x/vuln: govulncheck doesn't support loading vendored modules

[lachlan-smith]

Since the most recent update to govulncheck (v1.0.2) and the introduction of the LoadModules function (here), govulncheck can no longer run on projects that use private dependencies even when they are vendored locally unless the environment running govulncheck also has access to the private repositories.

We encountered this issue in our CI environment which does not have access to the private repositories and instead rely on the locally vendored dependencies.

The issue seems to be caused by calling go list with the -mod=mod flag, if this flag was omitted I believe it should instead first try using the vendored modules first.

[zpavlinovic]

@maceonthompson

[ffoebel]

Broke our CI as well and since the Github action doesn't support selecting the govulncheck version, the only workaround is to build an own action.

[zpavlinovic]

We are working on this and should have a fix soon.

[gopherbot]

Change https://go.dev/cl/557495 mentions this issue: internal/scan, vulncheck: use packages.load for mod info

[maceonthompson]

The fix for this has just been merged - would those not using the github action try to reproduce the issue after running go install golang.org/x/vuln/cmd/govulncheck@master?

[nathanmcgarvey-modopayments]

The fix for this has just been merged - would those not using the github action try to reproduce the issue after running go install golang.org/x/vuln/cmd/govulncheck@master?

LGTM.... doing a containerized build using golang:1.21 and go install golang.org/x/vuln/cmd/govulncheck@master && govulncheck ./... with at least one private vendor module that does not work with @latest.

[nathanmcgarvey-modopayments]

@maceonthompson or @zpavlinovic , is there a chance of tagging a 1.0.3 soon? Since most folks that have CI pipelines tagged at @latest will still be broken indefinitely, that'd be a big win for this an the related workspace issue.

[maceonthompson]

@nathanmcgarvey-modopayments We're working on tagging 1.0.3 with the relevant fixes right now, it will be released by EOD today/sometime tomorrow.

[zpavlinovic]

v1.0.3 tag is available now.