clawbot
215de1f857
check / check (push) Waiting to run
Go 1.27.1 in go.mod and in the Dockerfile's test and build images. Every module go.mod requires is at its current release; protoc-gen-go follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard library uuid package replaces github.com/google/uuid; FromBytes could only fail on a length validateUUID already checks, so that call and its unreachable error are gone. make vulncheck runs govulncheck v1.8.0, installed with go install at its release commit, in a vulncheck stage of the Dockerfile; script/check does not run it. The newer go directive switches on lint checks for strings.SplitSeq and t.Chdir, now used. A new test pins the bytes of a seeded manifest written by an mfer built before this change. Model: opus-5-5
23 lines
715 B
Bash
Executable File
23 lines
715 B
Bash
Executable File
#!/bin/sh
|
|
# script/vulncheck: report known vulnerabilities in the code mfer calls,
|
|
# with govulncheck, which reads the Go vulnerability database online.
|
|
# It runs as the vulncheck stage of the Dockerfile, on the same Go as the
|
|
# test phase, and this builds that stage alone, on the same terms as
|
|
# script/lint and script/test.
|
|
#
|
|
# script/check does not run it: the gate's result depends on this tree
|
|
# alone, and this one changes whenever a new advisory is published.
|
|
set -eu
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
|
|
ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
|
|
|
|
main() {
|
|
cd "$ROOT"
|
|
docker build --no-cache \
|
|
--target vulncheck \
|
|
-t "$("$SCRIPT_DIR/projectname")-vulncheck" .
|
|
}
|
|
|
|
main "$@"
|