fix(osvscanner): filter Grafana Go SDK dependencies

[alectimison-maker]

Summary

• filter OSV findings inherited from the selected grafana-plugin-sdk-go version
• preserve findings for direct plugin dependencies, unrelated indirect modules,
  and version mismatches
• fail open when the SDK module file cannot be fetched or parsed

Motivation

The JavaScript lockfile path already removes vulnerabilities inherited from
Grafana packages, but the Go path returned every OSV result unchanged. This can
block a plugin submission for a vulnerability in a module managed by the
Grafana Go SDK rather than by the plugin.

Closes #453.

Design

The filter parses the plugin's go.mod, resolves its selected
grafana-plugin-sdk-go version, and downloads only that version's bounded
go.mod from the Go module proxy. A finding is excluded only when:

• the plugin declares the vulnerable module as indirect;
• the SDK module file declares the same module; and
• the plugin, SDK, and OSV result versions match.

This is intentionally stricter than name-only filtering so a plugin's direct
dependency or independently upgraded version remains visible. Fetch, status,
size, version, and parse failures retain the original findings.

Testing

• go test ./pkg/analysis/passes/osvscanner/... — passed
• go vet ./pkg/analysis/passes/osvscanner/... — passed
• go build -o bin/darwin_arm64/plugincheck2 ./pkg/cmd/plugincheck2 — passed
• go test ./pkg/cmd/plugincheck2 -count=1 — passed
• go test ./pkg/... — passed

Compatibility and risks

JavaScript lockfile behavior and public APIs are unchanged. Go modules that do
not explicitly list transitive requirements keep their existing findings. The
new module-proxy request has a 10-second timeout and a 2 MiB response cap; if it
is unavailable, the validator reports all original vulnerabilities.

Scope

This change does not alter SDK version policy or general OSV allowlisting.

[github-actions]

Signed commits report

All 2 commits between main and fix/filter-grafana-sdk-go-vulnerabilities have verified signatures. ✅

[cla-assistant]

All committers have signed the CLA.

[Copilot]

Pull request overview

This PR brings the Go (go.mod) OSV-scanner path in line with the existing JavaScript lockfile behavior by filtering out vulnerability findings that are inherited from the selected grafana-plugin-sdk-go version, while preserving findings that are direct plugin dependencies or version mismatches. It does so by parsing the plugin’s go.mod, resolving the chosen SDK version (including replace), fetching the SDK’s go.mod from the Go module proxy, and excluding findings only when the vulnerable module is indirect in the plugin and matches versions across plugin/SDK/OSV.

Changes:

• Route go.mod scans through a new Go-specific filtering path (filterGoModResults).
• Implement SDK-aware filtering by downloading and parsing the selected grafana-plugin-sdk-go module file.
• Add unit tests for the Go module filtering and fail-open behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/analysis/passes/osvscanner/filter.go	Enables Go module filtering by delegating go.mod handling to the new Go-specific filter.
pkg/analysis/passes/osvscanner/filter-gomod.go	Adds the Go module filtering implementation, including SDK version resolution and module-proxy fetch/parsing.
pkg/analysis/passes/osvscanner/filter_test.go	Adds tests covering Go module filtering behavior and fail-open behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[alectimison-maker]

Fixed in c8028cb: filterGoModResults now only appends result entries that still have remaining findings, so a fully-filtered scan yields len(Results) == 0 and downstream (osvscanner.go:109) reports a clean pass.

[alectimison-maker]

Added TestFilterGoModPackagesAllFiltered (filter_test.go) which asserts filtered.Results is empty when every finding is SDK-owned, so the analyzer can report a clean pass. Verified with go test ./pkg/analysis/passes/osvscanner/....

[academo]

hi @alectimison-maker can you take a look at the failed build ?

[alectimison-maker]

Thanks for the ping @academo. The test-docker-build failure was not caused by this change: the PR was based on an older main whose Dockerfile pinned nodejs=24.17.0-r0, which the Alpine repository no longer provides (apk add ... unable to select packages). I have integrated the latest upstream main, which already fixed that pin to nodejs=~24, so the branch now contains only this change (3 files). CI on the updated head is currently awaiting approval to run (action_required).

I also addressed both Copilot review comments:

• filterGoModResults now drops result entries with no remaining findings, so a fully-filtered scan reports a clean pass downstream (len(Results) == 0).
• Added a regression test (TestFilterGoModPackagesAllFiltered) for the all-filtered case.

And all commits are now signed to satisfy the signed-commits check (which is green).