Repository navigation
Add govulncheck and enable gosec (manual backport 270) - #276
Merged
HarshwardhanPatil07 merged 10 commits intoOct 30, 2026
Merged
Conversation
To be able to detect known vulnerabilities reachable from the repository's Go code, add a vulncheck target that runs govulncheck over all Go packages. The tool is pinned (currently v1.9.0) and downloaded to ./bin/ by the existing go-install-tool machinery, so the version stays out of go.mod. The scan fetches the Go vulnerability database on demand and therefore needs network access. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit 2e34693)
govulncheck reports five vulnerabilities reachable from this repository's code, all in golang.org/x/net v0.59.0 and fixed in v0.60.0: GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612 and GO-2026-6617 (HTTP/2 flow control, HPACK and header handling issues). Bump to the minimum version that fixes them so the vulnerability check can be enforced in CI without any existing finding to waive. Two further findings in x/net/html (GO-2026-6860 and GO-2026-6866) are not reachable from this code and stay informational; they do not fail the check. Assisted-by: AI (cherry picked from commit 0d424cb) Signed-off-by: Alice Frosi <afrosi@redhat.com>
Run make vulncheck as a dedicated step in the unit job so pull requests fail when a known vulnerability is reachable from the repository's Go code. It is a separate step rather than part of make lint so the two checks can be run and diagnosed independently, and it reuses the Makefile target instead of duplicating the invocation. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit 2985ad1)
Describe the new target in CONTRIBUTING.md: what it scans, that it downloads both the govulncheck binary and the Go vulnerability database and so needs network access, and how to interpret its output. Only findings in functions the code actually calls fail the check; findings in imported packages or required modules that are not called are informational. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit cbb242e)
Every internal package lacked a package comment, which staticcheck's ST1000 check flags. Add a short one to each so the full staticcheck suite can be enabled. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit 1caecb6)
The pool status counts are int32 in the API but computed from int slice lengths, and the bare conversion would silently wrap on overflow (gosec G115). Node counts can't realistically get there, but a saturating conversion makes the intent explicit and keeps the linter quiet without a suppression. The counts can never be negative, but they stay int32 rather than uint32: the Kubernetes API conventions advise against unsigned integers because client support across languages is uneven, and recommend validating that the value is non-negative instead. Mark the counts with a minimum of 0 in the CRD schema, and clamp the conversion to [0, math.MaxInt32] so the controller never writes a value the schema would reject. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit 971a76a)
collectDrainResults dropped finished drains from r.drains without calling their cancel func, which is only invoked when a node leaves the pool. Each drain context derives from the reconcile context, which has no deadline, so every completed or failed drain stayed registered with the long-lived parent until the process exited. Cancel the context when the result is collected, after checking whether it was cancelled so the existing cancellation handling still works. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit c410789)
Prepare for enabling gosec by resolving its findings outside the e2e
suite:
- Tighten directory permissions in watcher tests to 0750 (G301).
- Annotate the remaining reports as false positives, each with the
reason:
- G204: nsenter callers pass fixed program names, and the only
external input is a validated, digested image reference; nothing
goes through a shell.
- G118 (drain): the cancel func is stored in r.drains and called
when the drain is collected.
- G118 (staging): staging intentionally outlives the reconcile, and
its parentless context cannot leak.
- G301: /run/ostree on the host keeps the conventional 0755 mode.
Assisted-by: AI
Signed-off-by: Alice Frosi <afrosi@redhat.com>
(cherry picked from commit 0bedf3d)
Without a config file golangci-lint runs only its standard linters, and staticcheck runs without the stylistic checks golangci-lint disables by default (package comments, naming, receiver and doc comment consistency). Add .golangci.yml to keep the standard set, enable all staticcheck checks, and add gosec for security issues. gosec is excluded from test/e2e, which intentionally drives kubectl, helm and bink with computed arguments. Because make lint already runs in CI, this needs no workflow change. Assisted-by: AI Signed-off-by: Alice Frosi <afrosi@redhat.com> (cherry picked from commit 2aa6aec)
alicefr
requested review from
HarshwardhanPatil07 and
Johan-Liebert1
and removed request for
Johan-Liebert1
October 30, 2026 07:49
CI installs the Go version named by the go directive in go.mod, so the vulnerability check ran against Go 1.26.0 and reported ten standard library vulnerabilities reachable from this repository's code, in net/http, net/textproto, crypto/tls and crypto/x509 (GO-2026-6603 through GO-2026-6809). They are fixed in Go 1.26.9 and 1.26.10. Raise the minimum to 1.26.10, the first release that fixes all of them, so CI builds and scans with a patched toolchain. Use the same patched Go version for the operator container builder. Assisted-by: AI (cherry picked from commit 6748772) Signed-off-by: Alice Frosi <afrosi@redhat.com>
HarshwardhanPatil07
approved these changes
Oct 30, 2026
HarshwardhanPatil07
enabled auto-merge (rebase)
October 30, 2026 07:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Manual backport of #270