ci: enforce gofmt and check for known vulnerabilities - #572
Open
0xrlawrence wants to merge 1 commit into
Open
Conversation
CONTRIBUTING.md requires all Go code to be gofmt'd, but nothing enforces it, and three files on main are currently unformatted. There is also no vulnerability scanning, so advisories in the dependency graph go unnoticed. Adds a Lint job running two gates: - gofmt, which fails with the list of offending files and the command to fix them - govulncheck, which fails only when a known vulnerability is actually reachable from this codebase Two things worth knowing about the implementation: - .docker/ is excluded from the gofmt sweep. It contains Dockerfiles named 'Dockerfile.go' (e.g. .docker/auto-update/Dockerfile.go), which gofmt tries to parse as Go and reports syntax errors on. Renaming those would be a cleaner fix, but is out of scope here. - The job creates empty placeholders for the two //go:embed asset directories before running govulncheck. They are gitignored, so on a fresh checkout the module does not type-check at all and govulncheck fails before it starts. A .gitkeep is enough to satisfy 'all:' embeds, and it avoids an npm build in the lint job. Merge order: the gofmt gate fails on main today. It should land after the two formatting fixes, or maintainers can squash them together. 'go vet' was deliberately left out. It currently reports ~55 copylocks findings, almost all protobuf MessageState copies in generated-adjacent code, so it cannot be made blocking without a much larger cleanup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
CONTRIBUTING.md requires all Go code to be
gofmt'd, but nothing enforces it — and three files onmainare currently unformatted. There is also no vulnerability scanning, so advisories in the dependency graph go unnoticed.Changes Made
Adds a
Lintjob with two gates:Two implementation notes worth knowing:
.docker/is excluded from the gofmt sweep. It contains Dockerfiles namedDockerfile.go(e.g..docker/auto-update/Dockerfile.go), which gofmt tries to parse as Go and reports syntax errors on. Renaming those would be the cleaner fix, but is out of scope here.//go:embedplaceholders before running govulncheck. The wallet/explorer asset directories are gitignored, so on a fresh checkout the module does not type-check at all and govulncheck fails before it starts. A.gitkeepsatisfies anall:embed and avoids paying for an npm build in the lint job.Merge order
The gofmt gate fails on
maintoday. It should land after the two formatting fixes (#558 and #559), or you may prefer to squash them together.Deliberately not included
go vetcurrently reports ~55 copylocks findings, almost all protobufMessageStatecopies in generated-adjacent code. It cannot be made blocking without a much larger cleanup, so I left it out rather than adding a step that is red from day one.Testing
Both gates were run locally against this branch. The gofmt gate correctly identifies exactly the three unformatted files; govulncheck exits 0.
🤖 Generated with Claude Code