build: switch to toolchain-cicd/govulncheck-action #1190
Conversation
WalkthroughReplaces the govulncheck GitHub Action with codeready-toolchain/toolchain-cicd/govulncheck-action@master, switches to file-based configuration using go.mod and .govulncheck.yaml, disables caching, and adds a new .govulncheck.yaml that lists three ignored vulnerabilities with silence-until dates and reference links. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (7)
.govulncheck.yaml (3)
17-17: Fix duplicated word in comment."Fixed in: Fixed in:" → "Fixed in:".
Apply:
- # Fixed in: Fixed in: net/http@go1.23.10 + # Fixed in: net/http@go1.23.10
18-20: Keep field order consistent across entries.Use the same key order as earlier items (id, silence-until, info).
- - id: GO-2025-3751 - info: https://pkg.go.dev/vuln/GO-2025-3751 - silence-until: 2025-10-02 + - id: GO-2025-3751 + silence-until: 2025-10-02 + info: https://pkg.go.dev/vuln/GO-2025-3751
1-20: Add missing newline at end of file.Fixes YAML lint error.
- id: GO-2025-3751 silence-until: 2025-10-02 info: https://pkg.go.dev/vuln/GO-2025-3751 +.github/workflows/govulncheck.yml (4)
22-26: Add minimal token permissions (defense-in-depth).Limit GITHUB_TOKEN scope for this job.
govulncheck: name: govulncheck runs-on: ubuntu-24.04 + permissions: + contents: read
22-26: Consider scheduled runs to catch new vulns outside PRs.Add a weekly schedule on master.
on: pull_request: branches: - master + schedule: + - cron: '0 3 * * 1'
26-26: Add missing newline at end of file.Fixes YAML lint error.
- config: .govulncheck.yaml + config: .govulncheck.yaml +
24-26: Remove redundant setup-go and enable caching
- govulncheck-action automatically installs Go based on
go-version-file, so you can remove the precedingactions/setup-gostep to avoid duplicate installs. (github.com)- The
cacheinput defaults to true; consider settingcache: trueto speed up subsequent CI runs without sacrificing reproducibility. (go.googlesource.com)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/govulncheck.yml(1 hunks).govulncheck.yaml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.govulncheck.yaml
[error] 20-20: no new line character at the end of file
(new-line-at-end-of-file)
.github/workflows/govulncheck.yml
[error] 26-26: no new line character at the end of file
(new-line-at-end-of-file)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Build & push operator bundles for e2e tests
- GitHub Check: Build & push Developer Sandbox UI image for UI e2e tests
🔇 Additional comments (2)
.govulncheck.yaml (1)
6-20: Confirm external action schema and Go version
- No local
govulncheck-actiondirectory in this repo; verify that the external codeready-toolchain/toolchain-cicdgovulncheck-actionsupports anignored-vulnerabilitieslist with fieldsid,silence-until(YYYY-MM-DD) andinfo.- go.mod uses Go 1.22.0, which is below the fixed versions for GO-2025-3563 (1.23.8), GO-2025-3750 and GO-2025-3751 (1.23.10), so these silences are justified.
.github/workflows/govulncheck.yml (1)
22-22: Pin action to a tag or commit SHA (avoid @master).Reduces supply-chain risk and unexpected breakages.
- uses: codeready-toolchain/toolchain-cicd/govulncheck-action@master + # Pin to a released tag or commit SHA + uses: codeready-toolchain/toolchain-cicd/govulncheck-action@<tag-or-sha>⛔ Skipped due to learnings
Learnt from: rsoaresd PR: codeready-toolchain/toolchain-e2e#1181 File: .github/workflows/publish-sandbox-ui-for-ui-e2e-tests.yml:70-71 Timestamp: 2025-08-05T11:01:26.390Z Learning: For codeready-toolchain organization repositories, the team prefers to use master branch references for their internal toolchain-cicd actions rather than pinning to specific commit SHAs, prioritizing ease of maintenance and automatic updates over the additional security of version pinning.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fbm3307, rsoaresd, xcoulon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/retest flaky test |
|
3 participants
Description
Currently, we only have our custom govulncheck-action enabled on wa, host-operator, member-operator, and registration-service. We need to enable it in the other repos (toolchain-e2e, toolchain-common, ...)
Why are we using our custom
toolchain-cicd/govulncheck-action?Unfortunately, govulncheck does not have a feature for ignoring the vulns. There is a feature request, but we do not know when it will be addressed. To avoid govulncheck failing in PRs, we implemented a workaround on toolchain-cicd to ignore vulnerabilities that do not have a fix available or require a higher Go version than we have.
Related PRs
codeready-toolchain/toolchain-common#490
codeready-toolchain/api#483
kubesaw/ksctl#122
Issue ticket number and link
SANDBOX-1401
Summary by CodeRabbit