mixandClaude Opus 5.5
68493dc097
Security audit 2026-10-17, findings I4 and I5 (low), stage 5. I4: every action is pinned by commit with its version in a comment - the latest release of the major each used, so nothing changes in behaviour (checkout v4.4.0, setup-go v5.6.0, setup-buildx-action v3.12.0, build-push-action v6.19.2, login-action v3.7.0; commits read with git ls-remote, the tags are lightweight). govulncheck v1.9.0 runs on the source in test.yml, and in release.yml on the image's panel and selfpost-backup binaries before the push (-mode=binary: the base image's Go, which may lag the runner's - a fixed stdlib advisory then fails the release until golang:1.26-trixie moves, which is the point). certbot is pinned to v5.8.0 and Caddy to 2.11.7 (Docker Hub, 2026-10-17). provenance/SBOM stay off until the GHCR cleanup keeps attestations, as the plan says. I5: published tags are never rebuilt, so a Debian security fix reaches operators with the next release. The guide (§ Upgrading) and SECURITY.md say so; base-packages.yml runs .github/scripts/base-packages.sh every Monday: what debian:trixie-slim would install for postfix, libsasl2-2, libsasl2-modules-db, sasl2-bin, openssl, libssl3t64, libdb5.3t64 against the table in development.md (the 2.14.3 image's versions), red when one moved. Tried on the test server: green as it stands, red with a version changed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
name: test
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
# design-first.sh reads each commit's parent and the template history.
|
|
fetch-depth: 0
|
|
|
|
- name: Design first
|
|
env:
|
|
BASE: ${{ github.event.pull_request.base.sha || github.event.before }}
|
|
HEAD: ${{ github.event.pull_request.head.sha || github.sha }}
|
|
run: bash .github/scripts/design-first.sh "$BASE" "$HEAD"
|
|
|
|
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
|
|
with:
|
|
go-version: "1.26"
|
|
cache: true
|
|
cache-dependency-path: |
|
|
go.sum
|
|
test/e2e/go.sum
|
|
|
|
- name: Format
|
|
run: |
|
|
fmt="$(gofmt -l .)"
|
|
if [ -n "$fmt" ]; then
|
|
echo "$fmt"
|
|
echo "gofmt needed on the files above; run 'gofmt -w .'"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Vet
|
|
run: go vet ./...
|
|
|
|
# Unused code, dead branches and the usual slips go vet does not look
|
|
# for. The version is pinned: a new release adds checks, and a check
|
|
# that appears under a push is a red build nobody asked for. 2026.1 is
|
|
# the release for Go 1.26. test/e2e is a module of its own, so ./...
|
|
# skips it; it is checked in its own step below.
|
|
- name: Staticcheck
|
|
run: go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...
|
|
|
|
- name: Test
|
|
run: go test ./...
|
|
|
|
# Known vulnerabilities in the module's dependencies and in the
|
|
# standard library of this Go, reached from SelfPost's code (security
|
|
# audit 2026-10-17, I4: twelve stdlib advisories went unnoticed until
|
|
# the base image's tag happened to move). Pinned like staticcheck.
|
|
- name: Vulnerabilities
|
|
run: go run golang.org/x/vuln/cmd/govulncheck@v1.9.0 ./...
|
|
|
|
# The e2e module runs only in release.yml, after a release is published;
|
|
# a type error there would first show up then. Compile it here without
|
|
# running it: `go test -run` would still run TestMain, which brings up
|
|
# the whole stand.
|
|
- name: Compile the e2e
|
|
working-directory: test/e2e
|
|
run: |
|
|
go vet ./...
|
|
go test -c -o /dev/null .
|
|
go run honnef.co/go/tools/cmd/staticcheck@2026.1 ./...
|