# Maintainer: kpcyrd <git@rxv.cc>
pkgname=osv-scanner
pkgver=1.9.1
pkgrel=5
pkgdesc="Vulnerability scanner written in Go which uses the data provided by https://osv.dev"
url="https://github.com/google/osv-scanner"
arch="all"
license="Apache-2.0"
makedepends="go"
checkdepends="tzdata"
# tests appears to be flaky? passes on local machines but fails on builder
options="net !check"
source="https://github.com/google/osv-scanner/archive/v$pkgver/osv-scanner-$pkgver.tar.gz"

export GOCACHE="${GOCACHE:-"$srcdir/go-cache"}"
export GOTMPDIR="${GOTMPDIR:-"$srcdir"}"
export GOMODCACHE="${GOMODCACHE:-"$srcdir/go"}"

prepare() {
	default_prepare

	# https://github.com/google/osv-scanner/issues/1137
	rm pkg/lockfile/apk-installed_test.go
}

build() {
	mkdir build
	go build -o build/ ./cmd/...
}

check() {
	# TestRun fails because more ghsa's were published since it was made
	# shellcheck disable=2046
	go test $(go list ./... | grep -v cmd/osv-scanner)
}

package() {
	install -Dm755 ./build/osv-scanner -t "$pkgdir"/usr/bin/
}

sha512sums="
8ac14cf200d1909e3a3db477a5b6a324d758853e6e473ef2acd64666d65b2314a2b343f3547117d81893fd26f020ccbf4857493a40d1df88c405a453f6e28bb9  osv-scanner-1.9.1.tar.gz
"
