fix(security): build with a patched Go toolchain - #115
Merged
Merged
Conversation
setup-go resolves the toolchain from go.mod and reads the go directive as an exact version, not a floor — so every build here used that exact patch release. govulncheck reports reachable call paths from this module into its standard library. Pinned to go1.25.14, the current patch for this minor. The go directive is untouched, so nothing importing this module has its floor raised, and the Go command honours it everywhere: CI, releases, and a laptop. Verified with the resolution CI performs: the build downloads go1.25.14 and govulncheck exits 0. Part of a fleet sweep — 40 of 43 Go repositories were affected. Refs klarlabs-studio/.github#73 Claude-Session: https://claude.ai/code/session_01N9cWx4ZEypDzzhvnnTiHdy
This repository's required checks move from GitHub Actions contexts to warden/gate, because Actions cannot run here — spending is capped, and the jobs are refused before they start (conclusion: failure, steps: 0). The gate keeps everything Actions was enforcing except one thing: the govulncheck job. That job is what surfaced the fleet-wide finding this branch fixes — every build used the exact patch release named in the go directive, fourteen releases behind in some repos. Switching without carrying it across would delete the check in the same change that ships its fix. Refs klarlabs-studio/.github#73 Claude-Session: https://claude.ai/code/session_01N9cWx4ZEypDzzhvnnTiHdy
Branch protection here now requires warden/gate instead of the GitHub Actions contexts, because Actions cannot run while the spending limit holds — every job reports failure with zero steps executed. Requiring a status is not the same as producing one. warden ran the gate and attested the commit, but published nothing, so the pull request stayed blocked on a check nothing emitted. This enables the publish. Claude-Session: https://claude.ai/code/session_01N9cWx4ZEypDzzhvnnTiHdy
isReady took the machine's current state and never read it. The readiness check asks interp.Matches(s), which is the right question — it matches hierarchical states, where comparing a raw StateID against a configured ready state would only ever match an exact leaf. The parameter is a leftover from the implementation that predated Matches. Found by golangci-lint's unparam. It is on main too: lint has been in this repository's pre_push all along, but the spending limit stopped Actions from running anything, so nothing has actually looked at this gate since the code landed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of a fleet-wide sweep: 40 of 43 Go repositories build on a Go toolchain behind on security patches.
Why
setup-goresolves the toolchain fromgo.modand reads thegodirective as an exact version, not a floor. So every build here used that exact patch release, and govulncheck reports reachable call paths from this module into its standard library.The findings were invisible because the failing step's log is not retrievable — they appear only in the check run's annotations.
The change
The
godirective is untouched, so nothing importing this module has its floor raised, and the Go command honours the toolchain everywhere — CI, releases, and a developer's laptop.Verification
Built and scanned with the resolution CI performs.
govulncheckexits 0.Analysis and the fleet survey: klarlabs-studio/.github#73. Already merged: klarlabs-studio/kiln#48, klarlabs-studio/warden#242.
https://claude.ai/code/session_01N9cWx4ZEypDzzhvnnTiHdy