ci: CodeQL, dependabot coverage, x/mod advisory bump (Scorecard) - #49
Merged
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
deadpoets
force-pushed
the
scorecard-hardening
branch
from
August 16, 2026 22:24
755bd43 to
0b91876
Compare
deadpoets
added a commit
that referenced
this pull request
Aug 17, 2026
… of them (#50) `apicompat.sh` treated **every** non-zero `gorelease` exit as a tool failure. Two conditions observed in one week are not tool failures, and both produced a red required check on PRs whose content had nothing to do with them. ## 1. Transient module resolution Publishing a version puts it on the git remote immediately, but on `proxy.golang.org` and `sum.golang.org` only after a propagation delay. In that window anything resolving the module 404s. The `retract` directive added in #47 makes this **worse**, not better: retractions live in the *latest* version's `go.mod`, so every resolution path must now fetch exactly the version that was just published. Today that failed `apicompat` on both open PRs simultaneously — #48 (gitignore patterns) and #49 (CodeQL) — neither of which touched Go code: ``` gorelease: go: loading module retractions for …@v0.0.0-gorelease: verifying go.mod: …@v0.3.2/go.mod: reading https://sum.golang.org/lookup/…@v0.3.2: 404 Not Found ``` ## 2. "Cannot suggest a release version" A legitimate `gorelease` result, not an error — it declines when the base isn't the most recent version of the major, which is exactly the state a dependency floor-raise PR is in. This is the same deadlock the script's own header already describes for API breaks, and it deserves the same treatment. It failed PR #44 and was worked around with an admin merge. ## The change Both become warnings with actionable titles. **Anything else non-zero still exits 1** — a parse error, a missing binary, or an auth failure must not pass silently. The script's one failing path is only worth having if it means something. Not retried on the transient path: the propagation window is minutes to tens of minutes, far longer than a job should sit spinning. ## Verification Classifier tested against eight cases, including the two **real** failure outputs captured from CI: | input | verdict | |---|---| | sumdb 404 / unknown revision *(today's failure)* | WARN transient | | "Cannot suggest a release version" *(PR #44's failure)* | WARN inconclusive | | clean run | pass | | compatible additions | pass | | incompatible API change | WARN *(existing behavior, unchanged)* | | network failure (`no such host`) | WARN transient | | `go.mod` parse error | **ERROR, exit 1** | | `gorelease: command not found` | **ERROR, exit 1** | Also run live against the real condition. It correctly errored on a genuine precondition failure (uncommitted changes in the tree) before the commit, and returned a clean comparison after — `Suggested version: v0.3.3`. --------- Co-authored-by: Chris Fink <7587613+deadpoets@users.noreply.github.com>
Three findings from an OpenSSF Scorecard run (aggregate 6.6): - CodeQL workflow, build-mode none — the only mode that covers all four modules in one job. Satisfies the SAST check, which found no analysis runs on any recent commit. - secmem-lint: x/mod v0.38.0 -> v0.40.0 (fixes GO-2026-6179 and GO-2026-6180, sumdb transparency-log verification), x/tools v0.49.0 alongside. Tooling-only exposure, but two releases stale. - dependabot: cover /secmem-lint and /examples. Their omission is how the x/mod lag went unnoticed. The remaining flagged vulnerability (GO-2026-5932, "openpgp is unmaintained") has no fixed version and flags any graph containing x/crypto; it is not actionable here.
The Go extractor supports only autobuild and manual; init fails fast on none. Manual reuses the same go.work union as CI so one root build covers core, crypto and lint, with examples built under GOWORK=off. Go version comes from go.mod, not a second pin site.
deadpoets
force-pushed
the
scorecard-hardening
branch
from
August 17, 2026 00:38
0b91876 to
48feb95
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three fixes from a local OpenSSF Scorecard preview (aggregate 6.6/10, run via the official container against the GitHub API — nothing published).
SAST: 0/10— no analysis runs found on any of the last 30 commits).build-mode: nonebecause autobuild stops at the firstgo.modand this repo has four; source-only scanning covers all of them in one job. Both actions SHA-pinned per repo convention. Weekly cron keeps the default branch from going stale between merges.x/modv0.38.0 → v0.40.0 (Vulnerabilities: 7/10). Clears GO-2026-6179 and GO-2026-6180 (sumdb transparency-log verification fixes).x/toolsmoves to v0.49.0 alongside. Built and tested underGOWORK=off./secmem-lintand/examplesto the gomod ecosystem. Their omission is exactly how the x/mod lag survived two releases of a published advisory unnoticed.Not addressed, deliberately:
x/cryptoat all — unclearable while secmem-crypto exists. Caps Vulnerabilities at 9.gorelease@latestat ci.yml:335 stays unpinned; the in-file rationale (x/exp publishes no tags, a pseudo-version pin rots invisibly) predates and outranks the Scorecard point. Accepted -1 on Pinned-Dependencies.enforce_admins: false, which is the bypass that permits solo self-merge past the required review. Owner's call, not a PR.SAST scores over the last 30 commits, so the check climbs gradually after this merges rather than jumping to 10.
🤖 Generated with Claude Code