fix(deps): clear the go-git advisories blocking every PR, and pin the toolchain - #287
Merged
Conversation
… toolchain govulncheck has been failing on every open pull request since GO-2026-6213 and GO-2026-6214 were published — both in go-git v6.0.0-alpha.4, both reachable from cmd/inforge/stack.go:217 where ephemeralWorkspace calls auto.NewLocalWorkspace, which reaches dotgit ref handling and worktree checkout. main's last CI run predates the advisories, so main looks green while nothing can merge: Dependabot #286 fails bulwark and therefore PR Gate, and so does everything else open. go-git is an indirect dependency via Pulumi's Automation API, so the bump is explicit: alpha.4 -> alpha.5, which carries go-billy to alpha.2 and x/net to v0.57.0. Build and the full suite pass on it. The toolchain pin is here rather than in a tidy-up of its own because it is the same failure in a different form. go.mod asked for 1.25.11 while five workflow steps pinned 1.26.6, and govulncheck reports against whichever Go actually builds — five of the vulnerabilities it finds locally are standard library issues fixed in 1.26.6, invisible in CI only because CI happens to pin the newer one. Dependabot updates neither number, so the two drift silently and the gap is a security question rather than a tidiness one. Stating it once in go.mod lets every workflow read it through setup-go's go-version-file, which the CI migration then depends on: without a toolchain line, go-version-file resolves to 1.25.11 and would quietly downgrade CI. Verified with bulwark v2.0.0: gosec, govulncheck and semgrep all pass, "no vulnerabilities found".
pedromvgomes
added a commit
that referenced
this pull request
Aug 22, 2026
The governance PR added the gt workflows but left ci.yml in place, so
ci-gate went green on a pipeline that ran nothing. This moves the work.
ci.yml's four jobs land as follows:
- lint -> ci-build, as its own job. gt's stage vocabulary is
preflight/build/test/end2end with no lint stage, and lint is not a test.
Keeping it a separate job inside ci-build preserves the parallelism it
had. bulwark does NOT make it redundant: bulwark runs gosec and
govulncheck, not golangci-lint, so dropping it would lose real coverage.
- build-test splits. `go build ./...` joins ci-build; `go test -race
-coverprofile` and the artifact upload become ci-test.
- bulwark is deleted, and bulwark.enabled comes out of .gt-repo.yaml so
gt's own stage takes over. The override existed because this repository
hand-rolled the job gt could not generically reproduce — that is no
longer true once the pipeline is gt's. gt's version also names its
secrets rather than inheriting them, which is what works across owners.
- pr-gate is deleted; ci-gate is its replacement, and the ruleset's
required context has to move with it — "PR Gate" stops existing the
moment this merges.
The coverage artifact is renamed coverage-out -> gt-coverage. That exact
name is the contract gt's bulwark stage consumes; it mirrors the artifact's
tree into the scan root, and a single module rooted here means one
coverage.out at the top level lands where bulwark already looks.
.bulwark.yml already declares coverage.source: report, so this keeps the
one-test-run property ci.yml was built for.
Every setup-go now reads go-version-file: go.mod, in release.yml as well as
the new stages, so the toolchain is stated once. That depends on the
toolchain line added by #287 — without it go-version-file resolves to
1.25.11 and silently downgrades CI from 1.26.6.
The README's CI badge pointed at ci.yml and would have gone blank; it now
points at ci-orchestration.yml.
Re-synced with gt 1.3.0 first as its own step; `gt repo config` was
byte-identical across it apart from the version stamp.
|
pedromvgomes
added a commit
that referenced
this pull request
Aug 22, 2026
The governance PR added the gt workflows but left ci.yml in place, so
ci-gate went green on a pipeline that ran nothing. This moves the work.
ci.yml's four jobs land as follows:
- lint -> ci-build, as its own job. gt's stage vocabulary is
preflight/build/test/end2end with no lint stage, and lint is not a test.
Keeping it a separate job inside ci-build preserves the parallelism it
had. bulwark does NOT make it redundant: bulwark runs gosec and
govulncheck, not golangci-lint, so dropping it would lose real coverage.
- build-test splits. `go build ./...` joins ci-build; `go test -race
-coverprofile` and the artifact upload become ci-test.
- bulwark is deleted, and bulwark.enabled comes out of .gt-repo.yaml so
gt's own stage takes over. The override existed because this repository
hand-rolled the job gt could not generically reproduce — that is no
longer true once the pipeline is gt's. gt's version also names its
secrets rather than inheriting them, which is what works across owners.
- pr-gate is deleted; ci-gate is its replacement, and the ruleset's
required context has to move with it — "PR Gate" stops existing the
moment this merges.
The coverage artifact is renamed coverage-out -> gt-coverage. That exact
name is the contract gt's bulwark stage consumes; it mirrors the artifact's
tree into the scan root, and a single module rooted here means one
coverage.out at the top level lands where bulwark already looks.
.bulwark.yml already declares coverage.source: report, so this keeps the
one-test-run property ci.yml was built for.
Every setup-go now reads go-version-file: go.mod, in release.yml as well as
the new stages, so the toolchain is stated once. That depends on the
toolchain line added by #287 — without it go-version-file resolves to
1.25.11 and silently downgrades CI from 1.26.6.
The README's CI badge pointed at ci.yml and would have gone blank; it now
points at ci-orchestration.yml.
Re-synced with gt 1.3.0 first as its own step; `gt repo config` was
byte-identical across it apart from the version stamp.
pedromvgomes
added a commit
that referenced
this pull request
Aug 22, 2026
The governance PR added the gt workflows but left ci.yml in place, so
ci-gate went green on a pipeline that ran nothing. This moves the work.
ci.yml's four jobs land as follows:
- lint -> ci-build, as its own job. gt's stage vocabulary is
preflight/build/test/end2end with no lint stage, and lint is not a test.
Keeping it a separate job inside ci-build preserves the parallelism it
had. bulwark does NOT make it redundant: bulwark runs gosec and
govulncheck, not golangci-lint, so dropping it would lose real coverage.
- build-test splits. `go build ./...` joins ci-build; `go test -race
-coverprofile` and the artifact upload become ci-test.
- bulwark is deleted, and bulwark.enabled comes out of .gt-repo.yaml so
gt's own stage takes over. The override existed because this repository
hand-rolled the job gt could not generically reproduce — that is no
longer true once the pipeline is gt's. gt's version also names its
secrets rather than inheriting them, which is what works across owners.
- pr-gate is deleted; ci-gate is its replacement, and the ruleset's
required context has to move with it — "PR Gate" stops existing the
moment this merges.
The coverage artifact is renamed coverage-out -> gt-coverage. That exact
name is the contract gt's bulwark stage consumes; it mirrors the artifact's
tree into the scan root, and a single module rooted here means one
coverage.out at the top level lands where bulwark already looks.
.bulwark.yml already declares coverage.source: report, so this keeps the
one-test-run property ci.yml was built for.
Every setup-go now reads go-version-file: go.mod, in release.yml as well as
the new stages, so the toolchain is stated once. That depends on the
toolchain line added by #287 — without it go-version-file resolves to
1.25.11 and silently downgrades CI from 1.26.6.
The README's CI badge pointed at ci.yml and would have gone blank; it now
points at ci-orchestration.yml.
Re-synced with gt 1.3.0 first as its own step; `gt repo config` was
byte-identical across it apart from the version stamp.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every open pull request in this repository is currently red.
govulncheckfails onGO-2026-6213andGO-2026-6214, both ingo-git v6.0.0-alpha.4, and both reachable fromcmd/inforge/stack.go:217—ephemeralWorkspace→auto.NewLocalWorkspace→dotgitref handling and worktree checkout.mainlooks green because its last CI run was 2026-08-16, before the advisories were published. Dependabot #286 failsbulwark→PR Gate; so does everything else open.The bump
go-git is indirect via Pulumi's Automation API, so it is bumped explicitly:
alpha.4→alpha.5, carryinggo-billytoalpha.2andx/nettov0.57.0. Build and the full test suite pass.Why the toolchain pin rides along
Same failure, different form.
go.modasked for 1.25.11 while five workflow steps pinned 1.26.6, andgovulncheckreports against whichever Go actually builds. Five of the vulnerabilities it finds locally are standard-library issues fixed in 1.26.6 — invisible in CI only because CI happens to pin the newer one. Dependabot updates neither number, so the two drift silently, and the gap is a security question rather than a tidiness one.Stating it once in
go.modalso unblocks the CI migration (#278), which moves every workflow ontosetup-go'sgo-version-file. Without atoolchainline that resolves to 1.25.11 and would quietly downgrade CI.Verification
bulwark v2.0.0, diff-scoped:
Merging this should turn the 12 open Dependabot PRs and #279 green again.