v0.9.0 compliance: full upgrade against core/go reference #3
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| # Woodpecker CI pipeline. | ||
| # Server: ci.lthn.sh. Lint + sonar in parallel, both depend only on clone. | ||
| # sonar_token is admin-scoped on the Woodpecker server. | ||
|
|
||
| when: | ||
| - event: push | ||
| branch: [dev, main] | ||
|
|
||
| steps: | ||
| - name: phpstan | ||
| image: ghcr.io/phpstan/phpstan:latest | ||
| depends_on: [] | ||
| commands: | ||
| - if [ -f phpstan.neon ] || [ -f phpstan.neon.dist ]; then phpstan analyse --no-progress --memory-limit=1G; else echo 'no phpstan config — sonar-only'; fi | ||
|
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "PHPStan config files:"
fd -HI -t f 'phpstan.neon*' || true
for f in $(fd -HI -t f 'phpstan.neon*'); do
echo
echo "---- $f ----"
rg -n 'autoload|bootstrap|includes|extension|vendor/' "$f" || true
done
echo
echo "Composer manifests (if present):"
fd -HI -t f 'composer.json' || trueRepository: dAppCore/php Length of output: 200 🏁 Script executed: cat phpstan.neonRepository: dAppCore/php Length of output: 867 🏁 Script executed: cat .woodpecker.ymlRepository: dAppCore/php Length of output: 754 🏁 Script executed: wc -l .woodpecker.yml && cat -n .woodpecker.ymlRepository: dAppCore/php Length of output: 934 🏁 Script executed: # Check if there's a composer.lock and if vendor directory would be cloned
fd -t d vendorRepository: dAppCore/php Length of output: 38 Install Composer dependencies before running PHPStan analysis. The phpstan container executes without 🤖 Prompt for AI Agents |
||
| - name: sonar | ||
| image: sonarsource/sonar-scanner-cli:latest | ||
| depends_on: [] | ||
| environment: | ||
| SONAR_HOST_URL: https://sonar.lthn.sh | ||
| SONAR_TOKEN: | ||
| from_secret: sonar_token | ||
| commands: | ||
| - sonar-scanner | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,91 +1,76 @@ | ||
| module dappco.re/go/php | ||
|
|
||
| go 1.26.2 | ||
|
|
||
| require ( | ||
| dappco.re/go v0.9.0 | ||
| dappco.re/go/cli v0.9.0 | ||
| dappco.re/go/i18n v0.9.0 | ||
| dappco.re/go/io v0.9.0 | ||
| github.com/dunglas/frankenphp v1.12.1 | ||
| gopkg.in/yaml.v3 v3.0.1 | ||
| ) | ||
|
|
||
| require ( | ||
| github.com/klauspost/compress v1.18.5 // indirect | ||
| github.com/stretchr/testify v1.11.1 // indirect | ||
| ) | ||
|
|
||
| require ( | ||
| dappco.re/go/inference v0.9.0 // indirect | ||
| dappco.re/go/log v0.9.0 // indirect | ||
|
Comment on lines
14
to
+21
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
govulncheck ./...Repository: dAppCore/php Length of output: 108 🏁 Script executed: # Check if go.mod exists and examine its contents
if [ -f "go.mod" ]; then
echo "=== go.mod found ==="
cat -n go.mod
else
echo "=== go.mod NOT found ==="
find . -name "go.mod" -type f 2>/dev/null | head -20
fiRepository: dAppCore/php Length of output: 3477 🏁 Script executed: # Search for Mercure in the dependency files
if [ -f "go.sum" ]; then
echo "=== Searching for mercure in go.sum ==="
rg "mercure" go.sum || echo "No mercure found in go.sum"
fiRepository: dAppCore/php Length of output: 271 🌐 Web query:
💡 Result: GHSA-hwr4-mq23-wcv5 is a GitHub security advisory for the Mercure project (github.com/dunglas/mercure), published on April 8, 2026. It describes a cache key collision vulnerability in the TopicSelectorStore component. Vulnerability details: The cache key was constructed by concatenating the topic selector and topic with an underscore separator (k = "m_" + topicSelector + "_" + topic). Since both can contain underscores, distinct pairs can collide, e.g., selector="foo_bar" topic="baz" and selector="foo" topic="bar_baz" both produce "m_foo_bar_baz". An attacker who can subscribe or publish with crafted topics can poison the cache, causing private updates to be delivered to unauthorized subscribers or blocking authorized ones (CWE-1289: Improper Validation of Integrity Check Value). Impact: Bypasses authorization checks on private updates if the attacker can interact with the hub. Affected versions: < 0.22.0 Patched in: v0.22.0 (released April 8, 2026), which replaces string keys with a typed struct {topicSelector string; topic string} for collision-free hashing, removes sharded cache (~38% faster), and uses a single otter cache. Workaround: Disable topic selector cache by setting topic_selector_cache to -1 in Caddyfile or 0 in library usage (reduces performance). Severity: High (CVSS v4: 7.1 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N) CVE: CVE-2026-39972 References: Official advisory at GHSA-hwr4-mq23-wcv5, GitHub advisories GHSA-hwr4-mq23-wcv5, release https://github.com/dunglas/mercure/releases/tag/v0.22.0. Citations:
Upgrade The dependency graph includes 🤖 Prompt for AI Agents |
||
| github.com/MauriceGit/skiplist v0.0.0-20211105230623-77f5c8d3e145 // indirect | ||
| github.com/RoaringBitmap/roaring/v2 v2.15.0 // indirect | ||
| github.com/beorn7/perks v1.0.1 // indirect | ||
| github.com/bits-and-blooms/bitset v1.24.4 // indirect | ||
| github.com/cespare/xxhash/v2 v2.3.0 // indirect | ||
| github.com/charmbracelet/x/ansi v0.11.6 // indirect | ||
| github.com/clipperhouse/displaywidth v0.11.0 // indirect | ||
| github.com/clipperhouse/uax29/v2 v2.7.0 // indirect | ||
| github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect | ||
| github.com/dunglas/mercure v0.21.11 // indirect | ||
| github.com/dunglas/skipfilter v1.0.0 // indirect | ||
| github.com/e-dant/watcher v0.0.0-20260223030516-06f84a1314be // indirect | ||
| github.com/felixge/httpsnoop v1.0.4 // indirect | ||
| github.com/fsnotify/fsnotify v1.9.0 // indirect | ||
| github.com/go-viper/mapstructure/v2 v2.5.0 // indirect | ||
| github.com/gofrs/uuid/v5 v5.4.0 // indirect | ||
| github.com/golang-jwt/jwt/v5 v5.3.1 // indirect | ||
| github.com/gorilla/handlers v1.5.2 // indirect | ||
| github.com/gorilla/mux v1.8.1 // indirect | ||
| github.com/lucasb-eyer/go-colorful v1.3.0 // indirect | ||
| github.com/mattn/go-runewidth v0.0.21 // indirect | ||
| github.com/maypok86/otter/v2 v2.3.0 // indirect | ||
| github.com/mschoch/smat v0.2.0 // indirect | ||
| github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect | ||
| github.com/pelletier/go-toml/v2 v2.2.4 // indirect | ||
| github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect | ||
| github.com/prometheus/client_golang v1.23.2 // indirect | ||
| github.com/prometheus/client_model v0.6.2 // indirect | ||
| github.com/prometheus/common v0.67.5 // indirect | ||
| github.com/prometheus/procfs v0.20.1 // indirect | ||
| github.com/rogpeppe/go-internal v1.14.1 // indirect | ||
| github.com/rs/cors v1.11.1 // indirect | ||
| github.com/sagikazarmark/locafero v0.12.0 // indirect | ||
| github.com/spf13/afero v1.15.0 // indirect | ||
| github.com/spf13/cast v1.10.0 // indirect | ||
| github.com/spf13/pflag v1.0.10 // indirect | ||
| github.com/spf13/viper v1.21.0 // indirect | ||
| github.com/subosito/gotenv v1.6.0 // indirect | ||
| github.com/unrolled/secure v1.17.0 // indirect | ||
| github.com/yosida95/uritemplate/v3 v3.0.2 // indirect | ||
| go.etcd.io/bbolt v1.4.3 // indirect | ||
| go.yaml.in/yaml/v2 v2.4.4 // indirect | ||
| go.yaml.in/yaml/v3 v3.0.4 // indirect | ||
| golang.org/x/crypto v0.50.0 // indirect | ||
| golang.org/x/net v0.53.0 // indirect | ||
| golang.org/x/sys v0.43.0 // indirect | ||
| golang.org/x/term v0.42.0 // indirect | ||
| golang.org/x/text v0.36.0 // indirect | ||
| google.golang.org/protobuf v1.36.11 // indirect | ||
| ) | ||
|
|
||
| replace ( | ||
| dappco.re/go/cli => ./internal/clishim | ||
| dappco.re/go/i18n => ./internal/i18nshim | ||
| ) | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Avoid admin-scoped Sonar tokens in CI.
Line 3 indicates the pipeline uses an admin-scoped token. That is broader access than needed and increases blast radius if leaked. Use a project-scoped analysis token instead and rotate the current secret.
🤖 Prompt for AI Agents