Skip to content

Run govulncheck by path in release preflight - #174

Merged
leet-c1 merged 1 commit into
mainfrom
fix/govulncheck-path
Nov 11, 2026
Merged

Run govulncheck by path in release preflight#174
leet-c1 merged 1 commit into
mainfrom
fix/govulncheck-path

Conversation

@leet-c1

@leet-c1 leet-c1 commented Nov 11, 2026

Copy link
Copy Markdown
Contributor

Problem

Since #159 (2026-10-21) routed release-preflight through locked-tools, only the pinned Go's bin is on PATH. The "Check for known vulnerabilities" step runs go install golang.org/x/vuln/cmd/govulncheck@v1.7.0, which writes the binary to GOBIN or the first GOPATH entry's bin. The next line then fails with govulncheck: command not found (exit 127). Every release with go_vulnerability_scan: true stops in preflight before building. ConductorOne/c1i's v0.10.0 release hit this twice (run 42847996674); its v0.9.2 released on the workflow version from before #159.

Fix

Call the binary at the path go install uses: $(go env GOBIN), else the first entry of $(go env GOPATH) plus /bin. Four lines, in that one step.

Compatibility

  • The step only runs with go_vulnerability_scan: true, which defaults to false. No other input, output, permission or job changes.
  • For callers with it on, the step failed every time, so nothing that passes today can start failing.
  • The one behaviour change: a govulncheck already on PATH can no longer shadow the pinned v1.7.0.

Verified

The step's script was extracted from the workflow and run against ConductorOne/c1i at v0.10.0. The environment matched the runner's: only the locked Go 1.27.3 on PATH, GOTOOLCHAIN=local, GOFLAGS=-mod=readonly, and a fresh HOME.

Setup Before After
GOPATH unset 127 0
GOPATH single entry 127 0
GOPATH multi-entry 127 0
GOBIN set 127 0
govulncheck already on PATH 0 0

python3 scripts/test-tool-integrity.py (28 OK, 1 skipped), go vet ./..., go test ./... and make test-scripts pass. The PowerShell tests were skipped because there's no pwsh locally. Nothing asserts on this step's text, and the README and docs/release-workflow.md describe only the input, so they stay accurate. Callers pick up the fix once v4 moves past it.

🤖 Generated with Claude Code

@leet-c1 @claude
Run govulncheck by path in release preflight
627c410 
Since #159 routed release-preflight through locked-tools, only the pinned
Go's bin is on PATH. `go install` still writes govulncheck to GOBIN or the
first GOPATH entry's bin, so the next line failed with `govulncheck:
command not found` (exit 127) and every release with
go_vulnerability_scan: true stopped before building.

Call the binary at the path go install uses. Callers with the input off
(the default) never run this step; for callers with it on, the step
failed every time, so nothing that passes today changes, and a
govulncheck already on PATH can no longer shadow the pinned v1.7.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@leet-c1
leet-c1 requested a review from a team November 11, 2026 00:08
@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Superseded — see the current review report for commit 627c410f6474

General PR Review: Run govulncheck by path in release preflight

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 226b66f5bc03.
Review mode: full
View review run

Review Summary

The "Check for known vulnerabilities" step in release-preflight (.github/workflows/release.yaml:379-392) now runs govulncheck by its full path. That path is $(go env GOBIN) if set, otherwise the first GOPATH entry plus /bin, which is where go install puts the binary. Before, the step looked for govulncheck on PATH, and locked-tools doesn't put that directory there. I scanned the full PR diff, a single 4-line hunk, for security and correctness problems. The path logic matches where go install writes. ${gopath%%:*} uses : as the list separator, which is right because the job runs on ubuntu-latest (release.yaml:268). set -euo pipefail still makes failures in go env fatal. Nothing else in the repo calls govulncheck from PATH. No repo-local criteria loaded, so I used only the base criteria. Inputs, outputs, permissions and job structure are unchanged, so callers keep the same interface.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

@github-actions

github-actions Bot commented Nov 11, 2026 •
edited
Loading

Copy link
Copy Markdown

General PR Review: Run govulncheck by path in release preflight

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 226b66f5bc03.
Review mode: full
View review run

Review Summary

The "Check for known vulnerabilities" step in release-preflight (.github/workflows/release.yaml:379-392) now runs govulncheck by its full path. That path is $(go env GOBIN) if set, otherwise the first GOPATH entry plus /bin, which is where go install puts the binary. Before, the step looked for govulncheck on PATH, and locked-tools doesn't put that directory there. I scanned the full PR diff, a single 4-line hunk, for security and correctness problems. The path logic matches where go install writes. ${gopath%%:*} uses : as the list separator, which is right because the job runs on ubuntu-latest (release.yaml:268). set -euo pipefail still makes failures in go env fatal. Nothing else in the repo calls govulncheck from PATH. No repo-local criteria loaded, so I used only the base criteria. Inputs, outputs, permissions and job structure are unchanged, so callers keep the same interface.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Reviewed commit: 627c410f6474

github-actions[bot]
github-actions Bot reviewed Nov 11, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found — see the full review report

@leet-c1
leet-c1 requested a review from gontzess November 11, 2026 00:14
@leet-c1 leet-c1 mentioned this pull request Nov 11, 2026
Merged
@leet-c1
leet-c1 merged commit 14095f9 into main Nov 11, 2026
7 checks passed
@leet-c1
leet-c1 deleted the fix/govulncheck-path branch November 11, 2026 16:40
@gontzess gontzess mentioned this pull request Nov 12, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@FeliLucero1 FeliLucero1 FeliLucero1 approved these changes
@gontzess gontzess Awaiting requested review from gontzess

Assignees

@gontzess gontzess

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@leet-c1 @FeliLucero1 @gontzess