Repository navigation
ci: check dependencies with gosocialcheck - #53979
AkihiroSuda wants to merge 1 commit into
Conversation
AkihiroSuda
added
kind/enhancement
1512e98 to
0d7adbe
Compare
| // Docker, Moby, and golang.org/x packages are trusted | ||
| //gosocialcheck:trusted | ||
| require ( | ||
| github.com/moby/docker-image-spec v1.3.1 // indirect | ||
| golang.org/x/sys v0.33.0 // indirect | ||
| ) |
There was a problem hiding this comment.
Is this something that can be configured through other ways? If I'm not mistaken, go (finally!?) started fixing grouping in go.mod to prevent multiple groups (multiple direct / indirect).
Also slightly wondering what makes decisions in CNCF projects more trust-worthy than (e.g.) moby itself? (I've seen some poor choices and messy dependency-management in CNCF)
There was a problem hiding this comment.
Is this something that can be configured through other ways?
Updated to use inline comments instead of require() group comments
If I'm not mistaken, go (finally!?) started fixing grouping in
go.modto prevent multiple groups (multiple direct / indirect).
Yes, seems started in Go 1.27 😞
Also slightly wondering what makes decisions in CNCF projects more trust-worthy than (e.g.) moby itself?
s/CNCF projects/CNCF graduated projects/
s/more/same/
(I've seen some poor choices and messy dependency-management in CNCF)
https://github.com/cncf/toc/blob/main/.github/ISSUE_TEMPLATE/template-graduation-application.md#security could be improved?
| name: Install gosocialcheck | ||
| run: | | ||
| go install "github.com/AkihiroSuda/gosocialcheck/cmd/gosocialcheck@${GOSOCIALCHECK_VERSION}" |
There was a problem hiding this comment.
Could this run as linter in golangci-lint? Similar to (e.g.) forbidigo ?
There was a problem hiding this comment.
Not sure, as gosocialcheck is a linter for go.mod rather than Go source codes themselves.
Could be experimented as a plugin anyway
b9a5830 to
fa0e781
Compare
fa0e781 to
aeaab91
Compare
Run gosocialcheck to check whether the dependencies of the main module, api, and client are adopted by trusted projects (i.e., CNCF graduated projects). Findings are reported as GitHub Actions annotations on go.sum and do not fail the job. Docker, Moby, and golang.org/x packages are annotated as trusted in go.mod. https://github.com/AkihiroSuda/gosocialcheck Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
aeaab91 to
58e3f82
Compare
Summary
Run gosocialcheck to check whether the dependencies of the main module, api, and client are adopted by trusted projects (i.e., CNCF graduated projects).
Findings are reported as GitHub Actions annotations on
go.sumand do not fail the job.Docker, Moby, and golang.org/x packages are annotated as trusted (
//gosocialcheck:trusted) ingo.mod.https://github.com/AkihiroSuda/gosocialcheck
See:
Release notes (optional)
A picture of a cute animal (not mandatory but encouraged)
Created with: Claude Code