Repository navigation
fix(security): build with Go 1.27.3 and require signed releases - #168
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 47d42ea66a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| repository-wide workflow lock spans preflight through publication, so queued | ||
| dispatches (including `X.Y.Z` and `vX.Y.Z`) recheck state after the previous | ||
| run finishes. The shared workflow creates an annotated version tag, builds all four native archives, signs and | ||
| run finishes. The shared workflow freezes the verified tag, builds all four native archives, signs and |
There was a problem hiding this comment.
When a live run fails before creating a draft or GitHub Release and main remains at the tagged SHA, the changed preflight now accepts the existing annotated tag and the reusable @v1 workflow reuses it as the frozen retry target. However, the recovery guidance at lines 107–110 still states that every fresh dispatch after a tag exists requires a new version. Following that guidance unnecessarily abandons a valid tagged module version; distinguish tag-only failures, which can be redispatched from the same head, from failures that already created a draft or release.
Useful? React with 👍 / 👎.
Fix GO-2026-6809, the crypto/x509 certificate-validation vulnerability reachable in a native macOS symbol-level scan with Go 1.27.2. Select Go 1.27.3 for source, downstream CI, and release builds while retaining the Go 1.27.0 language minimum.
Require fleet-signed release tags in the shared release pipeline. The read-only preflight now requires an annotated tag pointing directly to the workflow commit and still rejects existing draft/public releases; the shared pipeline verifies the signature before building and before publication. This permits the security patch to use the fleet-signed release process without weakening the release collision guard.
Validation: govulncheck v1.9.0 reports crypto/x509.Certificate.Verify as reachable before the bump and no reachable vulnerabilities afterward. Local build, Go test suite, module tidy check, and vet passed; all 48 script tests passed, including missing/lightweight/wrong-commit tag rejection and existing-release/API-error guards. Independent P0–P3 autoreview found no actionable issues. Exact-head CI must pass before merge.
The same PR prepares the next patch release with dated notes; the Unreleased section remains ready for subsequent changes. Publication follows the exact-head CI gate and a successful release dry run.