[go-fan] Go Module Review: golang.org/x/vuln (govulncheck)

[github-actions]

🐹 Go Fan Report: golang.org/x/vuln

Module Overview

golang.org/x/vuln is the home of govulncheck, Go's official vulnerability scanner. It checks a module against the curated Go vulnerability database (vuln.go.dev) and uses static call-graph analysis to report only vulnerabilities actually reachable from your code (symbol-level scanning) — far fewer false positives than dependency-version-only scanners. In gh-aw it's consumed purely as a build-time CLI tool, never as a Go library API.

Current Usage in gh-aw

• Files: 3 (tools.go, Makefile, .github/workflows/security-scan.yml)
• Import Count: 1 (a single blank import)
• Key APIs Used: none at the Go API level — only the govulncheck command.

Where & how it's wired in

• tools.go — _ "golang.org/x/vuln/cmd/govulncheck" under //go:build tools, pinning the tool in go.mod/go.sum (the idiomatic build-tool pattern 👍).
• Makefile → security-govulncheck: go run golang.org/x/vuln/cmd/govulncheck ./... (runs the pinned v1.4.0, text output).
• .github/workflows/security-scan.yml → govulncheck job: golang/govulncheck-action@v1.0.4 (SHA-pinned) → SARIF → uploaded to GitHub code scanning.

Research Findings

• Version: go.mod pins v1.4.0; the latest upstream module tag is v1.5.0. The v1.4.0→v1.5.0 diff is just 2 dependency-bump commits (update to x/tools@0602b30930e3) — no CLI/behavior change, low-risk.
• govulncheck defaults to -scan symbol (most precise) and supports -format sarif|json|text. gh-aw already gets symbol-level precision for free.

Recent Updates

• v1.5.0 is a maintenance/dependency refresh of x/vuln — no new flags or scanning behavior to adopt.

⚠️ Key finding: local ↔ CI version drift

The CI action golang/govulncheck-action@v1.0.4 (latest release, from 2024) internally runs go install golang.org/x/vuln/cmd/govulncheck@latest. So CI scans with an always-latest, unpinned govulncheck, while the Makefile uses the go.mod-pinned v1.4.0. The action also runs its own actions/setup-go with go-version: stable, which overrides the workflow's earlier go-version-file: go.mod step. Result: CI results aren't reproducible, and the explicit checkout/setup-go steps in the job are redundant with what the action does internally.

Improvement Opportunities

🏃 Quick Wins

• Bump golang.org/x/vuln v1.4.0 → v1.5.0 (go get -u golang.org/x/vuln@v1.5.0 && go mod tidy). Dependency-only, low risk; keeps the locally-pinned scanner current.
• Optionally go install the tool once rather than go run recompiling it each invocation (gosec target already does conditional install). Keep the module path + version if you switch, to preserve pinning.

✨ Feature Opportunities

• Add a security-govulncheck-sarif Make variant (govulncheck -format sarif ./...) so devs can reproduce the exact CI SARIF artifact locally before pushing.

📐 Best Practice Alignment

• Pin govulncheck in CI for reproducibility. Either (a) run govulncheck directly in CI mirroring the Makefile's go.mod-pinned version and upload-sarif the result (removes the unpinned @latest), or (b) consciously accept the action's @latest behavior for its convenient SARIF wiring.
• Remove redundant steps in the govulncheck job — the explicit actions/checkout + actions/setup-go are re-run by the action internally. Or pass go-version-file: go.mod to the action so the scanner builds under the project's go 1.26.3 toolchain instead of stable.

🔧 General Improvements

• The //go:build tools isolation is exactly right — govulncheck stays out of the production binary's dependency graph. No change needed.

Recommendations (prioritized)

1. Pin the govulncheck version used in CI (reproducibility / supply-chain hygiene).
2. Bump x/vuln v1.4.0 → v1.5.0 (trivial, keeps local in sync).
3. Trim redundant checkout/setup-go in the workflow, or align the action's Go toolchain to go.mod.
4. (Nice-to-have) Local SARIF Make target for CI parity.

Next Steps

• Open a small PR for the v1.5.0 bump + a CI reproducibility tweak; verify make security-govulncheck still passes clean.

---

Generated by Go Fan
Module summary saved to: scratchpad/mods/golang-x-vuln.md

Generated by 🐹 Go Fan · 102.5 AIC · ⌖ 12.7 AIC · ⊞ 7.4K · ◷

• expires on Jun 27, 2026, 12:57 AM UTC-08:00

[github-actions]

🍪 Issue Monster selected this for Copilot

I've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.

If assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.

Om nom nom! 🍪

🍪 Om nom nom by Issue Monster · 3.78 AIC · ⌖ 26.9 AIC · ⊞ 6.9K · ◷

[github-actions]

This issue was automatically closed because it expired on 2026-06-27T08:57:34.507Z.

Closed by Workflow