success
Security
queued 2m20s ran 1m30s total 3m49s
1 jobs
0 failed
3m49s duration
— tests
0 artifacts
vet / vuln / gosec / staticcheck / modules
successvet / vuln / gosec / staticcheck / modules
successSet up job
cloning rickub/cli @ 507eaf7c4250f77049ebd9bd49cbe803a67e5831action actions/setup-go@v5: node20 (_actions/actions/setup-go/v5)
successCheckout <1s
(checkout already performed by the runner — delivered as the read-only work disk)
successSet up Go 15s
ciguest: network up (172.30.0.10/30 via 172.30.0.9)ciguest: starting dockerd (overlay2, data-root on scratch)ciguest: dockerd is readyciguest: loaded baked image postgres_16-alpine.tar.gz: Loaded image: postgres:16-alpineciguest: 1 baked image archive(s) loaded (no per-job registry pull needed)ciguest: logged into registry registry.rickub.com as rickubSetup go version spec 1.26isExplicit: explicit? falseevaluating 0 versionsmatch not foundAttempting to download 1.26...No manifest cachedGetting manifest from actions/go-versions@main(node:552) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.(Use `node --trace-deprecation ...` to show where the warning was created)Fetching the manifest via the API failed.API rate limit exceeded for 46.105.119.221. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.)Falling back to fetching the manifest using raw URL.matching 1.26...check 1.27.2 satisfies 1.26check 1.27.1 satisfies 1.26check 1.27.0 satisfies 1.26check 1.26.9 satisfies 1.26arm64===x64 && darwin===linuxx64===x64 && darwin===linuxarm64===x64 && linux===linuxx64===x64 && linux===linuxmatched 1.26.9Acquiring 1.26.9 from https://github.com/actions/go-versions/releases/download/1.26.9-37875104533/go-1.26.9-linux-x64.tar.gzDownloading https://github.com/actions/go-versions/releases/download/1.26.9-37875104533/go-1.26.9-linux-x64.tar.gzDestination /tmp/2cee2c94-2a6f-4a13-ad62-7635f95d6a3adownload completeExtracting Go...Checking tar --versiontar (GNU tar) 1.34Copyright (C) 2021 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law.Written by John Gilmore and Jay Fenlason.[command]/usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /tmp/81bff3a6-48a5-4f5f-875a-08e7088dfc58 -f /tmp/2cee2c94-2a6f-4a13-ad62-7635f95d6a3aSuccessfully extracted go to /tmp/81bff3a6-48a5-4f5f-875a-08e7088dfc58Adding to the cache ...Caching tool go 1.26.9 x64source dir: /tmp/81bff3a6-48a5-4f5f-875a-08e7088dfc58destination /tmp/hostedtoolcache/go/1.26.9/x64finished caching toolSuccessfully cached go to /tmp/hostedtoolcache/go/1.26.9/x64Added go to the pathSuccessfully set up Go version 1.26which go :/tmp/hostedtoolcache/go/1.26.9/x64/bin/go:go env GOPATH :/tmp/home/go:creating /tmp/home/gocreating /tmp/home/go/binadd bin true[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOMODCACHE[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOCACHE/tmp/home/go/pkg/mod/tmp/home/.cache/go-buildfollowSymbolicLinks 'true'followSymbolicLinks 'true'implicitDescendants 'true'matchDirectories 'true'omitBrokenSymbolicLinks 'true'excludeHiddenFiles 'false'Search path '/workspace/cli/go.sum'/workspace/cli/go.sumFound 1 files to hash.primary key is setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205Cache service version: v2Resolved Keys:["setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205"]Checking zstd --quiet --version1.5.4zstd version: 1.5.4[Request] GetCacheEntryDownloadURL http://172.30.255.1:8888/twirp/github.actions.results.api.v1.CacheService/GetCacheEntryDownloadURL[Response] - 200Headers: { "content-length": "1029", "content-security-policy": "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; base-uri 'none'; frame-ancestors 'none'; object-src 'none'; form-action 'self' https://payment.stancer.com", "content-type": "application/json", "date": "Sun, 11 Oct 2026 17:12:51 GMT", "permissions-policy": "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()", "referrer-policy": "strict-origin-when-cross-origin", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-content-type-options": "nosniff", "x-request-id": "4cbe7cd9-dcdc-440d-81a4-fe89a7144ce1"}Body: { "matchedKey": "setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205", "matched_key": "setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205", "ok": true, "signedDownloadUrl": "http://172.30.255.1:8888/twirp/_blob/download/cache?sig=***", "signed_download_url": "http://172.30.255.1:8888/twirp/_blob/download/cache?sig=***"}Cache hit for: setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205Archive path: /tmp/b62ed243-254b-4bd3-bf63-3805643e7495/cache.tzstStarting download of archive to: /tmp/b62ed243-254b-4bd3-bf63-3805643e7495/cache.tzstUse Azure SDK: trueDownload concurrency: 8Request timeout (ms): 30000Cache segment download timeout mins env var: undefinedSegment download timeout (ms): 600000Lookup only: falseCache Size: ~124 MB (129789919 B)[command]/usr/bin/tar -xf /tmp/b62ed243-254b-4bd3-bf63-3805643e7495/cache.tzst -P -C /workspace/cli --use-compress-program unzstdCache restored successfullyCache restored from key: setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205##[add-matcher]/workspace/_actions/actions/setup-go/v5/matchers.jsongo version go1.26.9 linux/amd64
go env
AR='ar'CC='gcc'CGO_CFLAGS='-O2 -g'CGO_CPPFLAGS=''CGO_CXXFLAGS='-O2 -g'CGO_ENABLED='1'CGO_FFLAGS='-O2 -g'CGO_LDFLAGS='-O2 -g'CXX='g++'GCCGO='gccgo'GO111MODULE=''GOAMD64='v1'GOARCH='amd64'GOAUTH='netrc'GOBIN=''GOCACHE='/tmp/home/.cache/go-build'GOCACHEPROG=''GODEBUG=''GOENV='/tmp/home/.config/go/env'GOEXE=''GOEXPERIMENT=''GOFIPS140='off'GOFLAGS=''GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build4062800648=/tmp/go-build -gno-record-gcc-switches'GOHOSTARCH='amd64'GOHOSTOS='linux'GOINSECURE=''GOMOD='/workspace/cli/go.mod'GOMODCACHE='/tmp/home/go/pkg/mod'GONOPROXY=''GONOSUMDB=''GOOS='linux'GOPATH='/tmp/home/go'GOPRIVATE=''GOPROXY='https://proxy.golang.org,direct'GOROOT='/tmp/hostedtoolcache/go/1.26.9/x64'GOSUMDB='sum.golang.org'GOTELEMETRY='local'GOTELEMETRYDIR='/tmp/home/.config/go/telemetry'GOTMPDIR=''GOTOOLCHAIN='auto'GOTOOLDIR='/tmp/hostedtoolcache/go/1.26.9/x64/pkg/tool/linux_amd64'GOVCS=''GOVERSION='go1.26.9'GOWORK=''PKG_CONFIG='pkg-config'
successgo vet <1s
Run
go vet ./...
successModule integrity <1s
Run
set -euo pipefail go mod verify go mod tidy if ! git diff --exit-code -- go.mod go.sum; then echo "::error::go.mod/go.sum are not tidy; run 'go mod tidy' and commit" exit 1 fi
all modules verifiedgo: downloading github.com/inconshreveable/mousetrap v1.1.0go: downloading gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
successgovulncheck 8s
Run
go run golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION} ./...go: downloading golang.org/x/vuln v1.7.0go: downloading golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5go: downloading golang.org/x/mod v0.39.0go: downloading golang.org/x/tools v0.49.0go: downloading golang.org/x/sync v0.22.0No vulnerabilities found.
successgosec 52s
Run
go run github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} -quiet ./...go: downloading github.com/securego/gosec/v2 v2.29.0go: downloading github.com/anthropics/anthropic-sdk-go v1.66.0go: downloading github.com/openai/openai-go/v3 v3.52.0go: downloading google.golang.org/genai v1.69.0go: downloading github.com/ccojocar/zxcvbn-go v1.0.4go: downloading github.com/tidwall/sjson v1.2.5go: downloading github.com/invopop/jsonschema v0.14.0go: downloading github.com/pb33f/ordered-map/v2 v2.3.1go: downloading github.com/standard-webhooks/standard-webhooks/libraries v0.0.1go: downloading github.com/tidwall/gjson v1.19.0go: downloading github.com/google/uuid v1.6.0go: downloading github.com/gookit/color v1.6.1go: downloading go.yaml.in/yaml/v3 v3.0.5go: downloading golang.org/x/mod v0.40.0go: downloading github.com/bahlo/generic-list-go v0.2.0go: downloading github.com/buger/jsonparser v1.6.1go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6go: downloading cloud.google.com/go/auth v0.23.2go: downloading cloud.google.com/go v0.123.0go: downloading github.com/google/go-cmp v0.7.0go: downloading github.com/gorilla/websocket v1.5.3go: downloading github.com/tidwall/match v1.2.0go: downloading github.com/tidwall/pretty v1.2.1go: downloading github.com/xo/terminfo v1.0.0go: downloading github.com/googleapis/gax-go/v2 v2.24.0go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0go: downloading go.opentelemetry.io/otel v1.45.0go: downloading go.opentelemetry.io/otel/trace v1.45.0go: downloading golang.org/x/net v0.58.0go: downloading cloud.google.com/go/compute/metadata v0.9.0go: downloading google.golang.org/api v0.293.0go: downloading github.com/google/s2a-go v0.1.9go: downloading google.golang.org/grpc v1.83.1go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.20go: downloading go.opentelemetry.io/otel/metric v1.45.0go: downloading google.golang.org/protobuf v1.36.12go: downloading github.com/felixge/httpsnoop v1.1.0go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688go: downloading github.com/go-logr/logr v1.4.4go: downloading github.com/cespare/xxhash/v2 v2.3.0go: downloading golang.org/x/text v0.41.0go: downloading github.com/go-logr/stdr v1.2.2go: downloading go.opentelemetry.io/auto/sdk v1.2.1go: downloading golang.org/x/sys v0.47.0go: downloading golang.org/x/crypto v0.55.0
successstaticcheck 12s
Run
go run honnef.co/go/tools/cmd/staticcheck@${STATICCHECK_VERSION} ./...go: downloading honnef.co/go/tools v0.8.1go: downloading golang.org/x/tools v0.44.1-0.20260420230617-19499e7caabcgo: downloading golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678go: downloading golang.org/x/sync v0.20.0go: downloading golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaago: downloading github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089cgo: downloading golang.org/x/mod v0.35.0
successRelease binary is reproducible from a clean tree <1s
Run
set -euo pipefail
git diff --quiet || { echo "::error::working tree dirty before build"; git status --short; exit 1; }
CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X rickub.com/rickub/cli/cmd.Version=security-scan" -o "${RUNNER_TEMP}/rickub" .
"${RUNNER_TEMP}/rickub" version
rickub security-scan (linux/amd64)
Post Set up Go
(node:4340) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.(Use `node --trace-deprecation ...` to show where the warning was created)[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOMODCACHE[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOCACHE/tmp/home/go/pkg/mod/tmp/home/.cache/go-buildCache hit occurred on the primary key setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205, not saving cache.
No test reports for this run.
Tell a job where its test runner writes its report and this tab fills in: how many tests passed, failed and were skipped, a bar of the result at a glance, then every failure first — with the assertion that failed and the output around it — over a per-suite list of cases and their durations. No scrolling a log for the word FAIL.
It is one reports: key on the job — a job key, not a step, so the report is collected whatever the job concluded. JUnit XML and go test -json are both understood, and most runners already emit one of them. reports: is a rickub extension and works only in .rickub/workflows/; in .github/workflows/ it is a parse error on purpose, because those files are also meant to run on github.com.