ci: add Dependabot gomod coverage for both Go modules - #208
Merged
Conversation
The github-actions, npm and docker ecosystems left the repo's two Go modules (gen/go, remote-worker) unwatched, so Go advisories reached us only as a red trivy-scan gate rather than as a PR. That is exactly how CVE-2026-84304 (google.golang.org/grpc heap exhaustion via HTTP/2 DATA frame fragmentation) landed: it published on 2026-09-01, entered Trivy's DB overnight, and turned the gate red on unrelated PRs until it was bumped by hand in rossoctl#203. The same shape recurred a week earlier with GHSA-hrxh-6v49-42gf, fixed by hand in rossoctl#163 -- grpc is a repeat offender. Dependabot has no recursive directory match, so each go.mod needs its own entry. grpc, protobuf and genproto are grouped per module because they are generated-code peers: bumping one without the others can break the buf-generated bindings. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Paolo Dettori <dettori@us.ibm.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
gomodto.github/dependabot.ymlfor the repo's two Go modules,gen/goand
remote-worker. They were the only dependency surface Dependabot did notwatch — the existing entries cover
github-actions,npmanddockeronly.Why now
Because that gap has already cost us the same outage twice, and both times a
human had to notice a red gate and hand-bump the dependency:
GHSA-hrxh-6v49-42gfgoogle.golang.org/grpc1.82.0 → 1.82.1CVE-2026-84304google.golang.org/grpc1.82.1 → 1.83.1CVE-2026-84304(gRPC-Go heap exhaustion via HTTP/2 DATA frame fragmentation)published
2026-09-01T18:19Zand entered Trivy's DB overnight. The next morningtrivy-scanbegan failing on PRs that had nothing to do with Go — the failureis also near-invisible, because the job runs with
format: sarif, so stdoutshows
exit code 1with no findings table andcode-scanning/alerts?tool_name=Trivyreturns
[]. Diagnosing it means scanning the base and head trees by hand.A
gomodecosystem turns that into an ordinary dependency PR that arrivesbefore the advisory reaches the scanner DB.
Notes on the config
/gen/goand/remote-workereach need their own block.grpc/protobuf/genprotoare grouped per module, following the samereasoning as the existing
codeql-actiongroup: they are generated-code peers,and bumping one without the others can break the
buf-generated bindings.Verification
.github/dependabot.ymlparses; all 5 ecosystems resolve as intended(
github-actions,npm,docker,gomod×2).pre-commit run --files .github/dependabot.yml→ all hooks Passed(prettier, check-yaml, gitleaks, whitespace), so the new
lintgate from fix: pre-commit runs zero hooks — restore the hooks, add a CI gate, apply Prettier #202is satisfied.
Schedule is
weekly, matching every other ecosystem here. This only changes whatDependabot watches; no application code or CI behavior is affected.
Assisted-By: Claude Code