govulncheck审计与阻断治理（Go-评分-策略）最佳实践

实现示例type Finding = { module: string; vulnID: string; score: number }

type Policy = { block: number; warn: number }

function valid(vulnID: string): boolean { return /^GO-\d{4}-\d{4}$/.test(vulnID) || /^CVE-\d{4}-\d{4,}$/.test(vulnID) }

function decide(f: Finding, p: Policy): 'block' | 'warn' | 'pass' {

if (!valid(f.vulnID)) return 'block'

if (f.score >= p.block) return 'block'

if (f.score >= p.warn) return 'warn'

return 'pass'

}

function evaluate(list: Finding[], p: Policy): { blocked: Finding[]; warned: Finding[]; passed: Finding[] } {

const blocked: Finding[] = []

const warned: Finding[] = []

const passed: Finding[] = []

for (const f of list) {

const d = decide(f, p)

if (d === 'block') blocked.push(f)

else if (d === 'warn') warned.push(f)

else passed.push(f)

}

return { blocked, warned, passed }

}

审计与CI门禁阻断项直接失败；审计包含模块、漏洞ID与评分。策略变更需审批与归档。