ci(lab9): govulncheck gate - #3
Conversation
Signed-off-by: HNS <239804565+HNS2112@users.noreply.github.com>
Signed-off-by: HNS <239804565+HNS2112@users.noreply.github.com>
Signed-off-by: Elvira <239804565+HNS2112@users.noreply.github.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec668977c7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| FROM golang:1.24.6-bookworm AS builder | ||
| WORKDIR /src | ||
| COPY go.mod go.su[m] ./ |
There was a problem hiding this comment.
In a fresh checkout this Dockerfile cannot build because app/go.sum is not tracked, while Docker treats go.su[m] as a glob that only matches go.sum, not as an optional source. The failure happens before go mod download, so any docker compose build/Lab 6 image rebuild from the committed tree stops at this COPY; either add a real go.sum or avoid copying it until it exists.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,24 @@ | |||
| # syntax=docker/dockerfile:1 | |||
|
|
|||
| FROM golang:1.24.6-bookworm AS builder | |||
There was a problem hiding this comment.
This pins the shipped binary to Go 1.24.6, but the committed Trivy image report shows the resulting app/quicknotes binary has 15 HIGH/CRITICAL stdlib findings at v1.24.6, including fixes available in 1.24.12/1.24.13. Because the new CI job uses go-version-input: '1.24' rather than this Dockerfile pin, CI can pass with a newer patch while the container artifact remains vulnerable; bump the builder image to a patched 1.24.x tag or otherwise align the image build with the gate.
Useful? React with 👍 / 👎.
| zap-report.* | ||
| zap-report-after.* |
There was a problem hiding this comment.
Because this ignore pattern has no slash, Git applies it to matching files in any directory, even though the note just above says Lab 9 ZAP reports are deliverables students must be able to commit. A student who generates a new untracked zap-report.html/.json under their submission or evidence directory will have it silently ignored unless they force-add it; if these are only meant to be root scratch files, anchor the patterns with /.
Useful? React with 👍 / 👎.
| Regression test, covering two routes rather than one so that a future route added | ||
| outside `wrap` is caught: | ||
|
|
||
| ```go | ||
| func TestSecurityHeaders_PresentOnAllRoutes(t *testing.T) { |
There was a problem hiding this comment.
The submission claims this regression test was added, but the actual Go test file only loses a blank line and rg TestSecurityHeaders app finds no implementation. In the Lab 9 flow this test is the guard that the middleware stays applied to all routes, so the code can now regress without CI noticing; add the test to app/handlers_test.go or remove the claimed evidence.
Useful? React with 👍 / 👎.
Signed-off-by: Elvira <239804565+HNS2112@users.noreply.github.com>
Signed-off-by: Elvira <239804565+HNS2112@users.noreply.github.com>
1 participant
Internal PR to exercise the CI gate with govulncheck.