fix(httputil): CR/LF log sanitizer barrier (CodeQL #5/#6) + .trivyignore refresh #134
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Pull-request validation for the public repository. | |
| # GitHub Actions minutes are free for public repositories, so contributor PRs | |
| # get fast lint/test/build feedback here. Heavy release engineering | |
| # (multi-arch images, signing, deploy) runs on GitLab after merge. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| name: Lint & Vet | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: gofmt | |
| run: | | |
| unformatted=$(gofmt -l .) | |
| if [ -n "$unformatted" ]; then | |
| echo "::error::These files are not gofmt-formatted:" | |
| echo "$unformatted" | |
| exit 1 | |
| fi | |
| - name: go vet | |
| run: go vet ./... | |
| - name: golangci-lint | |
| run: | | |
| # Install golangci-lint from source so it is compiled with the same | |
| # Go toolchain as the module's go directive (go.mod). The prebuilt | |
| # binaries shipped by golangci-lint-action are built with an older Go | |
| # and refuse to run against a newer target version. Mirrors the | |
| # GitLab lint job, which installs golangci-lint the same way. | |
| go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest | |
| golangci-lint run --config .golangci.yml --timeout 5m | |
| test: | |
| name: Test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: go test | |
| run: go test -race -coverprofile=coverage.out ./... | |
| build: | |
| name: Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: go build | |
| run: go build ./... | |
| govulncheck: | |
| name: Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| # govulncheck has no built-in suppression mechanism. This wrapper | |
| # passes when ONLY known-unfixed vulnerabilities are present and | |
| # fails on anything new. Mirrors the GitLab security:govulncheck job. | |
| # Known unfixed (github.com/docker/docker SDK — no fix in v28.x): | |
| # GO-2026-4883, GO-2026-4887, GO-2026-5617, GO-2026-5668, | |
| # GO-2026-5746 — Moby daemon vulns (docker cp, container archive, | |
| # plugin/AuthZ). dnsweaver uses the SDK only as a read-only client | |
| # and runs no daemon, so these paths are unreachable. No stable fix | |
| # in the docker/docker +incompatible module (v29 is pre-release | |
| # moby/v2). Tracked/dismissed in GitHub Dependabot. | |
| KNOWN_VULNS="GO-2026-4883|GO-2026-4887|GO-2026-5617|GO-2026-5668|GO-2026-5746" | |
| RC=0 | |
| govulncheck ./... > govulncheck.txt 2>&1 || RC=$? | |
| cat govulncheck.txt | |
| if [ "$RC" -eq 0 ]; then | |
| echo "No vulnerabilities found" | |
| exit 0 | |
| fi | |
| FOUND=$(grep -oE 'GO-[0-9]+-[0-9]+' govulncheck.txt | sort -u) | |
| UNKNOWN=$(echo "$FOUND" | grep -vE "^($KNOWN_VULNS)$" || true) | |
| if [ -n "$UNKNOWN" ]; then | |
| echo "::error::New vulnerabilities found: $UNKNOWN" | |
| exit 1 | |
| fi | |
| echo "::warning::Only known-unfixed vulnerabilities found (docker/docker SDK, no upstream fix): $FOUND" |