AlexStocks opened a new pull request, #3576: URL: https://github.com/apache/dubbo-go/pull/3576
## What this PR does Part of #3566 (script-router execution timeout). Activates the security/quality gates from the code review: - **CI** (.github/workflows/github-actions.yml): add `Unit Test (race detector)` and `Dependency Vulnerability Check` jobs. - **golangci** (.golangci.yml): enable `gosec`; suppress `G104` (unchecked error returns, noisy, overlaps staticcheck/govet) and the intentional `md5` weak-crypto usage. - **Makefile**: add `test-race` and `vulncheck` targets; install `govulncheck`. ## Why The earlier security review found that the project's quality gates existed on paper (.golangci.yml, Makefile, CODE_REVIEW_GUIDE.md) but were not enforced in CI. This wires them into the pipeline so race conditions and vulnerable dependencies are caught before merge. ## Test plan - `make test-race` passes locally. - `make vulncheck` reports no actionable vulnerabilities. - `make lint` passes with gosec enabled. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
