项目文件夹

文件

T

文件历史

Asim Aslam bba3b8ba98 ci: add govulncheck vulnerability gate (+ wire into loop triage) (#4558 )

Adds a deterministic reachable-CVE gate: `govulncheck ./...` on every push/PR,
failing on any reachable vulnerability EXCEPT an explicit allow-list of
known-unfixable ones. Today the allow-list holds exactly the two pgx/v4 CVEs
(GO-2026-5004, GO-2026-4518) with no upstream fix (tracked in #4556), so the
gate is green now and turns red the moment a NEW vulnerability appears.

This is the deterministic layer under the `security` loop role: the role
audits with judgment, this blocks known CVEs mechanically. Also adds
`govulncheck` to the loop-triage watch list, so a newly-disclosed CVE that
reddens the gate on master auto-files a fix issue for the loop to bump the dep.

Make `govulncheck` a required status check on master to enforce it.
Verified locally: exit 3 with only the two allow-listed IDs -> gate PASS.


Claude-Session: https://claude.ai/code/session_01CmdEY7pYmV5zzwCjNJ4ykL

Co-authored-by: Claude <noreply@anthropic.com>

2026-07-10 11:04:36 +01:00

govulncheck.yml

ci: add govulncheck vulnerability gate (+ wire into loop triage) (#4558 )

2026-07-10 11:04:36 +01:00

harness.yml

Guard provider conformance workflow scheduling (#4120 )

2026-07-06 04:59:35 +01:00

lint.yaml

security: patch reachable CVEs (28 of 30) via toolchain + dependency bumps (#4555 )

2026-07-10 10:56:16 +01:00

loop-builder.yml

feat(loop): go-micro runs on micro loop (dogfood its own tool) (#3657 )