Dmitry VerkhoturovandGitHub
455d770899
govulncheck fails on master against the 1.25.12 pin with seven stdlib
advisories, all fixed in 1.25.13: GO-2026-5026, GO-2026-5972, GO-2026-6088,
GO-2026-6089, GO-2026-6090, GO-2026-6091 and GO-2026-6218, across crypto/tls,
encoding/asn1, encoding/xml, html/template, net/http and net/url.
Pinning the next patch would only move the problem to the following advisory,
as it did in 76d0cc2c. setup-go accepts a minor-only spec, so "1.25" resolves
to a patch on that line at run time. Staying on 1.25 rather than "stable"
keeps a move to a new minor a deliberate change, matching the `go 1.25.0`
directive in both go.mod files.
check-latest is required with it: by default setup-go uses the patch already
cached on the runner image, so a minor-only spec alone would keep resolving
to whatever that image ships, currently 1.25.12, and the scan would stay red.
118 lines
3.1 KiB
YAML
118 lines
3.1 KiB
YAML
name: backend
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
tags:
|
|
paths:
|
|
- ".github/workflows/ci-backend.yml"
|
|
- "backend/**"
|
|
- "Dockerfile"
|
|
- "docker-init.sh"
|
|
- ".dockerignore"
|
|
- "!backend/scripts/**"
|
|
- "!**.md"
|
|
pull_request:
|
|
paths:
|
|
- ".github/workflows/ci-backend.yml"
|
|
- "backend/**"
|
|
- "Dockerfile"
|
|
- "docker-init.sh"
|
|
- ".dockerignore"
|
|
- "!backend/scripts/**"
|
|
- "!**.md"
|
|
|
|
jobs:
|
|
test:
|
|
name: Test & Coverage
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: debug if needed
|
|
run: if [[ "$DEBUG" == "true" ]]; then env; fi
|
|
env:
|
|
DEBUG: ${{secrets.DEBUG}}
|
|
|
|
- name: install go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25"
|
|
check-latest: true
|
|
cache-dependency-path: backend
|
|
|
|
- name: test and build backend
|
|
run: |
|
|
go test -race -timeout=60s -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov_tmp ./...
|
|
cat $GITHUB_WORKSPACE/profile.cov_tmp | grep -v "_mock.go" > $GITHUB_WORKSPACE/profile.cov
|
|
go build -race ./...
|
|
working-directory: backend/app
|
|
env:
|
|
TZ: "America/Chicago"
|
|
|
|
- name: test examples
|
|
run: |
|
|
go test -race ./...
|
|
go build -race ./...
|
|
working-directory: backend/_example/memory_store
|
|
env:
|
|
TZ: "America/Chicago"
|
|
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: "v2.10.1"
|
|
working-directory: backend/app
|
|
|
|
- name: golangci-lint on example directory
|
|
uses: golangci/golangci-lint-action@v9
|
|
with:
|
|
version: "v2.10.1"
|
|
args: --config ../../.golangci.yml
|
|
working-directory: backend/_example/memory_store
|
|
|
|
- name: submit coverage
|
|
run: |
|
|
go install github.com/mattn/goveralls@latest
|
|
goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov
|
|
working-directory: backend
|
|
env:
|
|
COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
vulncheck:
|
|
name: Vulnerability scan
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: install go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version: "1.25"
|
|
check-latest: true
|
|
# both go.sum files so the cache key covers the main and example modules scanned below
|
|
cache-dependency-path: |
|
|
backend/go.sum
|
|
backend/_example/memory_store/go.sum
|
|
|
|
- name: govulncheck
|
|
run: |
|
|
go install golang.org/x/vuln/cmd/govulncheck@v1.5.0
|
|
govulncheck ./...
|
|
(cd _example/memory_store && govulncheck ./...)
|
|
working-directory: backend
|
|
env:
|
|
# ignore the committed vendor dirs and resolve modules from the cache so
|
|
# both the main module and the nested example module scan consistently
|
|
GOFLAGS: "-mod=readonly"
|