readme update

This commit is contained in:
jake 2025-05-17 11:45:28 -04:00
parent 4d69a9a6f4
commit 4b6117b09c

View File

@ -1,13 +1,34 @@
# donotpassgo # donotpassgo
A composite workflow that runs security checks on Go projects. Golang must be installed before this workflow can run. A composite workflow that runs general code checks on Go projects, an optional <b>test</b> input is available to trigger unit tests. See [steps](#steps) for more information on the jobs run
## Usage
adding donotpassgo to workflows is simple, just add the following step to your yaml file:
```yaml
- name: "checkpoint"
uses: https://code.jakeyoungdev.com/actions/donotpassgo@main
```
donotpassgo has optional support for running unit tests, this can be added by setting the <b>test</b> flag to <b>standard</b>
```yaml
- name: "checkpoint"
uses: https://code.jakeyoungdev.com/actions/donotpassgo@main
with:
test: standard
```
running unit tests with ginkgo is also supported by setting the <b>test</b> flag to <b>ginkgo</b>
```yaml
- name: "checkpoint"
uses: https://code.jakeyoungdev.com/actions/donotpassgo@main
with:
test: ginkgo
```
## Steps ## Steps
### govulncheck donotpassgo runs several workflow jobs to ensure quality and secure go code, these steps may be updated as new tools develop.
govulncheck is installed using 'go install' and is used to scan the application dependencies and standard library. ### Dependency Scans
[govulncheck](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) is installed using golang and is used to scan for vulnerabilities in the project dependencies and standard library.
### gosec ### Static Code Analysis
gosec is used for static code analysis. [gosec](https://github.com/securego/gosec) inspects source code for security problems
### Unit Tests
## TODO donotpassgo supports two unit tests libraries: the standard go library and [ginkgo](https://github.com/onsi/ginkgo)
1. Add support for unit tests
2. Add ginkgo/gomega support