Conversation
V5.4/V6.2 no longer get proactive Dependabot bumps (#4546), so the existing govulncheck cron - which only Slack-alerted before - now also opens a PR with the fix when a finding is reachable and a fixed version exists. Master keeps the plain Slack alert; its own weekly Dependabot PRs are the fix path there. The fix is built entirely through the GitHub API (blob/tree/commit/ref) rather than a local `git commit` + `git push`: every branch requires signed commits org-wide, and the runner has no signing key for a bot identity. Commits created via the API are signed by GitHub itself. Duplicate PRs are avoided by keying on (branch, advisory ID), so the same CVE affecting both release lines still gets one PR per branch, and two distinct CVEs on the same module don't collide. Assisted by AI
reinkrul
requested review from
Dirklectisch,
JorisHeadease,
gerardsn,
stevenvegt and
woutslakhorst
as code owners
September 14, 2026 10:28
reinkrul
marked this pull request as draft
September 14, 2026 10:30
The previous commit built the signed commit by hand through the GitHub Git Data API (blob/tree/commit/ref) to work around the org-wide signed- commits ruleset. peter-evans/create-pull-request's `sign-commits: true` does the same thing (signs as github-actions[bot] via the GITHUB_TOKEN, no bot signing key needed) as a maintained action instead. A `uses:` action step can't be looped over a variable number of findings within one job, though, so the fix now runs as a dynamic matrix: govulncheck_job still detects and extracts actionable findings per branch (one artifact each), prepare_fix_matrix merges those into a single list, and open_fix_prs runs create-pull-request once per finding. Slack now reports per-PR-opened instead of a single combined summary; a branch with a failure but nothing actionable (already an open PR, no fixed version yet, or a toolchain/stdlib finding) still gets its own alert from the detection job. Assisted by AI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #4545. Builds on #4546 (which removed the proactive Dependabot updates this replaces).
Extends
govulncheck-cron-schedule.yaml: on a V5.4/V6.2 finding, instead of only Slack-alerting, it now also opens a PR with the fix, when the finding is reachable and a fixed version exists. Master's path is unchanged (Slack alert only - its own Dependabot config handles the fix there).How it works (3 jobs):
govulncheck_job(existing, matrixed over master/V5.4/V6.2): the text-format run still triggers the job failure. On failure for a release branch, a second JSON-format run extracts which module/version to bump. A new step reduces that to actionable findings - one per (advisory, module), skipping stdlib/toolchain findings (need a Go version bump, notgo get), findings with no fixed version yet, and advisories that already have an open PR (keyed on branch + advisory ID, so the same CVE on both release lines still gets one PR each). Actionable findings are uploaded as a per-branch artifact. If a branch failed but nothing was actionable, it gets its own Slack alert here instead.prepare_fix_matrix: merges the per-branch artifacts into one list, since auses:action step can't be looped over a variable number of findings within a single job.open_fix_prs: a dynamic matrix, one leg per finding. Checks out the branch,go get/go mod tidythe fix, and opens the PR viapeter-evans/create-pull-requestwithsign-commits: true- it signs the commit asgithub-actions[bot]through the GitHub API rather than a localgit commit/git push, which every branch here requires (org-wide signed-commits ruleset) and the runner has no bot signing key for. Slack gets a message per PR actually opened, linking to it.Permissions:
govulncheck_jobneedspull-requests: read(to check for an existing fix PR) in addition tocontents: read.open_fix_prsneedscontents: write+pull-requests: write.prepare_fix_matrixneeds none.Not yet verified against a live finding - there's no known-vulnerable module on V5.4/V6.2 right now to exercise this against. Plan to verify with
workflow_dispatchonce merged, ideally against a branch with a real (or deliberately introduced) vulnerable dependency, before relying on this for real.Passes
actionlint(with shellcheck) cleanly.