From 5df4ccc2b7ed2ebdf3edbd694f9d2158c3e679fa Mon Sep 17 00:00:00 2001 From: Matt <47545907+SoundMatt@users.noreply.github.com> Date: Thu, 30 Jul 2026 15:49:45 -0700 Subject: [PATCH] chore: bump go-FuSa pin to v0.48.0 across ci.yml + release.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit go-FuSa v0.48.0 (upstream go-FuSa#89) fixes a critical bug in hara.DetermineASIL: the hand-written ISO 26262-3:2018 Table 4 lookup was wrong in 8/12 S2 cells and 11/12 S3 cells, always inflating the ASIL rating versus the standard's correct additive S+E+C model. It also fixes a non-reproducible qualify.computeHash (hashed the live timestamp, didn't sort results before hashing), a git argument-injection risk in impact.changedFiles, and a CI SARIF self-scan masking bug; a stale committed check-report.json was removed upstream and a legacy .fusa.json shape normalized. Bump all three pin locations (ci.yml's gofusa job, ci.yml's compliance job, release.yml) to v0.48.0 so they stay identical, per this repo's established convention (#61). Verified locally with go-FuSa v0.48.0: full gofusa lifecycle (check/ trace -req-coverage 100/cyber/vuln/trace -sec-tested 100/qualify/verify/ coverage/hara show/boundary/sci/coupling/tara/fmea -cyber -strict/ release/audit-pack) and the compliance job's additional steps (safety-case/check --output json/all 7 standards gap reports/the negative-count JSON sanity backstop) all pass cleanly, matching CI exactly. go-LIN's own dogfooded .fusa-hara.json (H-01..H-06) was already re-derived under the correct additive model back in #72, so the upstream ASIL-calculation fix surfaces no drift here: `gofusa hara show` reports the same ASIL-A/QM classifications as before, with zero gaps beyond the pre-existing fssrRefs advisories. gofusa cyber still reports the same 28 pre-existing CYBER009 INFO findings (0 error/0 warning) documented in ci.yml's comments; gofusa qualify still passes 46/46; gofusa fmea -strict still clears the content-quality gate. iec62443/slsa show a builder-field GAP when run outside CI (expected — that field is injected by ci.yml's post-release Python step using GITHUB_* env vars) but pass with 0 GAP once that step is simulated locally. go build/vet/test/test -race all green. No new ERROR/GAP/FAIL findings versus v0.47.1; no fixes required beyond the pin bump itself. Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com> --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/release.yml | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4f9a949..f3e2e55 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -167,14 +167,14 @@ jobs: run: relay interop --protocol LIN /tmp/go-lin # ── go-FuSa full safety lifecycle (spec §20.1.2) ────────────────────────── - # Pinned to v0.47.1. §20 makes the full lifecycle normative: every change must + # Pinned to v0.48.0. §20 makes the full lifecycle normative: every change must # pass check (ERROR gate), 100% requirement traceability, cybersecurity # analysis, dependency vulnerability scan, and tool qualification. The # remaining steps generate evidence artifacts (verify/fmea/release) and are # non-gating. To upgrade: install the new version locally, run the gating # commands, fix all findings, then bump the @version pin below. gofusa: - name: go-FuSa full lifecycle (v0.47.1) + name: go-FuSa full lifecycle (v0.48.0) runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 @@ -184,7 +184,7 @@ jobs: go-version: "1.25" - name: Install go-FuSa - run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.47.1 + run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.48.0 - name: gofusa check (gate on ERROR findings) run: gofusa check ./... @@ -282,7 +282,7 @@ jobs: go-version: "1.25" - name: Install go-FuSa - run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.47.1 + run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.48.0 - name: Generate evidence run: | diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index db80654..a380f8b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -26,7 +26,7 @@ jobs: go-version: "1.25" - name: Install go-FuSa - run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.47.1 + run: go install github.com/SoundMatt/go-FuSa/cmd/gofusa@v0.48.0 # -strict enforces the x-FuSa spec §1.6.2 content-quality gate: as of # go-FuSa v0.47.0 (go-FuSa#60) dFMEA entries vary failureMode/effect/