chore(security): suppress GO-2026-5932 openpgp code-scanning noise at source#287
Merged
Charles Chiu (charliie-dev) merged 5 commits intoJul 16, 2026
Merged
Conversation
govulncheck has no native ignore flag, so filter the SARIF in-place before upload. GO-2026-5932 (golang.org/x/crypto/openpgp unmaintained) fires on the transitively-present openpgp subpackage whose symbols are never called (govulncheck reports no reachable symbols) and has no fixed version, so it is non-actionable noise. Scoped to this one ID so real reachable vulns still surface; fail-safe leaves the original SARIF intact on any error. Refs #286
…026-5932 Extend the existing keep() SARIF filter to drop the Scorecard Vulnerabilities finding when the sole vuln it reports is GO-2026-5932, mirroring the govulncheck filter in security-sarif.yml. Matched by exact ID set so a finding that also lists a real reachable vuln is kept. Refs #286
Document the govulncheck SARIF filter and the scorecard keep() extension so a future maintainer does not simplify them away. Refs #286
Contributor
There was a problem hiding this comment.
Pull request overview
此 PR 在共用安全工作流程中精準過濾 GO-2026-5932 掃描雜訊。
Changes:
- 過濾 govulncheck SARIF 結果。
- 擴充 Scorecard 弱點過濾規則。
- 更新安全工作流程文件。
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
CLAUDE.md |
記錄新增的弱點過濾行為 |
.github/workflows/security-sarif.yml |
過濾 govulncheck SARIF |
.github/workflows/scorecard.yml |
過濾 Scorecard 特定弱點結果 |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…uleIndex Only drop the govulncheck finding at note level (module is a dependency but the vulnerable symbols are not called). warning (package imported) and error (symbol called) stay visible, so a genuinely reachable openpgp use surfaces if a downstream repo ever calls it. Also resolve the rule id via the SARIF 2.1.0 top-level `ruleIndex` (with `rule.index` as a secondary fallback) so an index-only result is matched correctly. Refs #286
The Scorecard Vulnerabilities check aggregates OSV findings across ecosystems,
so a VulnerabilitiesID message may list GO-2026-5932 alongside OSV-*/PYSEC-*/
RUSTSEC-* IDs. The previous fixed GO/CVE/GHSA regex silently ignored other
prefixes, so the set could still equal {GO-2026-5932} and drop a finding that
also reported a real vuln. Extract the full text after each "Project is
vulnerable to:" line instead, so any co-listed or unrecognized ID keeps the
finding (fail-safe); only a sole GO-2026-5932 is dropped.
Refs #286
Charles Chiu (charliie-dev)
deleted the
feature/suppress-openpgp-govulncheck
branch
July 16, 2026 07:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Suppress the
GO-2026-5932(golang.org/x/crypto/openpgpunmaintained) code-scanning noise at source in meta's reusable workflows, so downstream Go repos stop surfacing this non-actionable advisory on every scan.security-sarif.yml: post-filter the govulncheck SARIF to dropGO-2026-5932before upload (govulncheck has no native ignore flag).scorecard.yml: extend the existingkeep()SARIF filter to dropVulnerabilitiesIDfindings whose sole reported vuln isGO-2026-5932.Why
govulncheck confirms across every repo that the symbols are not reachable ("doesn't appear to call any of the vulnerable symbols"); the openpgp subpackage is only transitively present via
golang.org/x/crypto, and the advisory has no fixed version. It surfaced twice per Go repo (govulnchecknote+ ScorecardVulnerabilitiesIDhigh). The 14 live org alerts were manually dismissed; this makes the suppression durable.Both filters are scoped to the single ID so real reachable vulns still surface, and are fail-safe (original SARIF kept on error). Mirrors the posture-noise filter pattern from #265/#268.
Verification
mise run iac:actionlinton both workflows: 0 issues.GO-2026-5932by bothruleIdand ruleindex, keeps a co-listed real vuln.GO-2026-5932, keeps when it also lists a realCVE-*.Closes #286