mirror of
https://github.com/boshu2/agentops.git
synced 2026-09-14 15:08:13 +08:00
boshu
297dd022b5
Sweep 2026-07-09-claude M-2 + M-3, the arc that turns the GO-2026-4970 catch into a standing gate: eg2n: run_govulncheck in scripts/toolchain-validate.sh (mirrors run_gosec: gate-scope skip, per-module run, exit 0/3 = ran, anything else = loud tool error). Every reachable finding counts SECURITY HIGH so the gate BLOCKs - govulncheck's callgraph mode means a finding is a known CVE on a live path. Pinned govulncheck@v1.6.0 installed in validate.yml security job + nightly scanner suite; nightly is the standing lane that catches CVEs published AFTER code lands. Real-data measurement: go1.26.3 scanned 2 hits (sweep); landed go1.26.5 scans clean (No vulnerabilities found, rc 0). 7u00: every scanner the gate trusts is now pinned - gosec@v2.27.1, gitleaks@v8.30.1, semgrep==1.169.0, ruff==0.15.21, radon==6.0.1, pytest==9.1.1, hadolint v2.14.0, yq v4.53.3 (2 sites), and validate.yml's trivy no longer pipes the MUTABLE main-branch install script (pinned v0.72.0 download-then-execute, mirroring nightly). release.yml gosec/ gitleaks/semgrep pinned too. Zero @latest / releases/latest remain in .github/workflows/. Claude-Session: https://claude.ai/code/session_01BkgdP88SiccCSyYdi8GHNa