GoReleaser version floats on "~> v2" in the job that signs releases

未关闭 适合新手
  • 哪里不对？
#324 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
66/100
Issue 类型
重构
描述清晰度
描述清楚
活跃度
活跃
技术栈
github-actions, go, yaml
领域
ci-cd, release

调研方向

从 .github/workflows/go.yml 开始：第 249 行（snapshot）和第 331 行（release）的 goreleaser/goreleaser-action 步骤使用 version: "~> v2"，发布任务的权限位于第 286-289 行附近。选择一个确切的 GoReleaser 版本，并在发布日志中检查当前解析到的版本。两个步骤都指定该版本、仓库中记录了如何升级该版本，并且发布任务的 checkout 设置了 persist-credentials: false，即为完成。升级方式由维护者决定，因此在编辑前请先确认。

由索引模型根据 Issue 内容生成。

描述

area: release dependencies good first issue severity: low

Summary

Every action and build tool in the workflows is pinned except GoReleaser itself, which resolves to the newest 2.x at run time in both the snapshot and the release job.

Where

  • .github/workflows/go.yml:331
  • .github/workflows/go.yml:249
  • .github/workflows/go.yml:286

Details

Every action is pinned to a commit SHA, and golangci-lint (v2.15.0, go.yml:117), govulncheck (@v1.9.0, go.yml:123), syft and cosign (fixed by their pinned installer actions; the log shows syft v1.54.0) are fixed versions. GoReleaser itself is not: goreleaser/goreleaser-action@a4f02ab... # v7.3.0 is given version: "~> v2" at go.yml:249 (snapshot) and go.yml:331 (release). The release-snapshot log of run 43648865601 shows it resolved at run time: Downloading https://github.com/goreleaser/goreleaser/releases/download/v2.20.2/goreleaser_Linux_x86_64.tar.gz, checked only against checksums.txt from the same release. The release job holds contents: write, id-token: write and attestations: write (go.yml:286-289).

Impact

Whatever GoReleaser v2.x is newest on the day of a tag builds, signs and uploads the release, with nothing reviewed and no Dependabot PR. A new minor that changes or deprecates a config key fails or alters a release that the snapshot run on the previous push passed, and a compromised upstream release would run with the signing identity. It is the one build tool in the release path that is not reproducible from the repository.

Steps to reproduce

Compare go.yml:331 with the Downloading .../goreleaser/releases/download/v2.20.2/... line in job 132612931653's log.

Suggested fix

Pin an exact version (version: v2.20.2) in both steps, and keep it current by hand or with a Dependabot-visible form (a tools go.mod or a comment-driven updater such as Renovate's regex manager; Dependabot's github-actions ecosystem does not read with: version).

Notes

While here: the release job's checkout can set persist-credentials: false; GoReleaser and gh take the token from the environment.

Acceptance criteria

  • Both jobs name an exact GoReleaser version
  • There is a documented way to bump it
  • The release job's checkout does not persist credentials

Getting started

  • Relevant files: .github/workflows/go.yml
  • How to run tests: make test (or go test ./...). Tests must stay hermetic: use -simulate, -simulate-zone or the local DNS test server, never a live domain.
  • Related docs: docs/DEVELOPER_GUIDE.md, docs/ARCHITECTURE.md

Filed by repo-audit/full-audit at d0c56f0. Severity: low. Effort: S. audit-key: dependencies|.github/workflows/go.yml|goreleaser-action.version

主要语言
Go
星标
1
派生
1
平均合并
6 小时 42 分钟
30 天内合并 PR
7

环境准备

在 Codespaces 中打开

在浏览器里用你自己的 GitHub 账号启动这个项目的开发容器。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

TMHSDigital/subenum 的其他 Issue

查看 TMHSDigital/subenum 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。