jason810496 opened a new pull request, #70915: URL: https://github.com/apache/airflow/pull/70915
## Why Go modules resolve directly to upstream repositories. Unlike PyPI or npm — where releases are now scanned at publish time — there is no central registry that pre-scans a Go release, so a known-vulnerable or compromised dependency can enter the Go SDK's graph without any external scanner flagging it first. The recent `slogcolor` incident (dangling namespace taken over, removed in #70824) is the same class of risk. We already limit Dependabot to advisory-driven security updates for Go modules (#70914) and CodeQL scans our own Go source daily, but neither continuously checks the *dependency graph* against known advisories. ## What Add a `govulncheck` step to the `Go SDK tests` job on both the amd and arm CI workflows (kept in sync). `govulncheck`: - checks the module graph against the [Go vulnerability database](https://pkg.go.dev/vuln), and - is **reachability based**, so it only fails the build on advisories that affect code the SDK actually calls — keeping the signal low-noise rather than alerting on every transitively-present CVE. The `@v1.6.0` pin is immutable: Go module versions are content-addressed through the checksum database, unlike mutable Git tags used for `uses:` actions. This runs whenever the Go SDK job runs (i.e. when Go files change), catching a vulnerable dependency at the moment it is added or bumped. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.8) Generated-by: Claude Code (Opus 4.8) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
