39650132996
98%

Ran 21 Oct 2026 06:17PM UTC

Jobs 1

Files 203

Run time 1min

Badge

Embed ▾

Committed 21 Oct 2026 06:09PM UTC coverage: 98.497% (+0.007%) from 98.49%

Build # 39650132996

Build Type

push

github

Committed by

web-flow

Commit Message

build: move to Go 1.27.3, add OSV-Scanner and a security policy

Close the supply-chain findings of the security audit of 2026-10-21.

- Every module, tool module and go.work requires Go 1.27.3: Go 1.27.2
  carries GO-2026-6809 (crypto/x509 distrusted intermediates); CI
  follows go.work and govulncheck is clean on all 26 modules (F-20).
- A new OSV-Scanner job (pinned in tools/osv-scanner, one explicit
  root config so a per-module file cannot silence it, fails closed on
  network or database errors) scans every module's go.mod next to
  govulncheck, and the release verify job scans the released module:
  GitHub-reviewed advisories reach CI before the Go vulndb imports them.
  Repository-only advisories (such as GHSA-mgcc-cww5-fp2q) stay a
  documented blind spot.
- SECURITY.md: private reporting through GitHub, response targets, the
  supported versions after v1.0.0. docs/releasing.md describes the
  repository settings now in effect (F-21).
- go-chi/chi moves to v5.5.0 in the oidcrp interop module
  (GHSA-j6qf-3m9c-vwj3, GHSA-rqrp-8cg2-5958).
- The committed agent settings no longer pre-approve sed, awk or make
  with arbitrary arguments, which ran commands without a prompt (I-33).

Audit: F-20, F-21, I-33.

Coverage Stats

13897 of 14109 relevant lines covered (98.5%)

4976.76 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	39650132996.1	21 Oct 2026 06:17PM UTC	203	98.5	GitHub Action Run

hyperscale-stack / security / 39650132996
98%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 39650132996

hyperscale-stack / security / 39650132996 98%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 39650132996

hyperscale-stack / security / 39650132996
98%

README BADGES
x