From 62299f93a303a7b33509378e06415f55defa331c Mon Sep 17 00:00:00 2001 From: Paolo Dettori Date: Wed, 2 Sep 2026 12:53:30 -0400 Subject: [PATCH] ci: add Dependabot gomod coverage for both Go modules The github-actions, npm and docker ecosystems left the repo's two Go modules (gen/go, remote-worker) unwatched, so Go advisories reached us only as a red trivy-scan gate rather than as a PR. That is exactly how CVE-2026-84304 (google.golang.org/grpc heap exhaustion via HTTP/2 DATA frame fragmentation) landed: it published on 2026-09-01, entered Trivy's DB overnight, and turned the gate red on unrelated PRs until it was bumped by hand in #203. The same shape recurred a week earlier with GHSA-hrxh-6v49-42gf, fixed by hand in #163 -- grpc is a repeat offender. Dependabot has no recursive directory match, so each go.mod needs its own entry. grpc, protobuf and genproto are grouped per module because they are generated-code peers: bumping one without the others can break the buf-generated bindings. Assisted-By: Claude (Anthropic AI) Signed-off-by: Paolo Dettori --- .github/dependabot.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 495f66c..9c1f974 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -23,3 +23,30 @@ updates: directory: / schedule: interval: weekly + + # Go modules were not covered above, so Go advisories reached us only as a red + # trivy-scan gate and had to be bumped by hand -- CVE-2026-84304 (grpc) in #203. + # Dependabot needs one entry per go.mod; there is no recursive directory match. + - package-ecosystem: gomod + directory: /gen/go + schedule: + interval: weekly + groups: + # grpc, protobuf and genproto are generated-code peers: bumping one without + # the others can break the buf-generated bindings, so move them together. + grpc-protobuf: + patterns: + - 'google.golang.org/grpc*' + - 'google.golang.org/protobuf*' + - 'google.golang.org/genproto*' + + - package-ecosystem: gomod + directory: /remote-worker + schedule: + interval: weekly + groups: + grpc-protobuf: + patterns: + - 'google.golang.org/grpc*' + - 'google.golang.org/protobuf*' + - 'google.golang.org/genproto*'