Skip to content

ci: pin govulncheck by commit SHA to avoid x/tools generics panic #558

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Benehiko wants to merge 2 commits into
base: main
Choose a base branch
from
+11 −1
Open

ci: pin govulncheck by commit SHA to avoid x/tools generics panic #558

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8770fe3
ci: pin govulncheck to v1.3.0 to avoid generics panic
Benehiko Jun 19, 2026
5a66a2b
ci: pin govulncheck by commit SHA and document the v1.4.0 panic root …
Benehiko Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,10 +111,20 @@ RUN --mount=type=bind,target=.,ro \
EOT

FROM golang AS govulncheck
# Pinned to the golang/vuln v1.3.0 commit (SHA, not the mutable tag). govulncheck
# v1.4.0 bumped golang.org/x/tools to v0.46.0, whose new generic-method SSA
# support has an incomplete RuntimeTypes guard: a parameterized type boxed in a
# closure inside a generic method reaches typesinternal.ForEachElement still
# uninstantiated and panics ("ForEachElement called on type containing
# *types.TypeParam"). v1.3.0 uses x/tools v0.44.0 (pre-regression) and scans
# cleanly. Root cause: golang/go#80055 (fix CL go.dev/cl/792260, not yet
# released); govulncheck-facing report: golang/go#80059. Go resolves @<sha> to a
# pseudo-version. Bump once x/tools ships the fix and golang/vuln picks it up.
ARG GOVULNCHECK_VERSION=0782b76014f15f24e22a438f30f308df42899ba1
RUN --mount=type=cache,target=/root/.cache/go-build \
--mount=type=cache,target=/go/pkg/mod \
--mount=type=tmpfs,target=/go/src/ \
go install "golang.org/x/vuln/cmd/govulncheck@latest" \
go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" \
&& govulncheck -version

FROM golang AS do-govulncheck
Expand Down
Loading