Repository navigation
ci: build with Go 1.27.2 and take x/net v0.60.0, so the Vulnerability Check passes again - #110
Conversation
… Check passes again
FumingPower3925
added
security
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
⛔ Files ignored due to path filters (2)
📒 Files selected for processing (7)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (1)
🧰 Additional context used📓 Path-based instructions (2)A nested module that pins its own celeris and is spawned as a subprocess by the integration tests.⚙️ CodeRabbit configuration file Files:
Every uses: is pinned to a full commit SHA with a version comment (the repository requires SHA pinning).⚙️ CodeRabbit configuration file Files:
🔇 Additional comments (7)
📝 SummarySummary by CodeRabbit
WalkthroughCI workflows now use Go 1.27.2, and the Lint job uses golangci-lint v2.14. Contributor prerequisites and module dependency versions are also updated. ChangesVersion updates
Priority: ➖ Normal Estimated code review effort: 2 (Simple) | ~10 minutes Change: Other Suggested labels: Merge Risk: ⚪ Minimal · up to The toolchain updates match the documented prerequisites. The observed test failure reflects loopback networking unavailable in the inspection environment, not an established regression from this change; no concrete merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Merging this PR will degrade performance by 40.45%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ❌ | 1024workers |
8.6 µs | 14.4 µs | -40.45% |
Tip
Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.
Comparing ci/go-1.27.2-toolchain-loadgen (06d5941) with main (b6c0280)
|
CodSpeed reports one regressed benchmark (-40.45%) with its own warning "Different runtime environments detected": this PR changes the Go toolchain the benchmarks are built with (1.27.0 to 1.27.2), so the comparison against main's baseline mixes toolchains. The same check swung 21x on identical code earlier (loadgen#109), and it is advisory (not a required check). Every required check is green on this head; merging so the Vulnerability Check passes again. If the next main run still shows the benchmark moving on the new baseline, that is a real signal and loadgen#109 is where it gets looked at. |
The
Vulnerability Checkjob goes red on main's next CI run and on any PR, because Go advisories published after the last green runs now apply to what CI builds with (Go 1.27.0) and to thegolang.org/x/netthe testserver module pins.What
govulnchecksays on main (b6c0280), as CI runs itPinned scanner
govulncheck@v1.8.0,GOTOOLCHAIN=go1.27.0,govulncheck ./...in the two modules the job scans:internal/integrationtest/testserver: exit 3, 5 findings: GO-2026-6613 (net/http, standard library) and GO-2026-6603, -6611, -6612, -6617 (reached throughgolang.org/x/net@v0.58.0and the standard library's bundled http2).What this changes
Every
go-version: "1.27.0"in.github/workflows/*.ymlbecomes"1.27.2"(8 lines in 4 files). Thegodirectives in thego.modfiles stay at 1.27.0, so the minimum Go for consumers does not change.golang.org/x/netv0.58.0 to v0.60.0 ininternal/integrationtest/testserver(indirect;x/sysv0.47.0 to v0.48.0 andx/textv0.41.0 to v0.42.0 follow by minimum version selection).golang.org/x/netv0.59.0 to v0.60.0 in the root module (direct). The root scan was already clean on call reachability under 1.27.2, but v0.59.0 is in the advisory range at module level, so it is taken here too.golangci-lintv2.13 to v2.14 in theLintjob. With Go 1.27.2 the prebuilt v2.13.2 binary (built with go1.27.0) fails typecheck on every stdlib import (export data version 5 is greater than maximum supported version 4); v2.14.0 (also built with go1.27.0) reads 1.27.2 export data and reports 0 issues on this repo (checked locally, both versions,GOTOOLCHAIN=go1.27.2; v2.13.2 on go1.27.0 is also clean). CONTRIBUTING.md follows (golangci-lint v2.14+, CI builds with 1.27.2).Evidence (this branch,
GOTOOLCHAIN=go1.27.2,govulncheck@v1.8.0)govulncheck ./..., exit 0, "No vulnerabilities found": root module, andinternal/integrationtest/testserver.go build ./...andgo vet ./...pass in both modules;go mod verifypasses in both..github/tools(not scanned by CI; it only holds atooldirective):govulncheck github.com/rhysd/actionlint/cmd/actionlintexits 0, 0 called vulnerabilities.Refs goceleris/celeris#957 (same fix for celeris).