s1d3sw1ped/steamcache2
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Run CI on push to main #11

Merged
s1d3sw1ped merged 9 commits from ci/test-on-push into main 2026-08-31 15:47:07 -05:00
Conversation 6 Commits 9 Files Changed 3
+95 -76
Ghost commented 2026-08-31 15:05:29 -05:00
Copy Link
Copy Source

Main has 5 commits after 1.0.19 that never got Actions, because .gitea/workflows/test-pr.yaml only ran on pull_request.

This keeps the same checks and also runs them on push to main, matching scratchbox.

Main has 5 commits after 1.0.19 that never got Actions, because `.gitea/workflows/test-pr.yaml` only ran on `pull_request`. This keeps the same checks and also runs them on push to `main`, matching scratchbox.
Ghost added 1 commit 2026-08-31 15:05:29 -05:00
Run CI on push to main as well as pull requests.
CI / check-and-test (pull_request) Failing after 1m1s
Details
3d3c74fdb2 
Direct pushes to main currently skip tests because the workflow only listened for pull_request. Scratchbox already tests every push; do the same here.
Ghost added 1 commit 2026-08-31 15:05:29 -05:00
Run CI on push to main as well as pull requests.
CI / check-and-test (pull_request) Failing after 1m1s
Details
3d3c74fdb2 
Direct pushes to main currently skip tests because the workflow only listened for pull_request. Scratchbox already tests every push; do the same here.
Ghost commented 2026-08-31 15:08:12 -05:00
Copy Link
Copy Source

CI failed on the first push: go install golang.org/x/vuln/cmd/govulncheck@latest wants Go 1.25+, and setup-go from go.mod is 1.23 with GOTOOLCHAIN=local.

Build/vet/lint were already green. Pushed a follow-up so that install step uses GOTOOLCHAIN=auto. Tests still have not run; waiting on the new check.

CI failed on the first push: `go install golang.org/x/vuln/cmd/govulncheck@latest` wants Go 1.25+, and setup-go from `go.mod` is 1.23 with `GOTOOLCHAIN=local`. Build/vet/lint were already green. Pushed a follow-up so that install step uses `GOTOOLCHAIN=auto`. Tests still have not run; waiting on the new check.
Ghost added 1 commit 2026-08-31 15:08:13 -05:00
Let govulncheck@latest fetch a newer Go toolchain.
CI / check-and-test (pull_request) Failing after 24s
Details
0c54ef3404 
CI was dying on: golang.org/x/vuln@v1.7.0 requires go >= 1.25.0 (running go 1.23.0; GOTOOLCHAIN=local).
Ghost commented 2026-08-31 15:11:19 -05:00
Copy Link
Copy Source

CI failed on the first push: go install golang.org/x/vuln/cmd/govulncheck@latest wants Go 1.25+, and setup-go from go.mod is 1.23 with GOTOOLCHAIN=local.

Build/vet/lint were already green. Pushed a follow-up so that install step uses GOTOOLCHAIN=auto. Tests still have not run; waiting on the new check.

CI failed on the first push: `go install golang.org/x/vuln/cmd/govulncheck@latest` wants Go 1.25+, and setup-go from `go.mod` is 1.23 with `GOTOOLCHAIN=local`. Build/vet/lint were already green. Pushed a follow-up so that install step uses `GOTOOLCHAIN=auto`. Tests still have not run; waiting on the new check.
Ghost added 1 commit 2026-08-31 15:11:20 -05:00
Let govulncheck@latest fetch a newer Go toolchain.
CI / check-and-test (pull_request) Failing after 22s
Details
e7d4a19c3f 
CI was dying on: golang.org/x/vuln@v1.7.0 requires go >= 1.25.0 (running go 1.23.0; GOTOOLCHAIN=local).
Ghost commented 2026-08-31 15:11:44 -05:00
Copy Link
Copy Source

Next failure was real vulns, not the install: govulncheck on Go 1.23.0 flagged stdlib x509 error-string issues via vfserror.VFSError.Error (fmt.Sprintf -> x509.HostnameError.Error). Exit 3, tests skipped.

Follow-up:

  • check-latest: true so CI uses a patched 1.23, not 1.23.0
  • vulncheck is a separate job so race tests still run if advisories remain
Next failure was real vulns, not the install: `govulncheck` on Go **1.23.0** flagged stdlib `x509` error-string issues via `vfserror.VFSError.Error` (`fmt.Sprintf` -> `x509.HostnameError.Error`). Exit 3, tests skipped. Follow-up: - `check-latest: true` so CI uses a patched 1.23, not 1.23.0 - `vulncheck` is a separate job so race tests still run if advisories remain
Ghost added 1 commit 2026-08-31 15:11:45 -05:00
Use latest Go 1.23 patch in CI and run tests even if govulncheck fails.
CI / vulncheck (pull_request) Failing after 18s
Details
CI / check-and-test (pull_request) Successful in 37s
Details
fbb084d824 
setup-go was installing go.mod's 1.23.0 exactly, so govulncheck reported stdlib x509 findings and skipped tests. check-latest gets the patched 1.23, and vulncheck is its own job.
Ghost commented 2026-08-31 15:15:49 -05:00
Copy Link
Copy Source

vulncheck stayed red on latest 1.23 because 1.23 is EOL (ended 2025-08-12) and never got the later stdlib patches. One of the hits is GO-2025-4008 / CVE-2025-58189 (crypto/tls ALPN error text), fixed in 1.24.8 / 1.25.2.

Raised go.mod to 1.26.0 (supported previous stable; 1.27.0 just landed). Tests already passed on 1.23. Waiting on CI.

vulncheck stayed red on latest 1.23 because 1.23 is EOL (ended 2025-08-12) and never got the later stdlib patches. One of the hits is GO-2025-4008 / CVE-2025-58189 (`crypto/tls` ALPN error text), fixed in 1.24.8 / 1.25.2. Raised `go.mod` to **1.26.0** (supported previous stable; 1.27.0 just landed). Tests already passed on 1.23. Waiting on CI.
Ghost added 1 commit 2026-08-31 15:15:50 -05:00
Raise module Go version from EOL 1.23.0 to 1.26.0.
CI / check-and-test (pull_request) Failing after 11s
Details
CI / vulncheck (pull_request) Failing after 21s
Details
c7a2312994 
govulncheck fails on stdlib crypto/tls and crypto/x509 findings (including GO-2025-4008 / CVE-2025-58189) that were never patched on 1.23. 1.26 is still a supported release.
Ghost commented 2026-08-31 15:19:00 -05:00
Copy Link
Copy Source

setup-go@main with go-version-file is flaky here (version: not found on one job, 1.26.0 stdlib on the other). Pinned checkout/setup-go to v4/v5 and Go 1.26.7 (current 1.26 patch).

setup-go@main with `go-version-file` is flaky here (`version: not found` on one job, 1.26.0 stdlib on the other). Pinned checkout/setup-go to v4/v5 and Go **1.26.7** (current 1.26 patch).
Ghost added 1 commit 2026-08-31 15:19:01 -05:00
Pin CI to Go 1.26.7 and stable action tags.
CI / vulncheck (pull_request) Failing after 13s
Details
CI / check-and-test (pull_request) Failing after 23s
Details
19497eba0c 
setup-go@main plus go-version-file 1.26.0 was flaky (version: not found) and still scanned an unpatched 1.26.0 stdlib.
Ghost commented 2026-08-31 15:23:00 -05:00
Copy Link
Copy Source

Stopping here. I am not merging this.

What this PR is for

  • Run the same checks on push to main, not only on pull_request (main was 5 commits past 1.0.19 with no Actions).
  • Split check-and-test from vulncheck so a vuln advisory does not skip tests.

What we learned

  • Run 900: check-and-test green on latest Go 1.23. vulncheck red because 1.23 is EOL (ended 2025-08-12) and never got later stdlib patches. One hit is GO-2025-4008 / CVE-2025-58189 (crypto/tls ALPN error text), via vfserror.VFSError.Error -> fmt.Sprintf -> x509.HostnameError.Error.
  • Bumping go.mod toward 1.26 is the right direction. Current head pins CI to Go 1.26.7 + setup-go v5; that got past the setup-go flake, then golangci-lint-action@v4 failed and govulncheck@latest failed to install again.

Not merging. Ash should finish making CI green on supported Go (1.26.7 or 1.27): newer golangci-lint action, a working govulncheck install/action, keep tests on push to main. Do not drop the vuln job to sneak a merge.

Stopping here. I am not merging this. **What this PR is for** - Run the same checks on push to `main`, not only on pull_request (main was 5 commits past 1.0.19 with no Actions). - Split `check-and-test` from `vulncheck` so a vuln advisory does not skip tests. **What we learned** - Run 900: `check-and-test` **green** on latest Go 1.23. `vulncheck` **red** because 1.23 is EOL (ended 2025-08-12) and never got later stdlib patches. One hit is GO-2025-4008 / CVE-2025-58189 (`crypto/tls` ALPN error text), via `vfserror.VFSError.Error` -> `fmt.Sprintf` -> `x509.HostnameError.Error`. - Bumping `go.mod` toward 1.26 is the right direction. Current head pins CI to Go 1.26.7 + setup-go v5; that got past the setup-go flake, then **golangci-lint-action@v4** failed and `govulncheck@latest` failed to install again. **Not merging.** Ash should finish making CI green on supported Go (1.26.7 or 1.27): newer golangci-lint action, a working govulncheck install/action, keep tests on push to main. Do not drop the vuln job to sneak a merge.
Ghost added 1 commit 2026-08-31 15:27:37 -05:00
Fix CI on Go 1.26.7: golangci-lint-action v8 and vulncheck on 1.27.
CI / vulncheck (pull_request) Successful in 19s
Details
CI / check-and-test (pull_request) Failing after 27s
Details
79f02d9868 
v4 installs golangci-lint v1.64.8 (built with Go 1.24) which cannot lint a
1.26 module; v8 pulls v2.12. govulncheck@latest still fails to install on
1.26.7, so run that job on Go 1.27. Keep tests on push to main.
Ghost added 1 commit 2026-08-31 15:28:56 -05:00
Drop empty gosec settings so golangci-lint v2 config verifies.
CI / vulncheck (pull_request) Successful in 7s
Details
CI / check-and-test (pull_request) Failing after 13s
Details
36b613b6cd
Ghost added 1 commit 2026-08-31 15:30:37 -05:00
Keep v1 lint rules under golangci-lint v2 (no ST/QF, no G704/G705).
CI / vulncheck (pull_request) Successful in 7s
Details
CI / check-and-test (pull_request) Successful in 38s
Details
35d698a232
s1d3sw1ped merged commit d63d7b4d3c into main 2026-08-31 15:47:07 -05:00
s1d3sw1ped deleted branch ci/test-on-push 2026-08-31 15:47:07 -05:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 draft
Draft for review — do not merge without Eva review
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ash blake eva linus moss pike s1d3sw1ped
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: s1d3sw1ped/steamcache2#11
Delete Branch "ci/test-on-push"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?