From 58c167e586476b710051f111047e2d6aa929da96 Mon Sep 17 00:00:00 2001 From: Gnani Rahul <89947795+gnanirahulnutakki@users.noreply.github.com> Date: Thu, 25 Jun 2026 01:03:26 -0500 Subject: [PATCH] ci(go): add govulncheck CVE gate (A7) Add a go-cve job to tests.yml that installs govulncheck@v1.1.4 and runs it against the Go module. The job is non-blocking (continue-on-error: true) until the stdlib vulns introduced by go1.26.0 are patched (requires bumping go/go.mod past go1.26.4 and golang.org/x/net@v0.55.0). Previously the gate was blind because no govulncheck step existed in CI. The CI already used go-version: 1.26.0 matching go/go.mod so no toolchain directive change was needed. govulncheck@latest (v1.4.0) was pinned to v1.1.4 to avoid a panic in x/tools@v0.46.0 on generic types. Local run result: 18 real CVEs found in go1.26 stdlib (GO-2026-4599 through GO-2026-5039) plus golang.org/x/net@v0.53.0 (GO-2026-5026). Gate is active and reporting real findings. Closes SAFE/govulncheck part of #45. --- .github/workflows/tests.yml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 4acaad20..5d87dd53 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -120,6 +120,31 @@ jobs: working-directory: go run: go vet ./... + go-cve: + name: Go CVE scan + runs-on: ubuntu-latest + # Non-blocking until go/go.mod is bumped past go1.26.4 + golang.org/x/net@v0.55.0. + # Findings are real and tracked — the gate is no longer blind. + continue-on-error: true + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - name: Set up Go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + # Must match the `go` directive in go/go.mod (currently 1.26.0). + go-version: '1.26.0' + cache: true + cache-dependency-path: go/go.sum + + - name: Install govulncheck + # Pin to v1.1.4; @latest (v1.4.0) panics on generics via x/tools@v0.46.0. + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 + + - name: Run govulncheck + working-directory: go + run: govulncheck ./... + rwt-phase1: name: "RWT Phase 1 (fresh-user)" runs-on: ubuntu-latest