From d1f8cf412b4f3b54f134e1d3f37731903d094e1f Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 3 Jul 2026 21:38:04 +0100 Subject: [PATCH] Add govulncheck scan to backend CI Nothing in CI guarded against known vulnerabilities in the Go dependency tree. Add a vulncheck job that runs govulncheck over the backend module on every backend change. The version is pinned rather than tracking latest for reproducible runs. Current tree scans clean. --- .github/workflows/ci-backend.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/.github/workflows/ci-backend.yml b/.github/workflows/ci-backend.yml index 13ccab84..aa92b7c5 100644 --- a/.github/workflows/ci-backend.yml +++ b/.github/workflows/ci-backend.yml @@ -82,3 +82,34 @@ jobs: working-directory: backend env: COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + vulncheck: + name: Vulnerability scan + runs-on: ubuntu-latest + permissions: + contents: read + + steps: + - uses: actions/checkout@v7 + with: + persist-credentials: false + + - name: install go + uses: actions/setup-go@v6 + with: + go-version: "1.25" + # both go.sum files so the cache key covers the main and example modules scanned below + cache-dependency-path: | + backend/go.sum + backend/_example/memory_store/go.sum + + - name: govulncheck + run: | + go install golang.org/x/vuln/cmd/govulncheck@v1.5.0 + govulncheck ./... + (cd _example/memory_store && govulncheck ./...) + working-directory: backend + env: + # ignore the committed vendor dirs and resolve modules from the cache so + # both the main module and the nested example module scan consistently + GOFLAGS: "-mod=readonly"