git » chasquid » commit d226018

github: Note that govulncheck is run on the latest Go version

github: Note that govulncheck is run on the latest Go version

When running govulncheck, if we use go.mod's version, that is the oldest
Go version that we expect to build chasquid.

However, that specific version is often 1.x.0 and can include
vulnerabilities that are fixed in later patch releases. This can cause
govulncheck to complain, which introduces noise in the CI.

Instead, we should run govulncheck on the latest Go version, to make
sure that any reports are about our code or the dependencies, and not
the toolchain.

That behaviour is in place today, but it's not obvious from the config.

This patch updates the config to note this more explicitly, to prevent
future confusion.

diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 2143416..3666238 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -17,7 +17,10 @@ jobs:
       - uses: actions/checkout@v7
       - uses: actions/setup-go@v7
         with:
-          go-version: ">=1.19.2"
+          # Note this is intentionally the latest 1.x version, not the one we
+          # use in go.mod, as that avoids noise if there are vulnerabilities
+          # in the Go toolchain itself.
+          go-version: ">=1.x"
           check-latest: true
       - name: install govulncheck
         run: go install golang.org/x/vuln/cmd/govulncheck@latest