Skip to content

govulncheck: run from a container #1219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xcoulon merged 2 commits into from
Dec 11, 2025
Merged

govulncheck: run from a container #1219

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c756495
govulncheck-action: run from Container image
xcoulon Dec 9, 2025
aca7286
update link to action
xcoulon Dec 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions .github/workflows/govulncheck.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@ jobs:
uses: actions/checkout@v6

- name: Run govulncheck
uses: codeready-toolchain/toolchain-cicd/govulncheck-action@master
uses: xcoulon/toolchain-cicd/govulncheck-action@govulncheck_dockerfile
Copy link

@coderabbitai coderabbitai bot Dec 5, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

fd -type f -name "govulncheck.yml" | head -20

Repository: codeready-toolchain/host-operator

Length of output: 210

🌐 Web query:

codeready-toolchain host-operator govulncheck.yml xcoulon fork

💡 Result:

I couldn't find a public fork by user "xcoulon" of codeready-toolchain/host-operator that adds a govulncheck.yml. I did find:

  • Xavier Coulon (xcoulon) GitHub profile/gists. [1]
  • xcoulon/govulncheckx-action — a govulncheck GitHub Action that uses a .govulncheck.yaml/.govulncheckx.yaml config to ignore entries. [2]
  • The upstream codeready-toolchain/host-operator repository (no obvious govulncheck.yml in main). [3]

If you want, I can:

  • search deeper (include private forks if you give a GitHub link or username token), or
  • show how to add a govulncheck workflow to a host-operator fork and open a PR. Which do you prefer?

Sources:
[1] https://gist.github.com/xcoulon
[2] https://github.com/xcoulon/govulncheckx-action
[3] https://github.com/codeready-toolchain/host-operator

🌐 Web query:

codeready-toolchain toolchain-cicd govulncheck-action repository

💡 Result:

Here are relevant repositories I found:

  • govulncheck-action (official Go mirror on GitHub / canonical repo on go.googlesource.com). [golang/govulncheck-action]. [1][2]
  • Alternative govulncheck-action that produces SARIF (Templum/govulncheck-action). [3]
  • CodeReady Toolchain (GitHub org) — notable repos: host-operator, member-operator, api, toolchain-e2e. [4][5][6][7]

Sources:

  1. golang/govulncheck-action (GitHub mirror). [1]
  2. go.googlesource.com — govulncheck-action README. [2]
  3. Templum/govulncheck-action (SARIF uploader). [3]
  4. codeready-toolchain/host-operator (libraries.io / GitHub). [4]
  5. codeready-toolchain/member-operator (libraries.io / GitHub). [5]
  6. codeready-toolchain/api (libraries.io / GitHub). [6]
  7. codeready-toolchain/toolchain-e2e (libraries.io / GitHub). [7]

Would you like direct GitHub links or example workflow snippets for integrating govulncheck-action into a CodeReady Toolchain repo?

🌐 Web query:

site:github.com codeready-toolchain/toolchain-cicd govulncheck-action

💡 Result:

I searched GitHub for "site:github.com codeready-toolchain/toolchain-cicd govulncheck-action" and found no occurrences of govulncheck-action in the codeready-toolchain/toolchain-cicd repository.

Related govulncheck-action repositories I found:

  • golang/govulncheck-action (official mirror). [1]
  • Templum/govulncheck-action. [2]
  • kmulvey/govulncheck-action. [3]

If you want, I can open the codeready-toolchain/toolchain-cicd repo and search its CI/workflow files directly for govulncheck references.

🌐 Web query:

site:github.com/codeready-toolchain/toolchain-cicd

💡 Result:

Found the GitHub repository codeready-toolchain/toolchain-cicd — a public repo containing GitHub Actions composite run steps and CI/CD scripts (Go + Shell + Makefile). It shows ~169 commits, 3 stars, 20 forks, and no releases. [1]

Sources

  • GitHub: codeready-toolchain/toolchain-cicd (repository page). [1]

Action reference uses personal fork with feature branch — unsuitable for merging to master.

The action reference xcoulon/toolchain-cicd/govulncheck-action@govulncheck_dockerfile points to a personal fork instead of the organization repository (codeready-toolchain/toolchain-cicd), and references a feature branch rather than a stable release or stable branch reference. This pattern is unsuitable for production code merging to master.

Ensure the action reference uses the organization account with an appropriate stable branch or tag reference before merging. Additionally, verify the setup-go action mentioned in the PR description is properly defined in this workflow.

🤖 Prompt for AI Agents 
In .github/workflows/govulncheck.yml around line 17, the workflow uses a
personal fork and feature branch reference
(xcoulon/toolchain-cicd@govulncheck_dockerfile); update this to reference the
organization repository and a stable tag or branch (e.g.,
codeready-toolchain/[email protected] or @main) to avoid relying on personal
forks/feature branches, and confirm or add the setup-go action step referenced
in the PR so it uses the official setup-go action (actions/setup-go@vX) or a
pinned tag; replace the action reference and verify workflow runs locally or via
CI to ensure no other missing/misnamed actions.

Copy link
Contributor Author

@xcoulon xcoulon Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this needs to be updated once codeready-toolchain/toolchain-cicd#159 is merged

Copy link

@coderabbitai coderabbitai bot Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Get details about the referenced PR #159 in toolchain-cicd repository
gh pr view 159 --repo codeready-toolchain/toolchain-cicd --json title,state,url,author,body,headRefName

Length of output: 534

@xcoulon, understood! I can see that PR #159 ("govulncheck: run from a Container") is currently open and uses the same govulncheck_dockerfile branch. Once that PR is merged to the codeready-toolchain/toolchain-cicd repository, you'll need to update line 17 in this workflow to reference the organization repository instead of your personal fork.

The update should change:

uses: xcoulon/toolchain-cicd/govulncheck-action@govulncheck_dockerfile

to something like:

uses: codeready-toolchain/toolchain-cicd/govulncheck-action@master

(or whichever stable branch/tag is appropriate after the merge)

Would you like me to create a follow-up issue to track this update, or will you handle it as part of the merge process?

with:
go-version-file: go.mod
cache: false
config: .govulncheck.yaml
config: .govulncheck.yaml
debug: true # optional (default = false)
2 changes: 1 addition & 1 deletion .github/workflows/test-with-coverage.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
- name: Install Go
uses: actions/setup-go@v6
with:
go-version file: go.mod
go-version-file: go.mod
Copy link
Contributor

@MatousJobanek MatousJobanek Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice catch 👍

Copy link
Contributor Author

@xcoulon xcoulon Dec 9, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks ;)


- name: generate
run: |
Expand Down
28 changes: 20 additions & 8 deletions .govulncheck.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,46 +4,58 @@ ignored-vulnerabilities:
# Fixed in: crypto/[email protected]
- id: GO-2025-4013
info: https://pkg.go.dev/vuln/GO-2025-4013
silence-until: 2025-12-03
silence-until: 2026-01-03
# Lack of limit when parsing cookies can cause memory exhaustion in net/http
# Found in: net/[email protected]
# Fixed in: net/[email protected]
- id: GO-2025-4012
info: https://pkg.go.dev/vuln/GO-2025-4012
silence-until: 2025-12-03
silence-until: 2026-01-03
# Parsing DER payload can cause memory exhaustion in encoding/asn1
# Found in: encoding/[email protected]
# Fixed in: encoding/[email protected]
- id: GO-2025-4011
info: https://pkg.go.dev/vuln/GO-2025-4011
silence-until: 2025-12-03
silence-until: 2026-01-03
# Insufficient validation of bracketed IPv6 hostnames in net/url
# Found in: net/[email protected]
# Fixed in: net/[email protected]
- id: GO-2025-4010
info: https://pkg.go.dev/vuln/GO-2025-4010
silence-until: 2025-12-03
silence-until: 2026-01-03
# Quadratic complexity when parsing some invalid inputs in encoding/pem
# Found in: encoding/[email protected]
# Fixed in: encoding/[email protected]
- id: GO-2025-4009
info: https://pkg.go.dev/vuln/GO-2025-4009
silence-until: 2025-12-03
silence-until: 2026-01-03
# ALPN negotiation error contains attacker controlled information in crypto/tls
# Found in: crypto/[email protected]
# Fixed in: crypto/[email protected]
- id: GO-2025-4008
info: https://pkg.go.dev/vuln/GO-2025-4008
silence-until: 2025-12-03
silence-until: 2026-01-03
# Quadratic complexity when checking name constraints in crypto/x509
# Found in: crypto/[email protected]
# Fixed in: crypto/[email protected]
- id: GO-2025-4007
info: https://pkg.go.dev/vuln/GO-2025-4007
silence-until: 2025-12-03
silence-until: 2026-01-03
# Excessive CPU consumption in ParseAddress in net/mail
# Found in: net/[email protected]
# Fixed in: net/[email protected]
- id: GO-2025-4006
info: https://pkg.go.dev/vuln/GO-2025-4006
silence-until: 2025-12-03
silence-until: 2026-01-03
# Excessive resource consumption when printing error string for host certificate validation in crypto/x509
# Found in: crypto/[email protected]
# Fixed in: crypto/[email protected]
- id: GO-2025-4155
info: https://pkg.go.dev/vuln/GO-2025-4155
silence-until: 2026-01-03
Comment on lines +50 to +55
Copy link

@coderabbitai coderabbitai bot Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

GO-2025-4155 golang vulnerability crypto/x509

💡 Result:

Summary: GO-2025-4155 (CVE-2025-61729) is an excessive-resource-consumption bug in crypto/x509: HostnameError.Error() could print an unbounded number of hosts using repeated string concatenation (quadratic runtime), allowing a malicious certificate to cause high CPU/memory use. Fixes limit the number of hosts and use strings.Builder. [1][2]

Affected Go releases:

  • All 1.24.x before 1.24.11; all 1.25.x before 1.25.5. [1]

Fixed in:

  • go1.24.11 and go1.25.5 (upgrade to these or later). [1][2]

References:

  • OSV / GO-2025-4155 (alias CVE-2025-61729). [1]
  • Go issue tracking & description (issue #76445). [2]
  • Fix CL in the Go repo. [3]

If you want, I can provide exact upgrade commands for your platform or scan a go.mod to show whether your codebase is affected.

🏁 Script executed:

# Check if GO-2025-4155 appears elsewhere in the file
rg "GO-2025-4155" .govulncheck.yaml

# Also verify the file structure and list all vulnerability IDs
rg "^\s*- id: GO-" .govulncheck.yaml

Repository: codeready-toolchain/host-operator

Length of output: 210

🏁 Script executed:

# Attempt to read the .govulncheck.yaml file directly without cloning
cat .govulncheck.yaml | rg "GO-2025-4155"

Repository: codeready-toolchain/host-operator

Length of output: 210

🏁 Script executed:

# Try reading the file if it exists in the current context
fd "govulncheck.yaml" --exec cat {}

Repository: codeready-toolchain/host-operator

Length of output: 210

Add go1.25.5 to the fix version for GO-2025-4155.

The vulnerability GO-2025-4155 is published and legitimate (CVE-2025-61729), but the entry is incomplete. The vulnerability is fixed in both go1.24.11 and go1.25.5; the YAML should reflect both versions.

🤖 Prompt for AI Agents 
In .govulncheck.yaml around lines 50 to 55, update the GO-2025-4155 entry so its
"Fixed in" field lists both go1.24.11 and go1.25.5; modify the comment or the
value that currently says "Fixed in: crypto/[email protected]" to include ",
crypto/[email protected]" (or add a second "Fixed in" entry if your schema prefers
multiple entries) so the YAML accurately reflects both fix versions for
CVE-2025-61729.

# Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
# Found in: crypto/[email protected]
# Fixed in: crypto/[email protected]
- id: GO-2025-4175
info: https://pkg.go.dev/vuln/GO-2025-4175
silence-until: 2026-01-03
Comment on lines +56 to +61
Copy link

@coderabbitai coderabbitai bot Dec 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

GO-2025-4175 Go vulnerability crypto/x509 DNS name constraints

💡 Result:

Summary: GO-2025-4175 (CVE-2025-61727) is a crypto/x509 bug where an excluded DNS name constraint in a certificate chain does not stop a leaf certificate from using a wildcard SAN (e.g., excluding test.example.com doesn’t block a leaf with SAN *.example.com). This can allow acceptance of certificates that should have been excluded. [1][2]

Affected Go versions:

  • All releases before Go 1.24.11 (i.e., < 1.24.11).
  • Go 1.25.0 through < 1.25.5. [1]

Fixes / Mitigation:

  • Upgrade to Go 1.24.11 or Go 1.25.5 (these releases include the fix). [1][3]

References:

  • Go vulnerability entry (GO-2025-4175 / pkg.go.dev). [1]
  • Go issue discussing the bug (Issue #76442). [2]
  • Gerrit CL with the fix. [3]

GO-2025-4175 is a legitimate vulnerability, but the entry is incomplete.

The vulnerability is verified as a real, published Go security issue (CVE-2025-61727) affecting crypto/x509 DNS name constraint validation with wildcard names. However, the entry only documents the fix for Go 1.24.11 and omits that this vulnerability also affects Go 1.25.0–1.25.4 and is fixed in Go 1.25.5. Update the entry to reflect all affected versions and fix versions for completeness.

🤖 Prompt for AI Agents 
.govulncheck.yaml lines 56-61: the GO-2025-4175 entry is incomplete — update its
metadata to list all affected and fixed Go versions. Edit the entry to indicate
the vulnerability affects crypto/x509 in Go 1.23.12 and also Go 1.25.0–1.25.4,
and add the corresponding fix versions Go 1.24.11 and Go 1.25.5 (or merge into a
single affected/fixed field as project conventions require); ensure the info URL
remains and adjust the silence-until date only if policy requires.

Loading