Fix long-term GitHub Actions failures and remediate govulncheck CVE findings#437
Fix long-term GitHub Actions failures and remediate govulncheck CVE findings#437Copilot wants to merge 7 commits into
Conversation
Agent-Logs-Url: https://github.com/jetstack/version-checker/sessions/723b5680-e2ad-44e2-98a2-117d9553bf7b Co-authored-by: davidcollom <1504448+davidcollom@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Updates the repository’s main Go CI workflow (Test & Build) to address recurring GitHub Actions failures in the lint and govulncheck jobs by adjusting how the tools are installed and how repository checkout is handled.
Changes:
- Adjust
golangci-lintaction configuration to install viagoinstalland trackversion: latest. - Configure
golang/govulncheck-actionto skip its internal repo checkout (repo-checkout: false) and rely on the job’s checkout.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@copilot looks like we have some CVEs that need addressing from the recent govulncheck check... Let's fix them please |
Agent-Logs-Url: https://github.com/jetstack/version-checker/sessions/c3b9c0eb-1f13-4658-a1f2-c38f01ad1ec7 Co-authored-by: davidcollom <1504448+davidcollom@users.noreply.github.com>
Head branch was pushed to by a user without write access
Addressed in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
# Conflicts: # go.mod
|
I don't think that this should be 7 commits for dependency updates + a minor CI modification; please rebase. |
|
@aidy does it matter? the default merge is squashed anyway. |
|
There are effectively two functional changes here - one is to update the dependencies, one is to modify the CI action. Those are distinct and separate things, and so should be separate commits so that they could be independently reverted, should it be necessary, and to facilitate effective use of git bisect. Ideally, this would be two distinct PRs. |
Yea, Ideally - but again, does it really matter - given the fact no one else has contributed to the project for months - I'm even reluctant to even care about this project anymore.
This is true, but to resolve the pipeline, means we need to resolve the dependencies due to govulncheck failing... https://github.com/jetstack/version-checker/actions/runs/27133213187/job/80079106856 |
Summary
Resolve recurring CI failures in the
Test & Buildworkflow, includinggolangci-lintbreakage andgovulncheckcheckout/auth issues, and address the vulnerability reported bygovulncheck.Changes
golangci/golangci-lint-actionusage to:version: latestinstall-mode: goinstallgolang/govulncheck-actionusage to set:repo-checkout: falsegolang.org/x/netfromv0.49.0tov0.53.0(fix forGO-2026-4918)golang.org/x/cryptotov0.50.0golang.org/x/termtov0.42.0golang.org/x/texttov0.36.0Why this fixes it long-term
golangci-lintis no longer pinned to an older binary built with an older Go toolchain, avoiding future mismatches as the repository Go version advances.govulncheckno longer performs an extra internal checkout on top of the job checkout, preventing duplicate GitHub auth header issues that caused fetch failures.govulncheck-reported vulnerability is remediated by movinggolang.org/x/netto the reported fixed version.Validation
golangci-lint: Go version compatibility error in pinned linter binarygovulncheck: duplicateAuthorizationheader caused git fetch HTTP 400govulncheck: reportedGO-2026-4918ingolang.org/x/net@v0.49.0, fixed inv0.53.0go test ./pkg/metrics ./pkg/client/...succeedsmake buildsucceedsNotes
govulncheckre-run could not complete in this environment due transient DNS resolution failure forvuln.go.dev; CI remains the source of truth for the workflow scan result.