Repository navigation
ci: check both Go modules with govulncheck - #2729
Merged
Merged
Conversation
dunglas
force-pushed
the
feature/ci-govulncheck
branch
from
October 26, 2026 09:19
b053999 to
cb75554
Compare
dunglas
added a commit
that referenced
this pull request
Oct 26, 2026
`setup-go` read `go 1.27.0` from `go.mod` as an exact version, so `check-latest` never applied. Windows, macOS and `release.yaml` builds have been using Go 1.27.0, and the v1.13.3 Windows and macOS binaries are affected by [GO-2026-6617](https://pkg.go.dev/vuln/GO-2026-6617) (HTTP/2 server crash from an HPACK encoder race, fixed in Go 1.27.2). Docker images and Linux static binaries already used the latest patch release. - `go.mod` and `caddy/go.mod` now declare `go 1.27`, so `go-version-file` gives `setup-go` the minor version and `check-latest` resolves the latest 1.27.x on every run. `go mod tidy` keeps this form. - Lint fails on a patch release in a `go` directive or on any `toolchain` directive. Both pin CI to a release that goes stale, `go get` adds them back on its own, and Dependabot doesn't update them ([dependabot/dependabot-core#9527](dependabot/dependabot-core#9527)). Unblocks #2729, which flags GO-2026-6617 while CI runs Go 1.27.0.
dunglas
force-pushed
the
feature/ci-govulncheck
branch
from
October 26, 2026 09:42
cb75554 to
25c1131
Compare
Member
|
Thank you! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add a standalone GitHub Actions workflow that runs
govulncheck ./...for both the root and Caddy Go modules.main, daily and on manual dispatch.Validation: actionlint, YAML and shell syntax checks passed. The actual scan still needs to run in GitHub Actions.
@dunglas CC