Repository navigation
M9: ready the release, and fix what govulncheck found - #29
Merged
Merged
Conversation
Four things. The release header was still v0.1.0's, and it said goodread routes around the WAF through open endpoints so search and shelves keep working. That is now flatly untrue: both are disallowed and neither is read without --no-robots. Replaced with handwritten v0.3.0 notes, including a breaking-changes section naming every flag and command that moved. GoReleaser puts the generated changelog between the header and the footer, so the notes read as a person explaining what changed with the commit list underneath. The header is rewritten per release rather than kept generic, which sounds like a chore until you notice this one went two releases without anybody reading it. govulncheck ran in ci.yml on main and on PRs, which covers the branch and not the tag. A tag can be cut from a commit that was green a week ago and the database has moved since. It now also runs in the release job, against the exact tree about to be published, before goreleaser starts. Adding it found six, which is the whole point. Five were the standard library in go1.26.5, fixed in go1.26.6, so the release job now sets check-latest on setup-go: without it the runner's cached toolchain can be a patch behind and every standard library CVE fixed in between ships in the binary. The sixth was golang.org/x/text v0.38.0, reached through fang, bumped to v0.39.0. Also dropped "fast, friendly" from the package, image and cask descriptions, which was doing no work.
5 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Continues #17. Covers the goreleaser, govulncheck and release-notes boxes. Does not tag: that is a separate, deliberate step.
The release notes were two releases stale
The
release.headerstill said goodread "routes around the Goodreads WAF through open endpoints so search and shelves keep working". That is now flatly untrue. Both surfaces are disallowed byrobots.txtand neither is read without--no-robots.Replaced with handwritten v0.3.0 notes: the book/work distinction, robots obeyed structurally, the graph, the resumable crawler, the MCP server, and a breaking-changes section naming every flag and command that moved. GoReleaser puts the generated changelog between the header and the footer, so the release page reads as a person explaining what changed with the commit list underneath rather than as a commit list on its own.
The header is rewritten per release rather than kept generic. That sounds like a chore until you notice this one went two releases without anybody reading it.
govulncheck at the tag, not only the branch
ci.ymlruns it on pushes to main and on PRs, which covers the branch. It does not cover the tag. A tag can be cut from a commit that was green a week ago, and the vulnerability database has moved since.It now runs in the release job too, against the exact tree that is about to be published, before goreleaser starts.
Which immediately found six
That is the point of adding it, so this PR fixes them rather than deferring.
Five were the standard library in
go1.26.5, all fixed ingo1.26.6:net/urlcrypto/tlsencoding/xmlencoding/asn1net/http, reached fromClient.doGetThe release job's
setup-gohad nocheck-latest, so the runner's cached toolchain can be a patch or two behind and every standard library CVE fixed in between ships in the binary. It is set now, on both jobs in this workflow, which is whatci.ymlalready did.The sixth, GO-2026-5970 in
golang.org/x/textv0.38.0, is reached throughfangand is bumped to v0.39.0.Local
govulncheck ./...is now clean apart from the five that need go1.26.6, which CI will have.Also
Dropped "fast, friendly" from the nfpm, OCI label, cask and scoop descriptions. It was doing no work.
The container example in the header is
book 2767052rather thansearch "dune", sincesearchis a worse first impression now than it was.Not in this PR
Tagging
v0.3.0, and pulling and running the published image. Both are outward-facing and want a deliberate go-ahead, so they stay on #17.gofmt -l . && go vet ./... && go test ./...andgoreleaser checkare clean.