diff --git a/README.md b/README.md index 12c490c..c4f70d8 100644 --- a/README.md +++ b/README.md @@ -1,13 +1,34 @@ # donotpassgo -A composite workflow that runs security checks on Go projects. Golang must be installed before this workflow can run. +A composite workflow that runs general code checks on Go projects, an optional test input is available to trigger unit tests. See [steps](#steps) for more information on the jobs run + +## Usage +adding donotpassgo to workflows is simple, just add the following step to your yaml file: +```yaml +- name: "checkpoint" + uses: https://code.jakeyoungdev.com/actions/donotpassgo@main +``` + +donotpassgo has optional support for running unit tests, this can be added by setting the test flag to standard +```yaml +- name: "checkpoint" + uses: https://code.jakeyoungdev.com/actions/donotpassgo@main + with: + test: standard +``` + +running unit tests with ginkgo is also supported by setting the test flag to ginkgo +```yaml +- name: "checkpoint" + uses: https://code.jakeyoungdev.com/actions/donotpassgo@main + with: + test: ginkgo +``` ## Steps -### govulncheck -govulncheck is installed using 'go install' and is used to scan the application dependencies and standard library. - -### gosec -gosec is used for static code analysis. - -## TODO -1. Add support for unit tests -2. Add ginkgo/gomega support \ No newline at end of file +donotpassgo runs several workflow jobs to ensure quality and secure go code, these steps may be updated as new tools develop. +### Dependency Scans +[govulncheck](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) is installed using golang and is used to scan for vulnerabilities in the project dependencies and standard library. +### Static Code Analysis +[gosec](https://github.com/securego/gosec) inspects source code for security problems +### Unit Tests +donotpassgo supports two unit tests libraries: the standard go library and [ginkgo](https://github.com/onsi/ginkgo) \ No newline at end of file