From 33dbd99524dd7088e0d19dcef5fb428186f3cf51 Mon Sep 17 00:00:00 2001
From: Michele Baldessari <michele@acksyn.org>
Date: Thu, 4 Sep 2025 08:09:46 +0200
Subject: [PATCH] Add a govulnscan Makefile target

---
 .gitignore |  4 ++++
 Makefile   | 13 +++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/.gitignore b/.gitignore
index 6aa89ba34..106800dd3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,7 @@
 /config/samples/pattern-catalog-*.yaml
 **/apikey.txt
 /coverage.html
+
+# Govulncheck stuff
+govulncheck.results
+/database
diff --git a/Makefile b/Makefile
index 2818c140e..0705a4a39 100644
--- a/Makefile
+++ b/Makefile
@@ -193,6 +193,9 @@ KUSTOMIZE_VERSION ?= v5.3.0
 CONTROLLER_TOOLS_VERSION ?= v0.16.4
 ENVTEST_VERSION ?= release-0.19
 GOLANGCI_LINT_VERSION ?= v2.0.2
+GOVULNCHECK_VERSION ?= v1.1.4
+# parameters to pass to govulnscan
+GOVULNCHECK_OPTS ?=
 # update for major version updates to YQ_VERSION!
 YQ_API_VERSION = v4
 YQ_VERSION = v4.41.1
@@ -202,6 +205,7 @@ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen-$(CONTROLLER_TOOLS_VERSION)
 ENVTEST ?= $(LOCALBIN)/setup-envtest-$(ENVTEST_VERSION)
 GOLANGCI_LINT = $(LOCALBIN)/golangci-lint-$(GOLANGCI_LINT_VERSION)
 YQ = $(LOCALBIN)/yq-$(YQ_VERSION)
+GOVULNCHECK ?= $(LOCALBIN)/govulncheck-$(GOVULNCHECK_VERSION)
 
 ## Tool Versions
 OPERATOR_SDK_VERSION ?= v1.37.0
@@ -232,6 +236,15 @@ $(KUSTOMIZE): $(LOCALBIN)
 envtest: ## Download envtest-setup locally if necessary.
 	$(call go-install-tool,$(ENVTEST),sigs.k8s.io/controller-runtime/tools/setup-envtest,$(ENVTEST_VERSION))
 
+.PHONY: govulncheck
+govulncheck: $(GOVULNCHECK) ## Download govulncheck
+$(GOVULNCHECK): $(LOCALBIN)
+	$(call go-install-tool,$(GOVULNCHECK),golang.org/x/vuln/cmd/govulncheck,$(GOVULNCHECK_VERSION))
+
+.PHONY: govulnscan
+govulnscan: govulncheck
+	$(GOVULNCHECK) $(GOVULNCHECK_OPTS) ./... 2>&1 | tee govulncheck.results
+
 # go-get-tool will 'go get' any package $2 and install it to $1.
 PROJECT_DIR := $(shell dirname $(abspath $(lastword $(MAKEFILE_LIST))))
 # go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist