Repository navigation
ci: govulncheck scans with Go 1.27.3, the daemon release toolchain - #61
Merged
Merged
Conversation
common is a library with no release build of its own; it ships inside the daemon, pilotctl and the registry. The registry is already built with Go 1.27.3. The scan matches the daemon's release toolchain once the daemon builds with 1.27.3 too (pilotprotocol release.yml, ci/go-1.27.3); until that lands it is one step ahead of the shipped daemon. On Go 1.25.13 govulncheck reports ten stdlib findings (GO-2026-6809 and nine fixed in 1.26.9). On Go 1.27.3 it reports none, on main and on fix/sign-network-role-ops (#60). go.mod's go line stays at 1.25.13.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
govulncheck v1.1.4 (golang.org/x/tools v0.29.0) panics on Go 1.27.3's
standard library on linux/amd64 ("unexpected expr: *ast.KeyValueExpr").
v1.7.0 is the version pilotprotocol and updater already pin; on Go 1.27.3
it reports no vulnerabilities for this module, on main and on
fix/sign-network-role-ops.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
security.yml's govulncheck job scans with Go 1.27.3, the toolchain the daemon release builds with, using govulncheck v1.7.0 (the version pilotprotocol and updater pin; v1.1.4 cannot analyze Go 1.27's standard library).go.mod's go line stays at 1.25.13.On Go 1.27.3 govulncheck reports no findings for this module (ten stdlib findings on 1.25.13).