mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 21:47:20 +00:00
rcourtman
592a1e52f6
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable standard library vulnerabilities in Pulse (net/http, crypto/tls, html/template, os, net/textproto), published on 2026-10-08 and fixed in Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting vulnerabilities under both govulncheck v1.1.4 and v1.7.0. Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged this. The private Enterprise build and test job notices it: once the scan finds reachable advisories it needs more than the 4 GiB CI VM holds, the guest kernel kills govulncheck, and the job is cancelled. That has failed every Enterprise pair check since 2026-10-08, including the first beta's. Move every release builder and local toolchain guard together, as 1.26.8 did, so no candidate artifact keeps an older compiler: go.mod, the builder image digests (index digest for 1.26.9-alpine), the release and dev scripts, the devcontainer, and the root pair diagnostic. Only x/net is raised in the module graph; go mod tidy is deliberately not run, so unrelated indirect requirements stay as they were. Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
50 lines
1.6 KiB
YAML
50 lines
1.6 KiB
YAML
name: Root pair diagnostic (not qualification)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
expected_workflow_sha:
|
|
description: Full reviewed main SHA containing this diagnostic
|
|
required: true
|
|
type: string
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: root-pair-diagnostic
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
diagnostic:
|
|
if: github.repository == 'rcourtman/Pulse' && github.ref == 'refs/heads/main'
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 45
|
|
steps:
|
|
- name: Bind execution to reviewed workflow source
|
|
env:
|
|
EXPECTED_SHA: ${{ inputs.expected_workflow_sha }}
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "$EXPECTED_SHA" =~ ^[0-9a-f]{40}$ ]]
|
|
[[ "$GITHUB_SHA" == "$EXPECTED_SHA" ]]
|
|
[[ "$GITHUB_RUN_ATTEMPT" == 1 ]]
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
fetch-depth: 0
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
|
|
with:
|
|
go-version: '1.26.9'
|
|
cache: false
|
|
- name: Collect fixed exact-pair root evidence
|
|
run: python3 scripts/diagnose-root-pair.py --output root-pair-evidence
|
|
- name: Retain partial or complete diagnostic evidence only
|
|
if: always()
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: root-pair-diagnostic-${{ github.run_id }}-${{ github.run_attempt }}
|
|
path: root-pair-evidence/
|
|
if-no-files-found: warn
|
|
retention-days: 30
|