per discussion threads:

• Add govulncheck script to expose go vulnerabilities in a PR sig-security#101 (review)
• https://kubernetes.slack.com/archives/CHGFYJVAN/p1694040913317869

[rjsadow]

This is much more clean! Well done.
/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ArkaSaha30, rjsadow
Once this PR has been reviewed and has the lgtm label, please assign tallclair for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• config/jobs/kubernetes/sig-security/OWNERS
• config/testgrids/kubernetes/sig-security/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[rjsadow]

/hold for kubernetes/kubernetes#120562

[rjsadow]

@ArkaSaha30 @PushkarJ are we ok to close this based on kubernetes/kubernetes#120562 (comment) or do you see any other uses for having a separate job?

[liggitt]

The default verify script will make sure the PR doesn't make things worse, but I think we'd want a periodic job to check if existing state has issues, right?

[PushkarJ]

@liggitt yes we need the periodic one for sure. We are tracking it separately with this issue kubernetes/sig-security#100

[rjsadow]

I'm going to close this pr for now since kubernetes/kubernetes#120562 will add it to k/k presubmits and there's a separate issue tracking the periodic.

/close

[k8s-ci-robot]

@rjsadow: Closed this PR.

In response to this:

I'm going to close this pr for now since kubernetes/kubernetes#120562 will add it to k/k presubmits and there's a separate issue tracking the periodic.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.