fix(ci): enforce govulncheck and gosec + add permissions hardening (S5) by beonde · Pull Request #59 · capiscio/capiscio-core

beonde · 2026-03-29T16:08:16Z

Design Partner Verification Findings: S5

V2 — OVERSTATED: Tools installed but provide visibility without enforcement:

govulncheck ran with continue-on-error: true → never blocked CI
gosec ran with -no-fail flag → never blocked CI

V3 — Missing permissions: Security job lacked permissions: contents: read hardening that was claimed in the remediation response.

Changes

Remove continue-on-error: true from govulncheck (now blocks CI on findings)
Remove -no-fail from gosec args (now blocks CI on findings)
Add permissions: contents: read to security job
Pin govulncheck@v1.1.3 and gosec@v2.20.0 (was @latest and @master)

@master

Design partner verification found: 1. govulncheck runs with continue-on-error: true (never fails CI) 2. gosec runs with -no-fail flag (never fails CI) 3. Security job lacks permissions: contents: read hardening Changes: - Remove continue-on-error from govulncheck (now fails CI on findings) - Remove -no-fail from gosec (now fails CI on findings) - Add permissions: contents: read to security job - Pin govulncheck to v1.1.3 and gosec to v2.20.0 (was @latest/@master)

codecov · 2026-03-29T16:10:22Z

Codecov Report

❌ Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
pkg/badge/keeper.go	0.00%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

Copilot

Pull request overview

Tightens the CI security-scanning job so vulnerability/SAST findings enforce remediation (per S5 findings) and the job runs with least-privilege token permissions.

Changes:

Make govulncheck and gosec fail the workflow on findings (remove continue-on-error / -no-fail).
Pin govulncheck and gosec to specific versions instead of floating refs.
Harden the security job token permissions to contents: read.

Copilot · 2026-03-29T16:10:38Z

.github/workflows/ci.yml

        run: |
-          go install golang.org/x/vuln/cmd/govulncheck@latest
+          go install golang.org/x/vuln/cmd/govulncheck@v1.1.3
          govulncheck ./...


govulncheck is run without the opa_no_wasm build tag, while the main build/test jobs compile with -tags opa_no_wasm. This means govulncheck may skip analysis of the tagged code paths (e.g., pkg/pdp/config.go) and can miss vulnerabilities that ship in the intended build. Consider passing the same build tags to govulncheck (or running it for both tag sets).

Suggested change

govulncheck ./...

govulncheck -tags opa_no_wasm ./...

Copilot · 2026-03-29T16:10:39Z

.github/workflows/ci.yml

+        uses: securego/gosec@v2.20.0
        with:
-          args: '-no-fail -fmt json -out gosec-results.json ./...'
+          args: '-fmt json -out gosec-results.json ./...'


gosec is currently scanning ./... without the opa_no_wasm build tag used by the build/test jobs. That can exclude tagged files from SAST coverage and reduce the effectiveness of making gosec blocking. Consider adding the same build tags in the gosec args (or scanning both tag sets).

Suggested change

args: '-fmt json -out gosec-results.json ./...'

args: '-fmt json -tags opa_no_wasm -out gosec-results.json ./...'

govulncheck v1.1.3 pulls golang.org/x/tools@v0.23.0 which has a compilation error with Go 1.25 (invalid array length in tokeninternal). v1.1.4 pulls golang.org/x/tools@v0.29.0 which is compatible.

Three fixes for Security Scanning job: 1. Replace gosec Docker action (ships Go 1.22.0) with binary install that uses the CI's Go version from setup-go 2. Upgrade Go from 1.25.0 to 1.25.8 to fix stdlib vulnerabilities: - GO-2026-4603 (html/template) - GO-2026-4602 (os) - GO-2026-4601 (net/url) - GO-2026-4341 (net/url) - GO-2026-4340 (crypto/tls) - GO-2026-4337 (crypto/tls) 3. Upgrade grpc v1.79.1 → v1.79.3 to fix: - GO-2026-4762 (authorization bypass via missing leading slash)

Copilot

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

Copilot · 2026-03-29T16:27:02Z

.github/workflows/ci.yml

+          go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
          govulncheck ./...


PR description says govulncheck is pinned to v1.1.3, but this workflow installs v1.1.4. Either update the PR description or change the pinned version so the remediation record matches what CI actually enforces.

Copilot · 2026-03-29T16:27:02Z

.github/workflows/ci.yml

+          go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
+          gosec -fmt json -out gosec-results.json ./...


PR description says gosec is pinned to v2.20.0, but this workflow installs v2.22.4. Please align the description and the actual pinned version so audit/remediation tracking stays accurate.

Copilot · 2026-03-29T16:27:03Z

go.mod

 module github.com/capiscio/capiscio-core/v2

-go 1.25.0
+go 1.25.8


go directive should not include a non-zero patch version (e.g., 1.25.8). The go directive is the language version and Go tooling expects x.y or x.y.0; using 1.25.8 can make go mod parsing fail and break actions/setup-go when using go-version-file. Keep go 1.25.0 (or go 1.25) and, if you need to pin the toolchain patch, add a separate toolchain go1.25.8 directive instead.

Suggested change

go 1.25.8

go 1.25.0

toolchain go1.25.8

Security fixes: - G306: Tighten badge/policy file permissions from 0644 to 0600 (keeper.go, badge.go, policy.go) - G114: Replace http.ListenAndServe with http.Server + timeouts (gateway.go, example server) - G306: Add #nosec for intentionally 0644 public files (public keys, DIDs, agent cards) - G404: Add #nosec for non-cryptographic jitter random - CI: Add -exclude-generated flag and exclude G115,G304,G107 (generated protobuf, CLI file reads, URL validation)

gosec v2.22.4 requires #nosec directives on the line BEFORE the finding, not inline on the same line. Move all G306 and G404 nosec annotations accordingly. Local verification: 73 files scanned, 8 nosec recognized, 0 issues.

Copilot

Pull request overview

Copilot reviewed 11 out of 12 changed files in this pull request and generated 2 comments.

Copilot · 2026-03-29T16:47:58Z

go.mod

 module github.com/capiscio/capiscio-core/v2

-go 1.25.0
+go 1.25.8


go 1.25.8 makes the security job (which uses go-version-file: go.mod) run a different Go patch version than the lint/test jobs pinned to 1.25.0 in .github/workflows/ci.yml. Align these (e.g., use go-version-file everywhere or bump the pinned versions) to avoid inconsistent CI results.

Suggested change

go 1.25.8

go 1.25.0

Copilot · 2026-03-29T16:47:59Z

examples/secure_ping_pong/server/main.go

+	if err := srv.ListenAndServe(); err != nil {
 		log.Fatal(err)
 	}


ListenAndServe returns http.ErrServerClosed on normal shutdown; calling log.Fatal on any error can make graceful shutdown paths look like failures. Consider special-casing http.ErrServerClosed (or using errors.Is) before logging fatally.

Copilot AI review requested due to automatic review settings March 29, 2026 16:08

Copilot started reviewing on behalf of beonde March 29, 2026 16:08 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

beonde added 2 commits March 29, 2026 12:12

fix: update govulncheck to v1.1.4 for Go 1.25 compatibility

6309c39

govulncheck v1.1.3 pulls golang.org/x/tools@v0.23.0 which has a compilation error with Go 1.25 (invalid array length in tokeninternal). v1.1.4 pulls golang.org/x/tools@v0.29.0 which is compatible.

Copilot AI review requested due to automatic review settings March 29, 2026 16:24

Copilot started reviewing on behalf of beonde March 29, 2026 16:25 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

beonde added 2 commits March 29, 2026 12:37

fix: move #nosec annotations to line-above format

dfe8165

gosec v2.22.4 requires #nosec directives on the line BEFORE the finding, not inline on the same line. Move all G306 and G404 nosec annotations accordingly. Local verification: 73 files scanned, 8 nosec recognized, 0 issues.

Copilot AI review requested due to automatic review settings March 29, 2026 16:45

Copilot started reviewing on behalf of beonde March 29, 2026 16:45 View session

Copilot AI reviewed Mar 29, 2026

View reviewed changes

beonde merged commit bda5b5d into main Mar 29, 2026
9 checks passed

beonde deleted the fix/ci-security-enforcement branch March 29, 2026 16:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ci): enforce govulncheck and gosec + add permissions hardening (S5)#59

fix(ci): enforce govulncheck and gosec + add permissions hardening (S5)#59
beonde merged 5 commits intomainfrom
fix/ci-security-enforcement

beonde commented Mar 29, 2026

Uh oh!

codecov bot commented Mar 29, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Copilot AI Mar 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	args: '-fmt json -out gosec-results.json ./...'
	args: '-fmt json -tags opa_no_wasm -out gosec-results.json ./...'

		go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
		govulncheck ./...

		go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4
		gosec -fmt json -out gosec-results.json ./...

Conversation

beonde commented Mar 29, 2026

Design Partner Verification Findings: S5

Changes

Uh oh!

codecov bot commented Mar 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Mar 29, 2026 •

edited

Loading