Repository navigation
Conversation
To be able to detect known vulnerabilities reachable from the repository's Go code, add a vulncheck target that runs govulncheck over all Go packages. The tool is pinned (currently v1.9.0) and downloaded to ./bin/ by the existing go-install-tool machinery, so the version stays out of go.mod. The scan fetches the Go vulnerability database on demand and therefore needs network access. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
govulncheck reports five vulnerabilities reachable from this repository's code, all in golang.org/x/net v0.59.0 and fixed in v0.60.0: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (HTTP/2 flow control, HPACK and header handling issues). Bump to the minimum version that fixes them so the vulnerability check can be enforced in CI without any existing finding to waive. Two further findings in x/net/html (GO-2026-6860 and GO-2026-6866) are not reachable from this code and stay informational; they do not fail the check. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
Run make vulncheck as a dedicated step in the unit job so pull requests fail when a known vulnerability is reachable from the repository's Go code. It is a separate step rather than part of make lint so the two checks can be run and diagnosed independently, and it reuses the Makefile target instead of duplicating the invocation. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
Describe the new target in CONTRIBUTING.md: what it scans, that it downloads both the govulncheck binary and the Go vulnerability database and so needs network access, and how to interpret its output. Only findings in functions the code actually calls fail the check; findings in imported packages or required modules that are not called are informational. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
Every internal package lacked a package comment, which staticcheck's ST1000 check flags. Add a short one to each so the full staticcheck suite can be enabled. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
The pool status counts are int32 in the API but computed from int slice lengths, and the bare conversion would silently wrap on overflow (gosec G115). Node counts can't realistically get there, but a saturating conversion makes the intent explicit and keeps the linter quiet without a suppression. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
collectDrainResults dropped finished drains from r.drains without calling their cancel func, which is only invoked when a node leaves the pool. Each drain context derives from the reconcile context, which has no deadline, so every completed or failed drain stayed registered with the long-lived parent until the process exited. Cancel the context when the result is collected, after checking whether it was cancelled so the existing cancellation handling still works. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
Prepare for enabling gosec by resolving its findings outside the e2e
suite:
- Tighten directory permissions in watcher tests to 0750 (G301).
- Annotate the remaining reports as false positives, each with the
reason:
- G204: nsenter callers pass fixed program names, and the only
external input is a validated, digested image reference; nothing
goes through a shell.
- G118 (drain): the cancel func is stored in r.drains and called
when the drain is collected.
- G118 (staging): staging intentionally outlives the reconcile, and
its parentless context cannot leak.
- G301: /run/ostree on the host keeps the conventional 0755 mode.
Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
Without a config file golangci-lint runs only its standard linters, and staticcheck runs without the stylistic checks golangci-lint disables by default (package comments, naming, receiver and doc comment consistency). Add .golangci.yml to keep the standard set, enable all staticcheck checks, and add gosec for security issues. gosec is excluded from test/e2e, which intentionally drives kubectl, helm and bink with computed arguments. Because make lint already runs in CI, this needs no workflow change. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
CI installs the Go version named by the go directive in go.mod, so the vulnerability check ran against Go 1.26.0 and reported ten standard library vulnerabilities reachable from this repository's code, in net/http, net/textproto, crypto/tls and crypto/x509 (GO-2026-6603 through GO-2026-6809). They are fixed in Go 1.26.9 and 1.26.10. Raise the minimum to 1.26.10, the first release that fixes all of them, so CI builds and scans with a patched toolchain. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add govulncheck, stricter static analysis and gosec
Fixes: #269