Repository navigation
fix(security): build with patched Go 1.27.3 toolchain - #72
Conversation
|
🦞👀 Pull request received. I will update this pull request when review starts. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Merged as ee3e4b6 with exact-head PR and main CI green. Native macOS govulncheck reproduced reachable GO-2026-6809 on Go 1.27.2 and is clean on Go 1.27.3. Local Go build/tests/vet and package smoke tests passed. Released v0.2.1 after the complete release dry run passed. The fleet SSH-signed tag verifies locally and on GitHub. All 11 expected assets are present; downloaded archive/package checksums match. All six platform binaries report Go 1.27.3, and both macOS binaries pass online notarization and Foundation Team ID checks. Release notes match the tagged changelog. npm 0.2.1 is latest; its registry integrity matches the released tarball. The Go proxy resolves the signed source commit. Homebrew's v0.2.1 update passed and its URLs/checksums match the downloaded release archives. No service deployment was performed. |
Explicitly select Go 1.27.3 in every setup-go invocation, preserving the Go 1.27.1 source minimum and existing source toolchain declaration. Follow-up to #72: go-version-file makes setup-go select the language minimum before consulting the toolchain directive. The explicit version prevents this older setup selection in CI, release, benchmark, and results workflows. All six published v0.2.1 binaries already independently verify as Go 1.27.3 through source toolchain switching; no replacement release is needed. Validation: actionlint passes; independent P0–P3 autoreview found no actionable issues. Exact-head CI verifies both Linux and macOS packaging.
1 participant
Select Go 1.27.3 for source, CI, and release builds while retaining the Go 1.27.1 language minimum. All Go workflows select the toolchain from go.mod. Update the README and changelog to match.
On native macOS, the Go 1.27.2 baseline reaches GO-2026-6809 through
HuggingFaceBenchmarkClient.FetchSkillTrustBenchRowsatinternal/runner/benchmark.go:835, thenbufio.Scanner.Scanandx509.Certificate.Verify. The same symbol-levelgovulncheck ./...scan is clean on Go 1.27.3.Validation:
go build ./...,go test -count=1 ./...,go vet ./..., npm wrapper and package-builder tests, andnode scripts/build-npm-package.mjs --version v0.0.0 --pack --smokepass. Independent P0–P3 autoreview found no actionable issues. A patch release will follow after exact-head CI and release preflight pass.This PR also prepares the dated v0.2.1 changelog so the same reviewed source can pass the tag-driven release preflight. The empty Unreleased section is retained for subsequent work.