hyperscale-stack / security / 38327232440
98%

DEFAULT BRANCH: master
Ran
Jobs 1
Files 173
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 97.209% (-0.2%) from 97.411%
38327232440

push

github

web-flow 
build: harden CI, release and dependencies; require Go 1.27.2

Every module and go.work now require Go 1.27.2 (DEP-01): go1.26.5 carried
reachable standard-library advisories. A govulncheck workflow scans every
module on each change and weekly; the release scans the released module.
On go1.27.2 no module has a reachable advisory. The outbound gzip-bomb test
now checks the invariant it relies on (compressed size < MaxResponseBytes)
instead of a 16 KiB constant broken by the Go 1.27 flate encoder.

x/net v0.60.0 in grpc and examples came with Dependabot #109 (DEP-02);
Dependabot now covers every module, the tool modules and GitHub Actions.

Development tools live in one module each under tools/ (golangci-lint
v2.14.0, govulncheck v1.9.0, goveralls v0.0.12, mockery v3.8.1), outside
go.work, so no tool reaches a consumer's module graph (DEP-03): a core-only
consumer resolves 23 modules instead of 50. make generate writes the mocks
into in-package _test.go files; they are generated by CI, never committed.

Workflows run with a read-only token (only the release publish job gets
contents: write), every action is pinned to a commit SHA, credentials are
not persisted, no third-party action or downloaded binary is left, and
master runs are never cancelled (CI-01). Release tags match nested modules;
scripts/release-check.sh builds the consumer view without in-repo replaces
and refuses any other replace or exclude; check-modules fails on go-line
drift and on uncommitted sync/tidy effects (CI-02).

Breaking: consumers need Go >= 1.27.2. The first release of every module
is v1.0.0. See MIGRATION.md, "Toolchain".

Audit: DEP-01, DEP-02, DEP-03, CI-01, CI-02.

10900 of 11213 relevant lines covered (97.21%)

1454.09 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
98.32
-1.68% oidc/client/strictjson.go
Jobs
ID Job ID Ran Files Coverage
1 38327232440.1 173
97.21
GitHub Action Run
Source Files on build 38327232440