Repository navigation
fix(security): require a patched Go scaffold floor - #412
Conversation
@coderabbitai full review |
✅ Action performedFull review finished. |
The new regression suite failed against the original independent ratchet because it accepted the old compiler floor. It now passes 11 controls, including rejection of 1.26.0/1.26.9 and malformed/extra-token directives, acceptance of 1.26.10 and later versions, and trailing-comment compatibility. Local validation with Go 1.26.10 passes: configured formatting, build, package tests, golangci-lint (zero issues), renamed-scaffold build/tests, canonical agent shims, the actual floor check and mockery-hook fixtures. Workflow syntax, ShellCheck, whitespace and the exact released shell-pipeline validator pass, including all eight tracked shell files. The TODO scanner fixture join passes against the exact unchanged consumer-pinned 25f1dda catalogue checkout. Its Linux/Docker replay remains a native CI requirement; it was not claimed as locally executed. The existing deprecated-linter warning remains tracked in #399. The module declaration remains the sole toolchain selection source; the ratchet is an independently hard-coded lower bound, not a second toolchain pin. This does not assert that every later host toolchain is patched: the 1.27 branch separately requires 1.27.3 per the upstream advisory. No vulnerability scan is disabled or suppressed. Applied-rule readback confirms required Go validation comes from repository ID 933213756 (the maintained catalogue), matching the factual documentation correction. No authorization or agent behavior policy is broadened, and no heavy Go jobs are added to the trivial aggregator. Current-head full native selected Go jobs, substantive review, protected merge and post-merge evidence remain required. |
Code coverage overviewLanguages: Go Go / code-coverage/go
Line coverage data for the main branch is not yet available. View coverage of the 3 most covered files.
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Max errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 7 | 0 | 0 | 0.08s | ||
| ✅ ACTION | zizmor | 7 | 0 | 0 | 0 | 2.24s | |
| bash-exec | 7 | 1 | 0 | 0.04s | |||
| ✅ BASH | shellcheck | 7 | 0 | 0 | 0.53s | ||
| ✅ BASH | shfmt | 7 | 0 | 0 | 0 | 0.03s | |
| ✅ COPYPASTE | jscpd | yes | no | no | 0.79s | ||
| ✅ EDITORCONFIG | editorconfig-checker | 42 | 0 | 0 | 0.13s | ||
| ✅ JSON | jsonlint | 1 | 0 | 0 | 0.17s | ||
| ✅ JSON | prettier | 1 | 0 | 0 | 0 | 0.52s | |
| ✅ JSON | v8r | 1 | 0 | 0 | 2.26s | ||
| markdownlint | 6 | 0 | 6 | 0 | 0.81s | ||
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.3s | |
| ✅ REPOSITORY | betterleaks | yes | no | no | 0.71s | ||
| ✅ REPOSITORY | checkov | yes | no | no | 25.83s | ||
| ✅ REPOSITORY | git_diff | yes | no | no | 0.02s | ||
| ✅ REPOSITORY | grype | yes | no | no | 99.45s | ||
| ✅ REPOSITORY | osv-scanner | yes | no | no | 0.46s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.2s | ||
| ✅ REPOSITORY | syft | yes | no | no | 8.81s | ||
| ✅ REPOSITORY | trivy | yes | no | no | 14.89s | ||
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.25s | ||
| ✅ REPOSITORY | trufflehog | yes | no | no | 5.13s | ||
| ✅ SPELL | lychee | 18 | 0 | 0 | 1.38s | ||
| ✅ YAML | prettier | 11 | 0 | 0 | 0 | 0.5s | |
| ✅ YAML | v8r | 11 | 0 | 0 | 7.21s | ||
| ✅ YAML | yamllint | 11 | 0 | 0 | 0.7s |
Detailed Issues
⚠️ BASH / bash-exec - 1 error
Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/10.1.0/descriptors/bash_bash_exec/
-----------------------------------------------
✅ [SUCCESS] .github/scripts/run-mockery.sh
✅ [SUCCESS] .github/scripts/run-mockery.test.sh
❌ [ERROR] .github/scripts/verify-vendored-comment-scan.sh
Error: File:[.github/scripts/verify-vendored-comment-scan.sh] is not executable
✅ [SUCCESS] scripts/go-floor.test.sh
✅ [SUCCESS] scripts/rename-placeholders.sh
✅ [SUCCESS] scripts/rename-placeholders.test.sh
✅ [SUCCESS] scripts/validate-agent-shims.test.sh
⚠️ MARKDOWN / markdownlint - 6 errors
AGENTS.md:24:401 error MD013/line-length Line length [Expected: 400; Actual: 541]
AGENTS.md:28:401 error MD013/line-length Line length [Expected: 400; Actual: 431]
AGENTS.md:32:401 error MD013/line-length Line length [Expected: 400; Actual: 521]
AGENTS.md:177:401 error MD013/line-length Line length [Expected: 400; Actual: 448]
CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
GEMINI.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "@AGENTS.md"]
See detailed reports in MegaLinter artifacts
Show us your support by starring ⭐ the repository
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ➖ Normal Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (3 skipped: 3 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
| Linked Issues check |  |
Issue #411 requires the Go 1.26.10 floor, an independent rollback ratchet, malformed-directive rejection, and regression controls. The reviewed files implement these requirements: go.mod uses 1.26.1… |
Provide reviewable evidence that the ordinary PR executes every selected Go validation job from devantler-tech/.github#237. The available evidence does not establish this requirement. |
-
Check name Status Explanation Title check The title clearly identifies the security fix: requiring a patched Go scaffold floor. It matches the primary changes. Description check The description explains the advisory-driven Go version update, rollback controls, and validation scope. It is directly related to the changeset. Out of Scope Changes check The reviewed changes are limited to the Go module floor, its enforcement and regression tests, validation workflow integration, and related documentation. These changes directly support issue #411. No…Full details: Out of Scope Changes check
-
Explanation
The reviewed changes are limited to the Go module floor, its enforcement and regression tests, validation workflow integration, and related documentation. These changes directly support issue
#411. No unrelated product feature, second toolchain pin, heavy Go job, vulnerability-check disablement, or finding suppression is shown.
-
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (3 skipped: 3 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Full details: Linked Issues check
-
Explanation
Issue
#411requires the Go 1.26.10 floor, an independent rollback ratchet, malformed-directive rejection, and regression controls. The reviewed files implement these requirements:go.moduses 1.26.10,scripts/go-floor.test.shenforces the floor, andscripts/go-floor-regression.test.shcovers 11 rejection and acceptance cases. The supplied PR evidence reports the required formatting, build, test, lint, renamed-scaffold, and shell checks as passing. However, the same evidence states that current-head native selected Go jobs remain outstanding, and it does not establish that the ordinary PR executes every selected Go validation job from the maintained catalogue. The protected-merge and post-merge items are non-coding validation activities and do not affect this coding assessment.Resolution
Provide reviewable evidence that the ordinary PR executes every selected Go validation job from
devantler-tech/.github#237. The available evidence does not establish this requirement.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e57909c9f1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Current head Ordinary required Go validation run 39542799737 is complete and successful against this exact head. Every selected job actually ran and passed: tidy, golangci-lint, dead-code analysis, vulnerability scan, MegaLinter, build, test and coverage; the signed-fix follow-up jobs also passed without moving the head. The vulnerability job's native log independently records checkout of the maintained catalogue at The native scaffold gate 39542799251 also succeeded, including the real Linux TODO replay and shell integrity gate. All reported current-head checks have settled successfully or intentionally skipped. This supplies the execution evidence missing from the earlier linked-issue assessment; it is not a canary or a no-op PR. CodeRabbit's current-hour included-review receipt reports zero remaining reviews in this repository. The normal fallback Codex review for the complete current head is running and remains a promotion prerequisite. |
@codex review |
Both current review findings are fixed in
All 16 version/format controls and the actual existing sync-exclusion assertion pass. ShellCheck, actionlint, the exact released shell-pipeline validator, build, package tests, lint (zero issues), renamed-scaffold build/tests, agent-shim and mockery fixtures also pass. The two inline threads are resolved with their fixes; no finding was deferred, suppressed or treated as covered by the previous review. The new full native validation and substantive exact-head review remain promotion prerequisites. Earlier native execution proof remains historical evidence, not a green for this new head. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0aa26ac937
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@codex review |
Addressed the selected-toolchain finding in The new runtime controls first rejected a valid patched version because no compiler-check mode existed. All 16 directive and nine selected-toolchain controls now pass. Independent local execution rejects an affected selected compiler and accepts the explicitly selected patched supported compiler. Unknown/development/empty version responses fail closed. This does not install software or alter the caller's environment. The contributor-guide correction follows the newcomer skill: explain the check, link the upstream fixed-release advisory for recovery and preserve the existing fork, license, private-reporting, signature and submission policies. This was a scoped self-review with actual check execution; no independent newcomer usability session is claimed. The earlier inline finding is resolved with the implementation. A fresh full-head review and native gates remain required; earlier passing runs are not reused as current-head evidence. |
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Current-head readiness: All 25 current-head checks have settled successfully or intentionally skipped, including every selected ordinary Go job and native scaffold validation. The actual selected-compiler check, 16 directive controls and nine compiler-version controls pass. Build/tests, vulnerability scanning, coverage and existing Linux replay/integrity gates were not replaced with a local subset. Codex completed a substantive review against this full head and reports no unresolved findings, with a current-head no-major-issues receipt. Its historical has_any_findings flag remains true because the three earlier findings were reported and fixed; all three threads are resolved with their implementations. Fresh review/body/thread readback contains no new actionable finding or maintainer request. The latest commit is the normal verified signed formatter child, changing only case formatting. It was fast-forwarded locally without discarding work and the complete 25-case regression suite was re-executed. The PR body contract passes and the live holder is this session. All readable named/workflow gates pass. The configured code-quality rule remains UNVERIFIED in the helper, not labelled COMPLETE; GitHub independently reports CLEAN/MERGEABLE and its normal protected API is authoritative for that opaque gate. Ready for promotion and protected merge. Post-merge source/default-branch checks remain required. No additional compiler preference, artificial release, weakened scan or change to existing generated repositories' ownership policy is introduced. |
Why
The starter still permits a compiler affected by a newly published certificate-verification advisory. This security correction is triggered by the upstream advisory, not a speculative compatibility bump.
What
Require the supported patched minimum and prevent rollback with independent regression controls. Keep the starter minimal and correct its description of the already-migrated validation source.
Fixes #411