ci: bump govulncheck to v1.8.0 so the call-graph build survives Go 1.27 - #511
Closed
szibis wants to merge 1 commit into
Closed
ci: bump govulncheck to v1.8.0 so the call-graph build survives Go 1.27#511szibis wants to merge 1 commit into
szibis wants to merge 1 commit into
Conversation
v1.1.4 bundles golang.org/x/tools v0.29.0, whose SSA builder panics with 'unexpected expr: *ast.KeyValueExpr' when it builds a call graph for code type-checked as Go 1.27. The panic only triggers once the vulnerability database matches something in the Linux module graph, so the first Go 1.27 run passed and every later run on main and open PRs failed at Govulncheck. Reproduced locally with GOOS=linux; v1.8.0 completes with no findings.
github-actions
Bot
added
size/XS
Contributor
PR Quality ReportCompared against base branch Coverage and tests
Compatibility
Performance smokePerformance smoke was skipped for this PR because no perf-sensitive paths changed. State
|
szibis
pushed a commit
that referenced
this pull request
Sep 12, 2026
Materializes [Unreleased] into [1.64.0], bumps chart/README metadata, and carries the govulncheck v1.8.0 bump (from #511) so the test job passes on Go 1.27.
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every
testjob since #506 merged fails at theGovulncheckstep, onmainand on all open PRs.Root cause. govulncheck v1.1.4 bundles
golang.org/x/toolsv0.29.0, whose SSA builder panics withunexpected expr: *ast.KeyValueExprwhen it builds a call graph for code type-checked as Go 1.27. govulncheck only builds the call graph once the vulnerability database matches something in the module graph, and the match is platform-specific, which is why:Reproduced locally with
GOOS=linux GOARCH=amd64 govulncheck@v1.1.4 ./...(panics) versusgovulncheck@v1.8.0(completes, no vulnerabilities).Fix. Pin
govulncheck@v1.8.0inci.yaml. No other workflow uses govulncheck. CHANGELOG entry added under Changed.Verification
GOOS=linux GOARCH=amd64 govulncheck@v1.8.0 ./...govulncheck@v1.8.0 ./...(darwin)scripts/ci/check_changelog_pr.py --base main --head HEAD