GoReleaser version floats on "~> v2" in the job that signs releases
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 66/100
Research direction
Start in .github/workflows/go.yml: the goreleaser/goreleaser-action steps at lines 249 (snapshot) and 331 (release) take version: "~> v2", and the release job's permissions are around lines 286-289. Pick an exact GoReleaser version and check the release log for the version it currently resolves to. Done means both steps name that version, the repo documents how to bump it, and the release job's checkout sets persist-credentials: false. The bump method is a maintainer choice, so confirm it before editing.
Written by the indexing model from the issue text.
Description
Summary
Every action and build tool in the workflows is pinned except GoReleaser itself, which resolves to the newest 2.x at run time in both the snapshot and the release job.
Where
.github/workflows/go.yml:331.github/workflows/go.yml:249.github/workflows/go.yml:286
Details
Every action is pinned to a commit SHA, and golangci-lint (v2.15.0, go.yml:117), govulncheck (@v1.9.0, go.yml:123), syft and cosign (fixed by their pinned installer actions; the log shows syft v1.54.0) are fixed versions. GoReleaser itself is not: goreleaser/goreleaser-action@a4f02ab... # v7.3.0 is given version: "~> v2" at go.yml:249 (snapshot) and go.yml:331 (release). The release-snapshot log of run 43648865601 shows it resolved at run time: Downloading https://github.com/goreleaser/goreleaser/releases/download/v2.20.2/goreleaser_Linux_x86_64.tar.gz, checked only against checksums.txt from the same release. The release job holds contents: write, id-token: write and attestations: write (go.yml:286-289).
Impact
Whatever GoReleaser v2.x is newest on the day of a tag builds, signs and uploads the release, with nothing reviewed and no Dependabot PR. A new minor that changes or deprecates a config key fails or alters a release that the snapshot run on the previous push passed, and a compromised upstream release would run with the signing identity. It is the one build tool in the release path that is not reproducible from the repository.
Steps to reproduce
Compare go.yml:331 with the Downloading .../goreleaser/releases/download/v2.20.2/... line in job 132612931653's log.
Suggested fix
Pin an exact version (version: v2.20.2) in both steps, and keep it current by hand or with a Dependabot-visible form (a tools go.mod or a comment-driven updater such as Renovate's regex manager; Dependabot's github-actions ecosystem does not read with: version).
Notes
While here: the release job's checkout can set persist-credentials: false; GoReleaser and gh take the token from the environment.
Acceptance criteria
- Both jobs name an exact GoReleaser version
- There is a documented way to bump it
- The release job's checkout does not persist credentials
Getting started
- Relevant files:
.github/workflows/go.yml - How to run tests:
make test(orgo test ./...). Tests must stay hermetic: use-simulate,-simulate-zoneor the local DNS test server, never a live domain. - Related docs:
docs/DEVELOPER_GUIDE.md,docs/ARCHITECTURE.md
Filed by repo-audit/full-audit at d0c56f0. Severity: low. Effort: S. audit-key: dependencies|.github/workflows/go.yml|goreleaser-action.version
- Dominant language
- Go
- Stars
- 1
- Forks
- 1
- Avg merge
- 6h 42m
- Merged PRs (30d)
- 7
Getting set up
Starts the project's dev container in your browser, under your own GitHub account.
- Ships a Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from TMHSDigital/subenum
-
good first issue severity: low tech-debt
Difficulty 2/5 Half a day Newbie friendliness 75/100
TMHSDigital/subenum#329 ·
Maintainers usually reply within 1 day
-
area: docs documentation good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
TMHSDigital/subenum#327 ·
Maintainers usually reply within 1 day
-
ci good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
TMHSDigital/subenum#323 ·
Maintainers usually reply within 1 day
-
area: output bug good first issue severity: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
TMHSDigital/subenum#319 ·
Maintainers usually reply within 1 day
-
community documentation good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
TMHSDigital/subenum#135 ·
Maintainers usually reply within 1 day
All issues in TMHSDigital/subenum
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
volcano-sh/volcano#6323 ·
Maintainers usually reply within 1 day
-
needs-triage typo
Difficulty 1/5 Under an hour Newbie friendliness 88/100
llm-d-incubation/llm-d-scaling-manager#122 ·
Maintainers usually reply within 1 day
-
[Bug] Backend summarize min() / max() panics when a field has no numeric valuesPossibly taken @weng5e claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
grafana/grafana-infinity-datasource#1832 ·
Maintainers usually reply within 1 day
-
tech-debt
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
GillMacedo/godebugdiff#13 ·