From 5c3e644ec1bfe9c04bb890d8e12afbbbf057543a Mon Sep 17 00:00:00 2001 From: QuentinBisson Date: Sat, 20 Jun 2026 14:43:21 +0200 Subject: [PATCH 1/2] Add vulnerability-check reusable workflow Runs nancy sleuth against the Go module graph so the scan can gate the merge queue (on: pull_request + merge_group) instead of every CircleCI build. Authenticates via NANCY_USER/NANCY_TOKEN with an optional OSSI_OSSINDEXURL, and exits 0 on scanner outage. --- .github/workflows/vulnerability-check.yaml | 65 ++++++++++++++++++++++ CHANGELOG.md | 6 ++ 2 files changed, 71 insertions(+) create mode 100644 .github/workflows/vulnerability-check.yaml diff --git a/.github/workflows/vulnerability-check.yaml b/.github/workflows/vulnerability-check.yaml new file mode 100644 index 0000000..b86dc9f --- /dev/null +++ b/.github/workflows/vulnerability-check.yaml @@ -0,0 +1,65 @@ +name: Vulnerability check + +on: + workflow_call: + secrets: + NANCY_USER: + description: User to authenticate against the OSS Index database. + required: true + NANCY_TOKEN: + description: Token to authenticate against the OSS Index database. + required: true + OSSI_OSSINDEXURL: + description: Custom OSS Index / Sonatype endpoint URL. Defaults to the public OSS Index when unset. + required: false + +permissions: {} + +jobs: + nancy: + runs-on: ubuntu-24.04 + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Set up Go + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version-file: go.mod + + - name: Install nancy + env: + NANCY_VERSION: v2.1.0 + run: | + curl -sSL -o /usr/local/bin/nancy \ + "https://github.com/sonatype-nexus-community/nancy/releases/download/${NANCY_VERSION}/nancy-${NANCY_VERSION}-linux-amd64" + chmod +x /usr/local/bin/nancy + + - name: Check for vulnerable dependencies + env: + CGO_ENABLED: "0" + OSSI_USERNAME: ${{ secrets.NANCY_USER }} + OSSI_TOKEN: ${{ secrets.NANCY_TOKEN }} + OSSI_OSSINDEXURL: ${{ secrets.OSSI_OSSINDEXURL }} + run: | + set +e + go list -json -m all \ + | nancy sleuth --skip-update-check \ + --quiet --exclude-vulnerability-file ./.nancy-ignore \ + --additional-exclude-vulnerability-files ./.nancy-ignore.generated 2>&1 \ + | tee ./nancy-results.txt ; nancy_result=${PIPESTATUS[1]} + grep -qF \ + -e 'error accessing OSS Index' \ + -e 'Error: guide API request failed' \ + nancy-results.txt; grep_result=$? + set -e + # A scanner outage must not block the merge queue: skip only when nancy failed AND the output shows an upstream error. + if [[ $nancy_result -ne 0 && $grep_result -eq 0 ]]; then + echo "Ignoring failed scan due to a problem with the external scanner." + exit 0 + fi + exit $nancy_result diff --git a/CHANGELOG.md b/CHANGELOG.md index b18b56c..677bbe6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), however this project does not use Semantic Versioning and there are no releases. Instead this file uses a date-based structure. +## 2026-06-20 + +### Added + +- `vulnerability-check.yaml` reusable workflow: runs `nancy sleuth` against the Go module graph (`go list -json -m all`) to flag dependencies with known vulnerabilities, honouring `.nancy-ignore` and `.nancy-ignore.generated`. Call it on `pull_request` and `merge_group` to gate the merge queue. Authenticates to OSS Index via the `NANCY_USER`/`NANCY_TOKEN` secrets and accepts an optional `OSSI_OSSINDEXURL` for a custom endpoint. A scanner outage exits `0` so it does not block merges. + ## 2026-06-18 ### Fixed From c9ae66296fe3a1337a319c306c709f2171bf02cd Mon Sep 17 00:00:00 2001 From: QuentinBisson Date: Sat, 20 Jun 2026 14:56:04 +0200 Subject: [PATCH 2/2] vulnerability-check: require OSSI_OSSINDEXURL for endpoint parity The scan must hit the same OSS Index/Sonatype endpoint as the CircleCI scan, so make the URL a required secret rather than defaulting to the public OSS Index. --- .github/workflows/vulnerability-check.yaml | 4 ++-- CHANGELOG.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/vulnerability-check.yaml b/.github/workflows/vulnerability-check.yaml index b86dc9f..24b1780 100644 --- a/.github/workflows/vulnerability-check.yaml +++ b/.github/workflows/vulnerability-check.yaml @@ -10,8 +10,8 @@ on: description: Token to authenticate against the OSS Index database. required: true OSSI_OSSINDEXURL: - description: Custom OSS Index / Sonatype endpoint URL. Defaults to the public OSS Index when unset. - required: false + description: OSS Index / Sonatype endpoint URL. Must match the endpoint used by the CircleCI scan. + required: true permissions: {} diff --git a/CHANGELOG.md b/CHANGELOG.md index 677bbe6..421abec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,7 +10,7 @@ Instead this file uses a date-based structure. ### Added -- `vulnerability-check.yaml` reusable workflow: runs `nancy sleuth` against the Go module graph (`go list -json -m all`) to flag dependencies with known vulnerabilities, honouring `.nancy-ignore` and `.nancy-ignore.generated`. Call it on `pull_request` and `merge_group` to gate the merge queue. Authenticates to OSS Index via the `NANCY_USER`/`NANCY_TOKEN` secrets and accepts an optional `OSSI_OSSINDEXURL` for a custom endpoint. A scanner outage exits `0` so it does not block merges. +- `vulnerability-check.yaml` reusable workflow: runs `nancy sleuth` against the Go module graph (`go list -json -m all`) to flag dependencies with known vulnerabilities, honouring `.nancy-ignore` and `.nancy-ignore.generated`. Call it on `pull_request` and `merge_group` to gate the merge queue. Authenticates to OSS Index via the `NANCY_USER`/`NANCY_TOKEN` and `OSSI_OSSINDEXURL` secrets. A scanner outage exits `0` so it does not block merges. ## 2026-06-18