ci: go vulnerability gate (spec 013 G1)

[ValgulNecron]

Depends on #671 (its setup commit is included here until that merges).

Before: no Go vulnerability scanning ran anywhere in CI.

After: a new vuln (go) job installs govulncheck v1.9.0 and scans every go.work module (operator and api with envtest, test/e2e with e2e, and api again with postgres), failing on any reachable finding. .github/workflows/vuln-weekly.yaml runs the same scan on master every Monday at 04:00 UTC and on demand.

How: hack/check-govulncheck_test.sh proves the gate offline against a synthetic advisory DB in hack/testdata/govulncheck/db. A module calling vulnfixture.Bad must exit 3, and one calling only vulnfixture.Good must exit 0. The fixture module is vendored at v1.0.0 into a temp dir rather than reached through a directory replace, because govulncheck never reports a module with an empty version (affected() in x/vuln internal/vulncheck/vulncheck.go); tasks.md T016 notes this. T015–T020; T021 (fix what the first run reports, flip G-01) follows from this PR's CI.

🤖 Generated with Claude Code

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: GameplanePanel/Gameplane/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: d5d380c2-5f1a-4014-a74a-05362e04d827

📥 Commits

Reviewing files that changed from the base of the PR and between 5dabc32 and 0b03a58.

⛔ Files ignored due to path filters (2)

• go.work.sum is excluded by !**/*.sum
• operator/go.sum is excluded by !**/*.sum

📒 Files selected for processing (18)

• .github/actions/go-cache/action.yml
• .github/workflows/ci.yaml
• .github/workflows/vuln-weekly.yaml
• hack/check-govulncheck_test.sh
• hack/govulncheck-all.sh
• hack/testdata/govulncheck/db/ID/GO-0000-0001.json
• hack/testdata/govulncheck/db/index/db.json
• hack/testdata/govulncheck/db/index/modules.json
• hack/testdata/govulncheck/db/index/vulns.json
• hack/testdata/govulncheck/fail/go.mod
• hack/testdata/govulncheck/fail/main.go
• hack/testdata/govulncheck/pass/go.mod
• hack/testdata/govulncheck/pass/main.go
• hack/testdata/govulncheck/vulnfixture/go.mod
• hack/testdata/govulncheck/vulnfixture/vulnfixture.go
• operator/go.mod
• specs/013-expand-test-coverage/coverage-gaps.md
• specs/013-expand-test-coverage/tasks.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ValgulNecron]

vuln (go) is red as expected on its first run: the gate works, and these are the pre-existing findings T021 has to fix. The proof step passed (fixture exit 3 on the vulnerable call, 0 on the safe one).

Reachable findings, 13 of 17 scans:

• Go standard library, go1.26.8 (net/http, crypto/tls, net/textproto, html/template, mime/multipart): fixed in go1.26.9. CI's go-cache action requests 1.26 and got 1.26.8.
• golang.org/x/net v0.59.0 in capture-sidecar: fixed in v0.60.0.
• operator only, no fixed version: GO-2026-5932 (golang.org/x/crypto/openpgp, reached through cosign) and GO-2026-4529 (github.com/sigstore/cosign/v2 v2.6.5). Both are reached from internal/verify/verify.go. Clearing them means moving the operator off cosign v2. Excluding them is not an option under the spec (FR-008).

Not pushing a fix yet: the dependency and toolchain changes need the owner's sign-off first (CLAUDE.md override 1). This PR stays draft until then.

---

Generated by Claude Code

[github-actions]

CI Report - 0b03a58

run 38323102092 - attempt 1

0 failed - 30 passed - 0 skipped - 76m48s elapsed

Coverage

Module	Measured	Gate	Margin
web	L95.53 S94.07 B88.79 F91.78	L92 S92 B82 F76	+2.07

Changed

Area	Files	+/-
hack/	12	+262/-0
operator/	2	+95/-97
.github/	3	+66/-1
specs/	2	+12/-9
(root)	1	+1/-1

Slowest jobs

Job	Duration
e2e telemetry / amd64 (kind)	23m14s
e2e telemetry / arm64 (kind)	21m50s
build e2e images	14m25s
e2e capture overhead (kind)	12m21s
e2e multicluster / arm64 (kind x2)	10m40s

e2e buckets run

api-agent, api-auth, api-mods, api-rbac, api-roles, bot-fast, multicluster, operator, ratelimit, telemetry, upgrade

[ValgulNecron]

vuln (go) on e98f77a: check-latest worked. The runner now picks up go1.26.9, and every stdlib finding is gone. The fixture proof still catches GO-0000-0001 as it should. Two findings remain, both in operator:

• GO-2026-4529 in github.com/sigstore/cosign/v2@v2.6.5, no fixed version. The fix is fix(operator): verify module signatures with cosign v3 #684, which moves operator/internal/verify to cosign v3.
• GO-2026-5932 in golang.org/x/crypto@v0.57.0 (openpgp), no fixed version. It is reached through cosign v2. After fix(operator): verify module signatures with cosign v3 #684, x/crypto/openpgp is still linked through rekor's pkg/pki/pgp, so whether it stays reachable will only show once fix(operator): verify module signatures with cosign v3 #684 is merged here.

The maintainer chose to keep the cosign migration in its own PR, with this one merging after it. So I'm not copying #684 in here. When #684 merges, I'll merge master into this branch and re-check.

---

Generated by Claude Code