Mirrors/go-chasquid-smtp
1
0
Fork 0
mirror of https://blitiri.com.ar/repos/chasquid synced 2026-10-28 15:02:28 +00:00
Code Releases Activity

github: Note that govulncheck is run on the latest Go version

Browse Source 
When running govulncheck, if we use go.mod's version, that is the oldest
Go version that we expect to build chasquid.

However, that specific version is often 1.x.0 and can include
vulnerabilities that are fixed in later patch releases. This can cause
govulncheck to complain, which introduces noise in the CI.

Instead, we should run govulncheck on the latest Go version, to make
sure that any reports are about our code or the dependencies, and not
the toolchain.

That behaviour is in place today, but it's not obvious from the config.

This patch updates the config to note this more explicitly, to prevent
future confusion.
This commit is contained in:
Alberto Bertogli
2026-10-04 19:03:09 +01:00
parent b23047aa83
commit d2260180c6
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/govulncheck.yml
+4 -1
View File
@@ -17,7 +17,10 @@ jobs:
- uses: actions/checkout@v7 - uses: actions/checkout@v7
- uses: actions/setup-go@v7 - uses: actions/setup-go@v7
with: with:
go-version: ">=1.19.2" # Note this is intentionally the latest 1.x version, not the one we
# use in go.mod, as that avoids noise if there are vulnerabilities
# in the Go toolchain itself.
go-version: ">=1.x"
check-latest: true check-latest: true
- name: install govulncheck - name: install govulncheck
run: go install golang.org/x/vuln/cmd/govulncheck@latest run: go install golang.org/x/vuln/cmd/govulncheck@latest