aether/vociferate
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 7 Wiki Activity

docs: record gosec toolchain fix

Browse Source
This commit is contained in:
Micheal Wilkinson
2026-03-21 15:14:01 +00:00
parent 38afdeffa0
commit dd86944e64
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -39,6 +39,7 @@ A `### Breaking` section is used in addition to Keep a Changelog's standard sect
- Fixed docs-only detection in `decorate-pr` changelog gate: file list was iterated in a piped subshell so `docs_only` never propagated to the parent scope; replaced pipe with process substitution. - Fixed docs-only detection in `decorate-pr` changelog gate: file list was iterated in a piped subshell so `docs_only` never propagated to the parent scope; replaced pipe with process substitution.
- Pinned `securego/gosec` and `golang/govulncheck-action` to concrete version tags (`v2.22.4` and `v1.0.4`) so self-hosted Gitea runners can resolve them via direct git clone without relying on the GitHub Actions floating-tag API. - Pinned `securego/gosec` and `golang/govulncheck-action` to concrete version tags (`v2.22.4` and `v1.0.4`) so self-hosted Gitea runners can resolve them via direct git clone without relying on the GitHub Actions floating-tag API.
- Added `GOTOOLCHAIN: auto` environment variable to `gosec` and `govulncheck-action` steps in `push-validation` and `prepare-release` workflows to prevent Go toolchain version mismatches inside the act runner container. - Added `GOTOOLCHAIN: auto` environment variable to `gosec` and `govulncheck-action` steps in `push-validation` and `prepare-release` workflows to prevent Go toolchain version mismatches inside the act runner container.
- Replaced `securego/gosec` composite action with a direct `go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4 && gosec ./...` run step so gosec uses the Go 1.26 toolchain installed by `setup-go` rather than the action's bundled Go 1.24 binary which ignores `GOTOOLCHAIN=auto`.
## [1.0.2] - 2026-03-21 ## [1.0.2] - 2026-03-21