From a8e507af3b96b13a1699c98ebeb232adb5e43fd2 Mon Sep 17 00:00:00 2001 From: Manas Srivastava Date: Thu, 21 May 2026 22:27:14 +0530 Subject: [PATCH 1/2] ci: Tier 1 OSS security scanners CodeQL (security-extended) + Dependabot (gomod + actions) + govulncheck + OSV-Scanner. 100% free for public repos. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/dependabot.yml | 31 +++++++++++++++++++++++++++++ .github/workflows/codeql.yml | 33 +++++++++++++++++++++++++++++++ .github/workflows/govulncheck.yml | 25 +++++++++++++++++++++++ .github/workflows/osv-scanner.yml | 22 +++++++++++++++++++++ 4 files changed, 111 insertions(+) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/govulncheck.yml create mode 100644 .github/workflows/osv-scanner.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..73992aa --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,31 @@ +version: 2 +updates: + - package-ecosystem: gomod + directory: "/" + schedule: + interval: weekly + day: monday + time: "06:00" + timezone: Etc/UTC + open-pull-requests-limit: 5 + groups: + gomod-security: + applies-to: security-updates + patterns: + - "*" + gomod-minor-patch: + applies-to: version-updates + update-types: + - minor + - patch + + - package-ecosystem: github-actions + directory: "/" + schedule: + interval: weekly + day: monday + open-pull-requests-limit: 3 + groups: + actions: + patterns: + - "*" diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..2cdb7ba --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,33 @@ +name: CodeQL + +on: + push: + branches: [master, main] + pull_request: + branches: [master, main] + schedule: + - cron: '17 6 * * 1' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + analyze: + name: Analyze (Go) + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-go@v5 + with: + go-version-file: go.mod + - uses: github/codeql-action/init@v3 + with: + languages: go + queries: security-extended + - run: go build ./... + - uses: github/codeql-action/analyze@v3 + with: + category: "/language:go" diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml new file mode 100644 index 0000000..942dd8e --- /dev/null +++ b/.github/workflows/govulncheck.yml @@ -0,0 +1,25 @@ +name: govulncheck + +on: + push: + branches: [master, main] + pull_request: + branches: [master, main] + schedule: + - cron: '0 6 * * *' + +permissions: + contents: read + +jobs: + govulncheck: + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-go@v5 + with: + go-version-file: go.mod + check-latest: true + - run: go install golang.org/x/vuln/cmd/govulncheck@latest + - run: govulncheck ./... diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml new file mode 100644 index 0000000..89d7540 --- /dev/null +++ b/.github/workflows/osv-scanner.yml @@ -0,0 +1,22 @@ +name: OSV-Scanner + +on: + push: + branches: [master, main] + pull_request: + branches: [master, main] + schedule: + - cron: '0 6 * * *' + +permissions: + actions: read + contents: read + security-events: write + +jobs: + scan: + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.1 + permissions: + actions: read + contents: read + security-events: write From 61268f52df1485b63a851eabcdf09b82ebb4f0db Mon Sep 17 00:00:00 2001 From: Manas Srivastava Date: Thu, 21 May 2026 22:37:38 +0530 Subject: [PATCH 2/2] =?UTF-8?q?chore(go):=20bump=20toolchain=20to=201.25.1?= =?UTF-8?q?0=20=E2=80=94=20fixes=203=20stdlib=20CVEs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit govulncheck on PR #5 flagged three Go stdlib vulnerabilities reachable from sdk-go user code: - GO-2026-4971 net.Dialer panic on NUL byte (Windows) - GO-2026-4947 unexpected x509 chain-building work - GO-2026-4946 inefficient x509 policy validation All three are fixed in Go 1.25.9–1.25.10. Bumping toolchain to 1.25.10 to close the reachability path. Co-Authored-By: Claude Opus 4.7 (1M context) --- go.mod | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/go.mod b/go.mod index a3d6c3e..d5f6584 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,5 @@ module github.com/InstaNode-dev/sdk-go -go 1.22 +go 1.25 + +toolchain go1.25.10