From fca210e806c788c80a35f07d988328456af37c26 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 21 Jul 2026 18:56:06 +0000 Subject: [PATCH 1/4] =?UTF-8?q?feat:=20implement=20issue=20#842=20?= =?UTF-8?q?=E2=80=94=20SonarCloud:=20GitHub=20Actions=20/=20dependency=20h?= =?UTF-8?q?ardening?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../workflows/dependency-audit-reusable.yml | 2 +- .github/workflows/dependency-audit.yml | 2 +- test/workflows/dependency-hardening.bats | 23 +++++++++++++++++++ 3 files changed, 25 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-audit-reusable.yml b/.github/workflows/dependency-audit-reusable.yml index 7a1f3f28a..551ccb10a 100644 --- a/.github/workflows/dependency-audit-reusable.yml +++ b/.github/workflows/dependency-audit-reusable.yml @@ -133,7 +133,7 @@ jobs: go-version: "stable" - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & go.sum/checksum-DB verified; go install has no --locked equivalent - name: Audit Go dependencies run: | diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index da41b7abb..a235bc8eb 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -137,7 +137,7 @@ jobs: go-version: "stable" - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & go.sum/checksum-DB verified; go install has no --locked equivalent - name: Audit Go dependencies run: | diff --git a/test/workflows/dependency-hardening.bats b/test/workflows/dependency-hardening.bats index 175cba34f..63c62a92f 100644 --- a/test/workflows/dependency-hardening.bats +++ b/test/workflows/dependency-hardening.bats @@ -57,6 +57,29 @@ workflow_command_lines() { [ "$fail" -eq 0 ] } +@test "every 'go install' in a workflow is version-pinned and S8545-exempted" { + # S8545 flags `go install` as non-lockfile-enforcing. Go has no --locked / + # --require-hashes equivalent: a pinned `@vX.Y.Z` is the reproducible install + # (verified via the module checksum DB / go.sum), so the finding is a confirmed + # false positive suppressed with an inline `# NOSONAR(githubactions:S8545)` + # marker. This guard fails loud if a new `go install` is added unpinned + # (@latest/@main) or without the marker. + local fail=0 file cmd + while IFS=$'\t' read -r file cmd || [ -n "$file" ]; do + case "$cmd" in + *" go install "*) + case "$cmd" in *"@v"[0-9]*) : ;; *) + echo "UNPINNED go install (needs @vX.Y.Z): ${file##*/}: $cmd"; fail=1 ;; + esac + case "$cmd" in *"NOSONAR(githubactions:S8545)"*) : ;; *) + echo "MISSING # NOSONAR(githubactions:S8545): ${file##*/}: $cmd"; fail=1 ;; + esac + ;; + esac + done < <(workflow_command_lines) + [ "$fail" -eq 0 ] +} + @test "each hash-locked requirements file referenced by a workflow exists" { local fail=0 file cmd path while IFS=$'\t' read -r file cmd || [ -n "$file" ]; do From abfb370998c0b2edbeaa95ed1bafc3576bb0a40b Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 21 Jul 2026 19:02:44 +0000 Subject: [PATCH 2/4] fix(reviews): address review comments [skip ci-relay] --- test/workflows/dependency-hardening.bats | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/test/workflows/dependency-hardening.bats b/test/workflows/dependency-hardening.bats index 63c62a92f..5d1ad6e08 100644 --- a/test/workflows/dependency-hardening.bats +++ b/test/workflows/dependency-hardening.bats @@ -67,12 +67,17 @@ workflow_command_lines() { local fail=0 file cmd while IFS=$'\t' read -r file cmd || [ -n "$file" ]; do case "$cmd" in - *" go install "*) - case "$cmd" in *"@v"[0-9]*) : ;; *) - echo "UNPINNED go install (needs @vX.Y.Z): ${file##*/}: $cmd"; fail=1 ;; - esac - case "$cmd" in *"NOSONAR(githubactions:S8545)"*) : ;; *) - echo "MISSING # NOSONAR(githubactions:S8545): ${file##*/}: $cmd"; fail=1 ;; + *"go install"*) + case "$cmd" in + *[a-zA-Z0-9_-]go\ install*) : ;; + *) + case "$cmd" in *"@v"[0-9]*) : ;; *) + echo "UNPINNED go install (needs @vX.Y.Z): ${file##*/}: $cmd"; fail=1 ;; + esac + case "$cmd" in *"NOSONAR(githubactions:S8545)"*) : ;; *) + echo "MISSING # NOSONAR(githubactions:S8545): ${file##*/}: $cmd"; fail=1 ;; + esac + ;; esac ;; esac From 283f30f87c3fd6bdc9b7a539d104505bd81ec7f8 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 21 Jul 2026 19:05:27 +0000 Subject: [PATCH 3/4] fix(reviews): address review comments [skip ci-relay] --- .github/workflows/dependency-audit-reusable.yml | 2 +- .github/workflows/dependency-audit.yml | 2 +- test/workflows/dependency-hardening.bats | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/dependency-audit-reusable.yml b/.github/workflows/dependency-audit-reusable.yml index 551ccb10a..2a58d9de5 100644 --- a/.github/workflows/dependency-audit-reusable.yml +++ b/.github/workflows/dependency-audit-reusable.yml @@ -133,7 +133,7 @@ jobs: go-version: "stable" - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & go.sum/checksum-DB verified; go install has no --locked equivalent + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & verified by the Go checksum DB (sum.golang.org); go install has no --locked equivalent - name: Audit Go dependencies run: | diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index a235bc8eb..4d7da4a43 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -137,7 +137,7 @@ jobs: go-version: "stable" - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & go.sum/checksum-DB verified; go install has no --locked equivalent + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & verified by the Go checksum DB (sum.golang.org); go install has no --locked equivalent - name: Audit Go dependencies run: | diff --git a/test/workflows/dependency-hardening.bats b/test/workflows/dependency-hardening.bats index 5d1ad6e08..2dd02c680 100644 --- a/test/workflows/dependency-hardening.bats +++ b/test/workflows/dependency-hardening.bats @@ -60,7 +60,7 @@ workflow_command_lines() { @test "every 'go install' in a workflow is version-pinned and S8545-exempted" { # S8545 flags `go install` as non-lockfile-enforcing. Go has no --locked / # --require-hashes equivalent: a pinned `@vX.Y.Z` is the reproducible install - # (verified via the module checksum DB / go.sum), so the finding is a confirmed + # (verified via the Go checksum DB, sum.golang.org), so the finding is a confirmed # false positive suppressed with an inline `# NOSONAR(githubactions:S8545)` # marker. This guard fails loud if a new `go install` is added unpinned # (@latest/@main) or without the marker. From e441bdf07046d302d5f7adaa683edcb70230f315 Mon Sep 17 00:00:00 2001 From: donpetry-bot <281750570+donpetry-bot@users.noreply.github.com> Date: Tue, 21 Jul 2026 19:08:17 +0000 Subject: [PATCH 4/4] chore: dev-lead update (review-changes) [skip ci-relay] --- .github/workflows/dependency-audit-reusable.yml | 2 +- .github/workflows/dependency-audit.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-audit-reusable.yml b/.github/workflows/dependency-audit-reusable.yml index 2a58d9de5..3c9726805 100644 --- a/.github/workflows/dependency-audit-reusable.yml +++ b/.github/workflows/dependency-audit-reusable.yml @@ -133,7 +133,7 @@ jobs: go-version: "stable" - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & verified by the Go checksum DB (sum.golang.org); go install has no --locked equivalent + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @vX.Y.Z is reproducible (verified via Go checksum DB); no --locked equivalent - name: Audit Go dependencies run: | diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index 4d7da4a43..dcc064774 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -137,7 +137,7 @@ jobs: go-version: "stable" - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @version is reproducible & verified by the Go checksum DB (sum.golang.org); go install has no --locked equivalent + run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 # NOSONAR(githubactions:S8545) pinned @vX.Y.Z is reproducible (verified via Go checksum DB); no --locked equivalent - name: Audit Go dependencies run: |