From 53afd9890ffe18d8d97ec70b63c13018022bf774 Mon Sep 17 00:00:00 2001 From: Lukasz Raczylo Date: Tue, 15 Sep 2026 11:34:33 +0100 Subject: [PATCH] ci: pin govulncheck to v1.7.0 govulncheck@latest resolves to v1.8.0, which declares go 1.26.0 in its module file. Every job in this workflow pins go-version 1.25.x, so the install step fails before any scanning runs, which fails ci-success and skips the release job. v1.7.0 declares go 1.25.0 and installs on the pinned toolchain. This also matches the convention used for staticcheck, which is already pinned to an exact version. Pinning the binary does not freeze the vulnerability database, which govulncheck fetches at run time. Claude-Session: https://claude.ai/code/session_01Fu2wXqGUrfVBi5aLafKk8U --- .github/workflows/ci.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fd2edd1..849a70e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -69,7 +69,13 @@ jobs: ~/go/pkg/mod ~/.cache/go-build key: ${{ runner.os }}-go-1.25-${{ hashFiles('**/go.sum') }} - - run: go install golang.org/x/vuln/cmd/govulncheck@latest + # Pinned, matching staticcheck above. govulncheck@latest is v1.8.0, + # which declares go 1.26.0 and therefore cannot be installed by the + # 1.25.x toolchain this workflow pins - the install step fails before + # any scanning happens. v1.7.0 declares go 1.25.0. Pinning the binary + # does not freeze the vulnerability database, which govulncheck + # fetches at run time. Re-pin deliberately when bumping go-version. + - run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0 - run: govulncheck ./... gosec: