From 76e1cab21d7feeebdbda035562984a9847577977 Mon Sep 17 00:00:00 2001 From: Joshua Temple Date: Sat, 4 Jul 2026 15:34:28 -0400 Subject: [PATCH] fix(security): build with go1.26.4 to clear stdlib advisories Pin the toolchain to go1.26.4 in both the root and e2e modules and drive every CI Go setup from the module files, so builds use the patched standard library. This closes the two reachable govulncheck stdlib advisories GO-2026-5039 (net/textproto) and GO-2026-5037 (crypto/x509), both fixed in go1.26.4. Add a govulncheck job to the validation gate so a reachable standard library advisory fails CI going forward. Update the docs prerequisites and release-verification steps to the new toolchain floor. Signed-off-by: Joshua Temple --- .github/workflows/act-image-repin.yml | 2 +- .github/workflows/build-cli.yaml | 2 +- .github/workflows/nightly-release.yaml | 2 +- .github/workflows/pr.yaml | 6 +++--- .github/workflows/release.yaml | 4 ++-- .github/workflows/validate.yaml | 20 +++++++++++++++++--- docs/release-verification.md | 2 +- docs/src/content/docs/adoption.md | 2 +- docs/src/content/docs/getting-started.md | 2 +- e2e/go.mod | 2 ++ go.mod | 2 ++ 11 files changed, 32 insertions(+), 14 deletions(-) diff --git a/.github/workflows/act-image-repin.yml b/.github/workflows/act-image-repin.yml index 5bb03db8..7048d89a 100644 --- a/.github/workflows/act-image-repin.yml +++ b/.github/workflows/act-image-repin.yml @@ -103,7 +103,7 @@ jobs: if: steps.resolve.outputs.changed == 'true' uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: "1.25" + go-version-file: e2e/go.mod - name: Verify e2e module builds if: steps.resolve.outputs.changed == 'true' diff --git a/.github/workflows/build-cli.yaml b/.github/workflows/build-cli.yaml index 8b61ceec..e6e9525e 100644 --- a/.github/workflows/build-cli.yaml +++ b/.github/workflows/build-cli.yaml @@ -27,7 +27,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true - name: Build binary diff --git a/.github/workflows/nightly-release.yaml b/.github/workflows/nightly-release.yaml index c78b8cf4..17f3c0c8 100644 --- a/.github/workflows/nightly-release.yaml +++ b/.github/workflows/nightly-release.yaml @@ -205,7 +205,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 if: github.event.inputs.dry_run == 'true' with: - go-version: "1.25" + go-version-file: go.mod - name: Compute candidate version (dry run) id: version diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 72cdac7c..a24228da 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -53,7 +53,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true - name: Run unit tests @@ -89,7 +89,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true - name: Run golangci-lint @@ -111,7 +111,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true - name: Build cascade CLI diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 44ffe212..4ff9c4d9 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -44,7 +44,7 @@ jobs: - name: Set up Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: "1.25" + go-version-file: go.mod - name: Run tests run: go test -v ./... @@ -70,7 +70,7 @@ jobs: - name: Set up Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: "1.25" + go-version-file: go.mod - name: Install cosign uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index 15e10fff..58def78a 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -41,7 +41,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true - name: Run tests @@ -73,7 +73,7 @@ jobs: - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: - go-version: '1.25' + go-version-file: go.mod cache: true - name: Run golangci-lint @@ -81,9 +81,23 @@ jobs: with: version: v2.10.1 + vuln: + name: Vulnerability Scan + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + with: + go-version-file: go.mod + cache: true + + - name: Run govulncheck + run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./... + validate: name: Validation Gate - needs: [test, lint] + needs: [test, lint, vuln] runs-on: ubuntu-latest outputs: result: ${{ steps.result.outputs.result }} diff --git a/docs/release-verification.md b/docs/release-verification.md index 6f3175d1..042f1304 100644 --- a/docs/release-verification.md +++ b/docs/release-verification.md @@ -81,7 +81,7 @@ cd cascade git checkout v0.X.Y ``` -2. Ensure Go 1.25 is installed (the version used for official releases). +2. Ensure Go 1.26.4 or newer is installed (the toolchain pinned in `go.mod` via the `toolchain` directive, used for official releases). 3. Build with the same flags used in the release workflow: diff --git a/docs/src/content/docs/adoption.md b/docs/src/content/docs/adoption.md index 40366d12..7ec361f8 100644 --- a/docs/src/content/docs/adoption.md +++ b/docs/src/content/docs/adoption.md @@ -18,7 +18,7 @@ The flow in one line: you write a manifest plus callback workflows, run `cascade - **GitHub Actions enabled** on the repository, with trunk-based development (a single primary branch). - **Conventional Commits are required.** cascade derives the semver bump, the changelog, and breaking-change detection entirely from Conventional Commit messages. This is not optional. Commits that do not follow the convention are not processed correctly and version derivation can fail. See [Versioning and schema compatibility](/cascade/versioning/). - **GitHub setup**: environments for each deploy stage, branch and tag protection, the secrets your callbacks consume, and scoped tokens. The [Security and Hardening](/cascade/security/hardening/) checklist is the authoritative list; wire it up before your first production promotion. -- The `cascade` CLI for local generation (Go 1.25+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/). +- The `cascade` CLI for local generation (Go 1.26.4+ to `go install`; in Actions, the setup action installs it for you). See [Getting Started](/cascade/getting-started/). ## Build a pipeline from scratch diff --git a/docs/src/content/docs/getting-started.md b/docs/src/content/docs/getting-started.md index 5ddba7ba..cd373da8 100644 --- a/docs/src/content/docs/getting-started.md +++ b/docs/src/content/docs/getting-started.md @@ -7,7 +7,7 @@ This guide walks through setting up `cascade` in your repository. For the big pi ## Prerequisites -- Go 1.25+ (for the CLI) +- Go 1.26.4+ (for the CLI) - A GitHub repository with Actions enabled - Trunk-based development (single primary branch) diff --git a/e2e/go.mod b/e2e/go.mod index 6afeefe8..d19d354a 100644 --- a/e2e/go.mod +++ b/e2e/go.mod @@ -2,6 +2,8 @@ module github.com/stablekernel/cascade/e2e go 1.25.0 +toolchain go1.26.4 + replace github.com/stablekernel/cascade => ../ require ( diff --git a/go.mod b/go.mod index 072196d7..5d97c2bf 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/stablekernel/cascade go 1.25 +toolchain go1.26.4 + require ( github.com/pmezard/go-difflib v1.0.0 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2