Repository navigation
Conversation
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
General PR Review: Build preflight govulncheck from locked sourceBlocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThis PR makes
I scanned the full PR diff for security and correctness, including the action wiring, the phase handling in The author notes that a GitHub-hosted end-to-end run of the composite action and a release-preflight canary are still pending. I could not run them either, because this review is read-only. Runtime behavior on real runners is therefore checked only by reading the code. Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. Reviewed commit: |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
## Problem Release preflight fails on c1i (and any caller with `go_vulnerability_scan: true`) because the locked Go toolchain is **1.27.3**, which has **GO-2026-6859** (HTTP/1 server crash from a `MaxBytesReader` header race in `net/http`): ``` Vulnerability #1: GO-2026-6859 Found in: net/http@go1.27.3 Fixed in: net/http@go1.27.4 Your code is affected by 1 vulnerability ... exit 3 ``` c1i is the only caller that opts into `go_vulnerability_scan`; it cannot override the locked toolchain (`GOTOOLCHAIN: local`), and its `verify-locked-go.sh` rejects a caller newer than the lock. So the fix belongs here: move the locked Go to 1.27.4. ## Change - `.github/actions/locked-tools/tool-locks.txt`: the four Go entries (`linux/amd64`, `linux/arm64`, `darwin/arm64`, `windows/amd64`) move to `go1.27.4`, with SHA256s from https://go.dev/dl/?mode=json. - `go.mod`: `go 1.27.3` → `go 1.27.4`. - `docs/release-workflow.md`: the lock table follows. - `scripts/test-tool-integrity.py`: the newer-than-locked gate fixture uses 1.27.5 (1.27.4 is now equal, not newer), the allowed-directive loop includes 1.27.4, and the single-version sanity fixture mutates 1.27.4 → 1.27.5. - `.github/actions/ca-trust-guard/README.md`: the module-directive mention follows; the Go 1.27.3 `crypto/x509` incident notes are unchanged (they describe behaviour, not the lock). ## Verification - `go test ./...` under Go 1.27.4: pass. - `python3 scripts/test-tool-integrity.py`: 28 tests, OK (1 skipped). - Checksums are the official values from `https://go.dev/dl/?mode=json` for `go1.27.4`. ## Release note Merging this alone does not change what `@v4` resolves to; callers pinned to `@v4` need a new `v4.x` release cut from this commit. Until then, c1i's release stays blocked (its preflight correctly refuses a Go 1.27.3 build). ## Related #175 also touches `locked-tools`; this change only rewrites the Go lock entries and the gate fixtures, so it should merge independently. Upstream: c1i#202 bumps c1i's own `go` directive to 1.27.4 for CI. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Problem
#174 fixed govulncheck executable lookup after locked-tools stopped publishing
GOPATH/bin, but preflight still installs the scanner with a separatego install golang.org/x/vuln/cmd/govulncheck@v1.7.0. The scanner version is fixed, but its source identity is not part of the reviewed canonical tool lock.Change
golang/vulncommit617f44b718537dccdea1915395650e0529e3b72e(v1.7.0)../cmd/govulncheckwith readonly modules,proxy.golang.org, andsum.golang.org.PATH.go,govulncheckonly whengo_vulnerability_scanis enabled; source-hygiene-only preflight continues to request just Go.go installand GOBIN/GOPATH lookup. The Linux/Darwin/Windows./...scan loop and fail-closed behavior are unchanged.No permissions, release-secret ordering, scan inputs, or job dependencies change.
Verification
PATH="/tmp/ghw174-tools/go/bin:$PATH" GOTOOLCHAIN=local make testmake workflow-validatebash scripts/lint-shell.sh— 36 repository Bash scripts passed.PATH="/tmp/ghw174-tools/go/bin:$PATH" GOTOOLCHAIN=local go vet ./...go version -mconfirmed modulegolang.org/x/vuln v1.7.0,vcs.revision=617f44b718537dccdea1915395650e0529e3b72e, andvcs.modified=false.govulncheck -version, which reportedgovulncheck@v1.7.0.Draft validation remaining
A GitHub-hosted Linux amd64 run of the complete composite prepare → checkout → install → source-build → cleanup sequence and a release-preflight canary have not been run locally. Run those before marking ready. No live release was executed.