Skip to content

Build preflight govulncheck from locked source - #175

Closed
gontzess wants to merge 1 commit into
mainfrom
steve.gontzes/lock-govulncheck
Closed

Build preflight govulncheck from locked source#175
gontzess wants to merge 1 commit into
mainfrom
steve.gontzes/lock-govulncheck

Conversation

@gontzess

@gontzess gontzess commented Nov 12, 2026

Copy link
Copy Markdown
Contributor

Problem

#174 fixed govulncheck executable lookup after locked-tools stopped publishing GOPATH/bin, but preflight still installs the scanner with a separate go install golang.org/x/vuln/cmd/govulncheck@v1.7.0. The scanner version is fixed, but its source identity is not part of the reviewed canonical tool lock.

Change

  • Add a Linux amd64 govulncheck source lock for golang/vuln commit 617f44b718537dccdea1915395650e0529e3b72e (v1.7.0).
  • Teach locked-tools to check out that exact commit with credential persistence disabled, automatically install locked Go first, and build ./cmd/govulncheck with readonly modules, proxy.golang.org, and sum.golang.org.
  • Disable Go environment files/workspace discovery and clear private/insecure module overrides for the scanner build. Check and hash the executable before publishing its directory on PATH.
  • Request go,govulncheck only when go_vulnerability_scan is enabled; source-hygiene-only preflight continues to request just Go.
  • Remove the separate go install and GOBIN/GOPATH lookup. The Linux/Darwin/Windows ./... scan loop and fail-closed behavior are unchanged.
  • Add source-commit/checksum/Go-requirement negative controls, action and workflow wiring assertions, Renovate metadata, and documentation.

No permissions, release-secret ordering, scan inputs, or job dependencies change.

Verification

  • PATH="/tmp/ghw174-tools/go/bin:$PATH" GOTOOLCHAIN=local make test
    • Locked-tools integrity: 30 tests, OK, 1 native-Windows-only test skipped on Linux.
    • Full repository script and Go test targets passed.
  • make workflow-validate
  • bash scripts/lint-shell.sh — 36 repository Bash scripts passed.
  • PATH="/tmp/ghw174-tools/go/bin:$PATH" GOTOOLCHAIN=local go vet ./...
  • Real source-build smoke using the hash-verified locked Go 1.27.3 toolchain:
    • Built the pinned commit successfully for Linux amd64.
    • go version -m confirmed module golang.org/x/vuln v1.7.0, vcs.revision=617f44b718537dccdea1915395650e0529e3b72e, and vcs.modified=false.
    • Built a native Linux arm64 copy and executed govulncheck -version, which reported govulncheck@v1.7.0.
  • Independent read-only review of the staged diff found no introduced P1/P2/P3 findings.

Draft validation remaining

A GitHub-hosted Linux amd64 run of the complete composite prepare → checkout → install → source-build → cleanup sequence and a release-preflight canary have not been run locally. Run those before marking ready. No live release was executed.

@gontzess @c1-squire-dev
Build release govulncheck from locked source
99b15bf 
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Superseded — see the current review report for commit 99b15bfaabbb

General PR Review: Build preflight govulncheck from locked source

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 14095f92a811.
Review mode: full
View review run

Review Summary

This PR makes govulncheck a source-built tool in locked-tools, using the same pattern as gon.

  • Lock: a new lock row pins golang/vuln to 617f44b7 for linux/amd64. I confirmed through the GitHub API that the v1.7.0 tag resolves to this commit.
  • Prepare step: locked-tools.sh adds Go automatically and makes a unique workspace checkout path whose name is checked against a regex.
  • Checkout: a pinned actions/checkout fetches the commit without persisting credentials.
  • Build: govulncheck-source.sh checks HEAD against the lock and enforces readonly/proxy/sumdb. It also runs the locked-Go version and go.mod checks, then builds with GOENV/GOWORK off and private/insecure overrides cleared. Finally it prints the binary's SHA256 and adds its directory to GITHUB_PATH.
  • Workflow: release-preflight (runs-on: ubuntu-latest, so the linux/amd64 lock applies) requests go,govulncheck only when go_vulnerability_scan is true. It drops go install and the GOBIN lookup, and the binary is now found on PATH. The OS loop and fail-closed behavior are unchanged.

I scanned the full PR diff for security and correctness, including the action wiring, the phase handling in locked-tools.sh, the Renovate regex against the lock text, and the test updates. No repo-local criteria loaded, so I applied only the base criteria.

The author notes that a GitHub-hosted end-to-end run of the composite action and a release-preflight canary are still pending. I could not run them either, because this review is read-only. Runtime behavior on real runners is therefore checked only by reading the code.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

@github-actions

github-actions Bot commented Nov 12, 2026 •
edited
Loading

Copy link
Copy Markdown

General PR Review: Build preflight govulncheck from locked source

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base 14095f92a811.
Review mode: full
View review run

Review Summary

This PR makes govulncheck a source-built tool in locked-tools, using the same pattern as gon.

  • Lock: a new lock row pins golang/vuln to 617f44b7 for linux/amd64. I confirmed through the GitHub API that the v1.7.0 tag resolves to this commit.
  • Prepare step: locked-tools.sh adds Go automatically and makes a unique workspace checkout path whose name is checked against a regex.
  • Checkout: a pinned actions/checkout fetches the commit without persisting credentials.
  • Build: govulncheck-source.sh checks HEAD against the lock and enforces readonly/proxy/sumdb. It also runs the locked-Go version and go.mod checks, then builds with GOENV/GOWORK off and private/insecure overrides cleared. Finally it prints the binary's SHA256 and adds its directory to GITHUB_PATH.
  • Workflow: release-preflight (runs-on: ubuntu-latest, so the linux/amd64 lock applies) requests go,govulncheck only when go_vulnerability_scan is true. It drops go install and the GOBIN lookup, and the binary is now found on PATH. The OS loop and fail-closed behavior are unchanged.

I scanned the full PR diff for security and correctness, including the action wiring, the phase handling in locked-tools.sh, the Renovate regex against the lock text, and the test updates. No repo-local criteria loaded, so I applied only the base criteria.

The author notes that a GitHub-hosted end-to-end run of the composite action and a release-preflight canary are still pending. I could not run them either, because this review is read-only. Runtime behavior on real runners is therefore checked only by reading the code.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Reviewed commit: 99b15bfaabbb

github-actions[bot]
github-actions Bot reviewed Nov 12, 2026
View reviewed changes

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No blocking issues found — see the full review report

@gontzess
gontzess marked this pull request as ready for review November 12, 2026 18:45
@gontzess
gontzess requested a review from a team November 12, 2026 18:45
@leet-c1 leet-c1 mentioned this pull request Nov 12, 2026
Merged
@gontzess gontzess closed this Nov 12, 2026
leet-c1 added a commit that referenced this pull request Nov 12, 2026
@leet-c1 @c1-squire-dev
chore(deps): lock Go 1.27.4 for release builds (GO-2026-6859) (#176)
57082aa 
## Problem

Release preflight fails on c1i (and any caller with
`go_vulnerability_scan: true`) because the locked Go toolchain is
**1.27.3**, which has **GO-2026-6859** (HTTP/1 server crash from a
`MaxBytesReader` header race in `net/http`):

```
Vulnerability #1: GO-2026-6859
  Found in: net/http@go1.27.3
  Fixed in: net/http@go1.27.4
Your code is affected by 1 vulnerability ... exit 3
```

c1i is the only caller that opts into `go_vulnerability_scan`; it cannot
override the locked toolchain (`GOTOOLCHAIN: local`), and its
`verify-locked-go.sh` rejects a caller newer than the lock. So the fix
belongs here: move the locked Go to 1.27.4.

## Change

- `.github/actions/locked-tools/tool-locks.txt`: the four Go entries
(`linux/amd64`, `linux/arm64`, `darwin/arm64`, `windows/amd64`) move to
`go1.27.4`, with SHA256s from https://go.dev/dl/?mode=json.
- `go.mod`: `go 1.27.3` → `go 1.27.4`.
- `docs/release-workflow.md`: the lock table follows.
- `scripts/test-tool-integrity.py`: the newer-than-locked gate fixture
uses 1.27.5 (1.27.4 is now equal, not newer), the allowed-directive loop
includes 1.27.4, and the single-version sanity fixture mutates 1.27.4 →
1.27.5.
- `.github/actions/ca-trust-guard/README.md`: the module-directive
mention follows; the Go 1.27.3 `crypto/x509` incident notes are
unchanged (they describe behaviour, not the lock).

## Verification

- `go test ./...` under Go 1.27.4: pass.
- `python3 scripts/test-tool-integrity.py`: 28 tests, OK (1 skipped).
- Checksums are the official values from `https://go.dev/dl/?mode=json`
for `go1.27.4`.

## Release note

Merging this alone does not change what `@v4` resolves to; callers
pinned to `@v4` need a new `v4.x` release cut from this commit. Until
then, c1i's release stays blocked (its preflight correctly refuses a Go
1.27.3 build).

## Related

#175 also touches `locked-tools`; this
change only rewrites the Go lock entries and the gate fixtures, so it
should merge independently. Upstream: c1i#202 bumps c1i's own `go`
directive to 1.27.4 for CI.

Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments
@jugonzalez12 jugonzalez12 jugonzalez12 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@gontzess @jugonzalez12