gate: add an osv-scanner vulnerability scan #587

New issue

Closed

opened 2026-09-22 17:11:06 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-22 17:11:06 +00:00

Owner

Context

osv-scanner scans dependency manifests across ecosystems. govulncheck is
Go-only and call-graph-based, so it structurally cannot see the npm
vulnerabilities in the committed conformance harness lockfile. osv-scanner
found 19 such npm vulnerabilities. Ecosystem coverage is the reason to keep
both, not duplication.

What

Add osv-scanner scan source -r --no-call-analysis . to the gate's heavy
block. This covers go.mod and conformance/mcp-client/package-lock.json.
--no-call-analysis keeps the scan lockfile-fast and deterministic;
call-graph analysis stays govulncheck's job. Confirm the flag name at pin
time; this is v2 syntax.
The scan exits non-zero on findings, which matches the zero-tolerance rule.
Pin osv-scanner in scripts/setup-dev.sh and .forgejo/workflows/ci.yml,
kept in sync. Add the CLAUDE.md line. Note in the ci.yml header that both
vulnerability scans need network egress to the OSV API.

Acceptance

The step runs green on the clean tree.
Reverting one of the harness dependency bumps makes the step fail, which
proves the check.

## Context osv-scanner scans dependency manifests across ecosystems. govulncheck is Go-only and call-graph-based, so it structurally cannot see the npm vulnerabilities in the committed conformance harness lockfile. osv-scanner found 19 such npm vulnerabilities. Ecosystem coverage is the reason to keep both, not duplication. ## What - Add `osv-scanner scan source -r --no-call-analysis .` to the gate's heavy block. This covers go.mod and conformance/mcp-client/package-lock.json. - `--no-call-analysis` keeps the scan lockfile-fast and deterministic; call-graph analysis stays govulncheck's job. Confirm the flag name at pin time; this is v2 syntax. - The scan exits non-zero on findings, which matches the zero-tolerance rule. - Pin osv-scanner in `scripts/setup-dev.sh` and `.forgejo/workflows/ci.yml`, kept in sync. Add the CLAUDE.md line. Note in the ci.yml header that both vulnerability scans need network egress to the OSV API. ## Acceptance - The step runs green on the clean tree. - Reverting one of the harness dependency bumps makes the step fail, which proves the check.

hexajon added the

security

testing

labels

2026-09-22 17:11:06 +00:00

hexajon referenced this issue

2026-09-24 15:43:53 +00:00

chore(deps): upgrade golang.org/x/crypto, mod, and text past known vulnerabilities #620

hexajon referenced this issue

2026-09-24 15:52:22 +00:00

track: x/crypto is in go.mod only for the update signature check, so osv-scanner ignores GO-2026-5932 #621

hexajon referenced this issue from a pull request that will close it,