mirror of
https://blitiri.com.ar/repos/chasquid
synced 2026-10-29 15:02:30 +00:00
Alberto Bertogli
d2260180c6
When running govulncheck, if we use go.mod's version, that is the oldest Go version that we expect to build chasquid. However, that specific version is often 1.x.0 and can include vulnerabilities that are fixed in later patch releases. This can cause govulncheck to complain, which introduces noise in the CI. Instead, we should run govulncheck on the latest Go version, to make sure that any reports are about our code or the dependencies, and not the toolchain. That behaviour is in place today, but it's not obvious from the config. This patch updates the config to note this more explicitly, to prevent future confusion.
29 lines
796 B
YAML
29 lines
796 B
YAML
name: "govulncheck"
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main", "next" ]
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: [ "main", "next" ]
|
|
schedule:
|
|
- cron: '29 21 * * 6'
|
|
|
|
jobs:
|
|
govulncheck:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: actions/setup-go@v7
|
|
with:
|
|
# Note this is intentionally the latest 1.x version, not the one we
|
|
# use in go.mod, as that avoids noise if there are vulnerabilities
|
|
# in the Go toolchain itself.
|
|
go-version: ">=1.x"
|
|
check-latest: true
|
|
- name: install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
- name: run govulncheck
|
|
run: govulncheck ./...
|