Skip to content

chore(security): suppress GO-2026-5932 openpgp code-scanning noise at source#287

Merged
Charles Chiu (charliie-dev) merged 5 commits into
devfrom
feature/suppress-openpgp-govulncheck
Jul 16, 2026
Merged

chore(security): suppress GO-2026-5932 openpgp code-scanning noise at source#287
Charles Chiu (charliie-dev) merged 5 commits into
devfrom
feature/suppress-openpgp-govulncheck

Conversation

@charliie-dev

Copy link
Copy Markdown
Contributor

What

Suppress the GO-2026-5932 (golang.org/x/crypto/openpgp unmaintained) code-scanning noise at source in meta's reusable workflows, so downstream Go repos stop surfacing this non-actionable advisory on every scan.

  • security-sarif.yml: post-filter the govulncheck SARIF to drop GO-2026-5932 before upload (govulncheck has no native ignore flag).
  • scorecard.yml: extend the existing keep() SARIF filter to drop VulnerabilitiesID findings whose sole reported vuln is GO-2026-5932.

Why

govulncheck confirms across every repo that the symbols are not reachable ("doesn't appear to call any of the vulnerable symbols"); the openpgp subpackage is only transitively present via golang.org/x/crypto, and the advisory has no fixed version. It surfaced twice per Go repo (govulncheck note + Scorecard VulnerabilitiesID high). The 14 live org alerts were manually dismissed; this makes the suppression durable.

Both filters are scoped to the single ID so real reachable vulns still surface, and are fail-safe (original SARIF kept on error). Mirrors the posture-noise filter pattern from #265/#268.

Verification

  • mise run iac:actionlint on both workflows: 0 issues.
  • Python filter logic unit-checked with sample SARIF:
    • govulncheck: removes GO-2026-5932 by both ruleId and rule index, keeps a co-listed real vuln.
    • scorecard: drops when the message lists only GO-2026-5932, keeps when it also lists a real CVE-*.

Closes #286

govulncheck has no native ignore flag, so filter the SARIF in-place before
upload. GO-2026-5932 (golang.org/x/crypto/openpgp unmaintained) fires on the
transitively-present openpgp subpackage whose symbols are never called
(govulncheck reports no reachable symbols) and has no fixed version, so it is
non-actionable noise. Scoped to this one ID so real reachable vulns still
surface; fail-safe leaves the original SARIF intact on any error.

Refs #286
…026-5932

Extend the existing keep() SARIF filter to drop the Scorecard Vulnerabilities
finding when the sole vuln it reports is GO-2026-5932, mirroring the
govulncheck filter in security-sarif.yml. Matched by exact ID set so a finding
that also lists a real reachable vuln is kept.

Refs #286
Document the govulncheck SARIF filter and the scorecard keep() extension so a
future maintainer does not simplify them away.

Refs #286

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

此 PR 在共用安全工作流程中精準過濾 GO-2026-5932 掃描雜訊。

Changes:

  • 過濾 govulncheck SARIF 結果。
  • 擴充 Scorecard 弱點過濾規則。
  • 更新安全工作流程文件。

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File Description
CLAUDE.md 記錄新增的弱點過濾行為
.github/workflows/security-sarif.yml 過濾 govulncheck SARIF
.github/workflows/scorecard.yml 過濾 Scorecard 特定弱點結果

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/security-sarif.yml Outdated
Comment thread .github/workflows/security-sarif.yml Outdated
…uleIndex

Only drop the govulncheck finding at note level (module is a dependency but the
vulnerable symbols are not called). warning (package imported) and error (symbol
called) stay visible, so a genuinely reachable openpgp use surfaces if a
downstream repo ever calls it. Also resolve the rule id via the SARIF 2.1.0
top-level `ruleIndex` (with `rule.index` as a secondary fallback) so an
index-only result is matched correctly.

Refs #286
Copilot AI review requested due to automatic review settings July 16, 2026 07:12

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comment thread .github/workflows/scorecard.yml Outdated
The Scorecard Vulnerabilities check aggregates OSV findings across ecosystems,
so a VulnerabilitiesID message may list GO-2026-5932 alongside OSV-*/PYSEC-*/
RUSTSEC-* IDs. The previous fixed GO/CVE/GHSA regex silently ignored other
prefixes, so the set could still equal {GO-2026-5932} and drop a finding that
also reported a real vuln. Extract the full text after each "Project is
vulnerable to:" line instead, so any co-listed or unrecognized ID keeps the
finding (fail-safe); only a sole GO-2026-5932 is dropped.

Refs #286
Copilot AI review requested due to automatic review settings July 16, 2026 07:18

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

@charliie-dev
Charles Chiu (charliie-dev) merged commit 62e0a85 into dev Jul 16, 2026
10 checks passed
@charliie-dev
Charles Chiu (charliie-dev) deleted the feature/suppress-openpgp-govulncheck branch July 16, 2026 07:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore(security): suppress GO-2026-5932 openpgp code-scanning noise at source

2 participants