This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 679cfca77ab Scan Go SDK dependencies for known vulnerabilities in CI
(#70915)
679cfca77ab is described below
commit 679cfca77abe9ac5a12592eb0fee559c4bdb92c0
Author: Jason(Zhe-You) Liu <[email protected]>
AuthorDate: Tue Aug 4 06:16:24 2026 +0800
Scan Go SDK dependencies for known vulnerabilities in CI (#70915)
Go modules resolve directly to upstream repositories with no central
registry
that pre-scans releases the way PyPI and npm now do, so a known-vulnerable
or
compromised dependency can enter the graph without any external scanner
flagging it first. Add a govulncheck step to the Go SDK test job on both the
amd and arm CI workflows. govulncheck checks the module graph against the Go
vulnerability database and is reachability based, so it only fails the
build on
advisories that affect code the SDK actually calls, keeping the signal
low-noise. This complements the daily CodeQL scan (which covers our own Go
source, not dependency advisories) and the advisory-driven Dependabot
security
updates.
---
.github/workflows/ci-amd.yml | 9 +++++++++
.github/workflows/ci-arm.yml | 9 +++++++++
2 files changed, 18 insertions(+)
diff --git a/.github/workflows/ci-amd.yml b/.github/workflows/ci-amd.yml
index 4750ec25990..72ef23494d7 100644
--- a/.github/workflows/ci-amd.yml
+++ b/.github/workflows/ci-amd.yml
@@ -1017,6 +1017,15 @@ jobs:
- name: Run Go tests
working-directory: ./go-sdk
run: gotestsum --format github-actions ./...
+ # Go modules have no central registry that pre-scans releases, so we
scan our own
+ # dependency graph against the Go vulnerability database. govulncheck is
reachability
+ # based, so it only fails on advisories that actually affect code we
call. The version
+ # tag is immutable (Go modules are content-addressed via the checksum
database).
+ - name: Scan Go dependencies for known vulnerabilities
+ working-directory: ./go-sdk
+ run: |
+ go install golang.org/x/vuln/cmd/[email protected]
+ govulncheck ./...
tests-java-sdk:
name: "Java SDK tests"
diff --git a/.github/workflows/ci-arm.yml b/.github/workflows/ci-arm.yml
index 35344fdcccd..8c62297ea7e 100644
--- a/.github/workflows/ci-arm.yml
+++ b/.github/workflows/ci-arm.yml
@@ -1006,6 +1006,15 @@ jobs:
- name: Run Go tests
working-directory: ./go-sdk
run: gotestsum --format github-actions ./...
+ # Go modules have no central registry that pre-scans releases, so we
scan our own
+ # dependency graph against the Go vulnerability database. govulncheck is
reachability
+ # based, so it only fails on advisories that actually affect code we
call. The version
+ # tag is immutable (Go modules are content-addressed via the checksum
database).
+ - name: Scan Go dependencies for known vulnerabilities
+ working-directory: ./go-sdk
+ run: |
+ go install golang.org/x/vuln/cmd/[email protected]
+ govulncheck ./...
tests-java-sdk:
name: "Java SDK tests"
