Repository navigation
Run the security and fuzz workflows on commits, and get security green again - #35
Merged
Merged
Conversation
Both workflows had a schedule. GitHub disables any workflow with a schedule after 60 days without repository activity, and a disabled workflow also skips push and pull_request. fuzz was marked disabled_inactivity and security stopped running at all, so its gates silently stopped applying to PRs. This repo can sit idle for months. security now runs on master pushes, PRs, and workflow_dispatch. fuzz runs on master pushes that touch the fuzzed parsers (or go.mod/go.sum), plus the existing workflow_dispatch for longer runs.
1.25 left Go's support window when 1.27 shipped, so 1.25.12 gets no further stdlib security fixes, and the govulncheck and gosec releases security.yml installs now require go >= 1.26. With GOTOOLCHAIN=local, CI could not install either tool, so both jobs had failed on every run since September. 1.26.10 rather than 1.27: CI builds the Wails v2.13 CLI with this toolchain, and that CLI's golang.org/x/tools v0.44 predates 1.27.
@latest silently moved both tools to releases that need a newer Go than go.mod's, and the install broke CI with no change in this repo. A pinned version installs the same tool after months idle. govulncheck v1.9.0 and gosec v2.30.0 are the current releases (both need the go 1.26 toolchain); bump them alongside go.mod's go line.
echo is indirect: Wails compiles it into its dev server only. All 12 open
Dependabot alerts on it that have a fixed release (1 critical, 4 high,
7 medium) are fixed by v4.16.1 or earlier; two medium ones have no fixed
release yet. The bump also moves golang.org/x/{crypto,net,sys,text}
forward. Every new version is older than dependabot.yml's 7-day cooldown.
The Windows dev-tag and production-tag builds vet clean, and the full
suite and burst floor pass.
npm audit failed on four high advisories (vite <= 8.1.5, postcss <= 8.5.22, source-map-js <= 1.2.1, nanoid <= 3.3.17), all in vite's toolchain. A lockfile-only fix: vite 8.1.4 -> 8.3.5 is inside package.json's ^8.1.4, and with it postcss 8.5.32, source-map-js 1.2.2, nanoid 3.3.20, and rolldown 1.2.16. Resolved with --before 7 days ago to respect dependabot.yml's cooldown (the unrestricted fix picked a vite and rolldown published the day before). npm audit now reports 0. Build output: fonts are byte-identical. The CSS differs only in how rounded-full's infinite radius is printed (3.4e38px -> 2147483647px). The agent, gateway, and wizard devmock scenarios render on the new dev server, and outside Wails the production bundle fails exactly as the old one does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
securityworkflow had stopped running entirely, and was failing whenever it did run.Why it stopped running.
security.ymlandfuzz.ymlboth had aschedule:trigger. GitHub disables any workflow with a schedule after 60 days without repository activity, and a disabled workflow skipspushandpull_requesttoo.fuzzis still markeddisabled_inactivity.securityhadn't run since Oct 26, so it never ran on #34.Why it failed. On every run since September:
govulncheck@latestandgosec@latestnow require Go ≥ 1.26, but CI installs go.mod's 1.25.12 withGOTOOLCHAIN=local, so neither tool installed.npm auditfailed on 4 high advisories in vite's toolchain.Changes
securityruns on master pushes, PRs, andworkflow_dispatch.fuzzruns on master pushes that touch the fuzzed parsers (or go.mod/go.sum), plus its existingworkflow_dispatch. Neither has a schedule any more.govulncheck@v1.9.0andgosec@v2.30.0instead of@latest.labstack/echov4.16.3. It's indirect, compiled only into Wails' dev server. This fixes the 12 open Dependabot alerts that have a fixed release (1 critical, 4 high, 7 medium); 2 medium alerts have no fixed release yet.^8.1.4), which also moves postcss, source-map-js, nanoid and rolldown. Resolved with--before7 days ago to respect the Dependabot cooldown.npm auditnow reports 0.Every new Go and npm version is older than the 7-day cooldown.
Verification
go test ./...(full suite plus burst floor) andgo veton linux and windows pass locally. Locally that's Go 1.27.3 with the go.mod line at 1.26.10; CI runs the 1.26.10 toolchain itself.dev-tag anddesktop,production-tag builds vet clean.rounded-full's infinite radius is printed. The agent, gateway and wizard devmock scenarios render on the new vite in headless Brave. Outside Wails, the production bundle fails exactly as the old one does.securityrun is the first check of govulncheck/gosec on 1.26.10.After merging
fuzzis still disabled for inactivity on GitHub's side. Re-enable it once, withgh workflow enable fuzz.ymlor from the Actions tab. Without a schedule it won't be auto-disabled again.