success
Security
queued 1m59s ran 1m56s total 3m55s
1 jobs
0 failed
3m55s duration
— tests
0 artifacts
vet / vuln / gosec / staticcheck / modules
successvet / vuln / gosec / staticcheck / modules
successSet up job
cloning rickub/cli @ aa8785956e6339dbb23893ebaf869cc6ad5879f5action actions/setup-go@v5: node20 (_actions/actions/setup-go/v5)
successCheckout <1s
(checkout already performed by the runner — delivered as the read-only work disk)
successSet up Go 22s
ciguest: network up (172.30.0.10/30 via 172.30.0.9)ciguest: starting dockerd (overlay2, data-root on scratch)ciguest: dockerd is readyciguest: loaded baked image postgres_16-alpine.tar.gz: Loaded image: postgres:16-alpineciguest: 1 baked image archive(s) loaded (no per-job registry pull needed)ciguest: logged into registry registry.rickub.com as rickubSetup go version spec 1.26isExplicit: explicit? falseevaluating 0 versionsmatch not foundAttempting to download 1.26...No manifest cachedGetting manifest from actions/go-versions@main(node:553) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.(Use `node --trace-deprecation ...` to show where the warning was created)matching 1.26...check 1.27.2 satisfies 1.26check 1.27.1 satisfies 1.26check 1.27.0 satisfies 1.26check 1.26.9 satisfies 1.26arm64===x64 && darwin===linuxx64===x64 && darwin===linuxarm64===x64 && linux===linuxx64===x64 && linux===linuxmatched 1.26.9Acquiring 1.26.9 from https://github.com/actions/go-versions/releases/download/1.26.9-37875104533/go-1.26.9-linux-x64.tar.gzDownloading https://github.com/actions/go-versions/releases/download/1.26.9-37875104533/go-1.26.9-linux-x64.tar.gzDestination /tmp/58717920-2ad4-420f-8aec-5c485cddbcd4download completeExtracting Go...Checking tar --versiontar (GNU tar) 1.34Copyright (C) 2021 Free Software Foundation, Inc.License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>.This is free software: you are free to change and redistribute it.There is NO WARRANTY, to the extent permitted by law.Written by John Gilmore and Jay Fenlason.[command]/usr/bin/tar xz --warning=no-unknown-keyword --overwrite -C /tmp/6a782365-4299-4f62-aaf7-93502eaded01 -f /tmp/58717920-2ad4-420f-8aec-5c485cddbcd4Successfully extracted go to /tmp/6a782365-4299-4f62-aaf7-93502eaded01Adding to the cache ...Caching tool go 1.26.9 x64source dir: /tmp/6a782365-4299-4f62-aaf7-93502eaded01destination /tmp/hostedtoolcache/go/1.26.9/x64finished caching toolSuccessfully cached go to /tmp/hostedtoolcache/go/1.26.9/x64Added go to the pathSuccessfully set up Go version 1.26which go :/tmp/hostedtoolcache/go/1.26.9/x64/bin/go:go env GOPATH :/tmp/home/go:creating /tmp/home/gocreating /tmp/home/go/binadd bin true[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOMODCACHE[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOCACHE/tmp/home/.cache/go-build/tmp/home/go/pkg/modfollowSymbolicLinks 'true'followSymbolicLinks 'true'implicitDescendants 'true'matchDirectories 'true'omitBrokenSymbolicLinks 'true'excludeHiddenFiles 'false'Search path '/workspace/cli/go.sum'/workspace/cli/go.sumFound 1 files to hash.primary key is setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205Cache service version: v2Resolved Keys:["setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205"]Checking zstd --quiet --version1.5.4zstd version: 1.5.4[Request] GetCacheEntryDownloadURL http://172.30.255.1:8888/twirp/github.actions.results.api.v1.CacheService/GetCacheEntryDownloadURL[Response] - 200Headers: { "content-length": "1029", "content-security-policy": "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; base-uri 'none'; frame-ancestors 'none'; object-src 'none'; form-action 'self' https://payment.stancer.com", "content-type": "application/json", "date": "Sun, 11 Oct 2026 17:33:40 GMT", "permissions-policy": "accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()", "referrer-policy": "strict-origin-when-cross-origin", "strict-transport-security": "max-age=31536000; includeSubDomains", "x-content-type-options": "nosniff", "x-request-id": "e5890579-5393-4df6-9ffd-efcf58a2dce1"}Body: { "matchedKey": "setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205", "matched_key": "setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205", "ok": true, "signedDownloadUrl": "http://172.30.255.1:8888/twirp/_blob/download/cache?sig=***", "signed_download_url": "http://172.30.255.1:8888/twirp/_blob/download/cache?sig=***"}Cache hit for: setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205Archive path: /tmp/1b58461d-930c-4e5e-b1bf-d2cf595c36a7/cache.tzstStarting download of archive to: /tmp/1b58461d-930c-4e5e-b1bf-d2cf595c36a7/cache.tzstUse Azure SDK: trueDownload concurrency: 8Request timeout (ms): 30000Cache segment download timeout mins env var: undefinedSegment download timeout (ms): 600000Lookup only: falseCache Size: ~124 MB (129789919 B)[command]/usr/bin/tar -xf /tmp/1b58461d-930c-4e5e-b1bf-d2cf595c36a7/cache.tzst -P -C /workspace/cli --use-compress-program unzstdCache restored successfullyCache restored from key: setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205##[add-matcher]/workspace/_actions/actions/setup-go/v5/matchers.jsongo version go1.26.9 linux/amd64
go env
AR='ar'CC='gcc'CGO_CFLAGS='-O2 -g'CGO_CPPFLAGS=''CGO_CXXFLAGS='-O2 -g'CGO_ENABLED='1'CGO_FFLAGS='-O2 -g'CGO_LDFLAGS='-O2 -g'CXX='g++'GCCGO='gccgo'GO111MODULE=''GOAMD64='v1'GOARCH='amd64'GOAUTH='netrc'GOBIN=''GOCACHE='/tmp/home/.cache/go-build'GOCACHEPROG=''GODEBUG=''GOENV='/tmp/home/.config/go/env'GOEXE=''GOEXPERIMENT=''GOFIPS140='off'GOFLAGS=''GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1183992777=/tmp/go-build -gno-record-gcc-switches'GOHOSTARCH='amd64'GOHOSTOS='linux'GOINSECURE=''GOMOD='/workspace/cli/go.mod'GOMODCACHE='/tmp/home/go/pkg/mod'GONOPROXY=''GONOSUMDB=''GOOS='linux'GOPATH='/tmp/home/go'GOPRIVATE=''GOPROXY='https://proxy.golang.org,direct'GOROOT='/tmp/hostedtoolcache/go/1.26.9/x64'GOSUMDB='sum.golang.org'GOTELEMETRY='local'GOTELEMETRYDIR='/tmp/home/.config/go/telemetry'GOTMPDIR=''GOTOOLCHAIN='auto'GOTOOLDIR='/tmp/hostedtoolcache/go/1.26.9/x64/pkg/tool/linux_amd64'GOVCS=''GOVERSION='go1.26.9'GOWORK=''PKG_CONFIG='pkg-config'
successgo vet 1s
Run
go vet ./...
successModule integrity <1s
Run
set -euo pipefail go mod verify go mod tidy if ! git diff --exit-code -- go.mod go.sum; then echo "::error::go.mod/go.sum are not tidy; run 'go mod tidy' and commit" exit 1 fi
all modules verifiedgo: downloading github.com/inconshreveable/mousetrap v1.1.0go: downloading gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
successgovulncheck 10s
Run
go run golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION} ./...go: downloading golang.org/x/vuln v1.7.0go: downloading golang.org/x/telemetry v0.0.0-20260811182544-a038080d80e5go: downloading golang.org/x/mod v0.39.0go: downloading golang.org/x/tools v0.49.0go: downloading golang.org/x/sync v0.22.0No vulnerabilities found.
successgosec 1m02s
Run
go run github.com/securego/gosec/v2/cmd/gosec@${GOSEC_VERSION} -quiet ./...go: downloading github.com/securego/gosec/v2 v2.29.0go: downloading github.com/anthropics/anthropic-sdk-go v1.66.0go: downloading github.com/openai/openai-go/v3 v3.52.0go: downloading google.golang.org/genai v1.69.0go: downloading github.com/ccojocar/zxcvbn-go v1.0.4go: downloading github.com/tidwall/sjson v1.2.5go: downloading github.com/invopop/jsonschema v0.14.0go: downloading github.com/pb33f/ordered-map/v2 v2.3.1go: downloading github.com/standard-webhooks/standard-webhooks/libraries v0.0.1go: downloading github.com/tidwall/gjson v1.19.0go: downloading github.com/google/uuid v1.6.0go: downloading github.com/gookit/color v1.6.1go: downloading go.yaml.in/yaml/v3 v3.0.5go: downloading cloud.google.com/go/auth v0.23.2go: downloading cloud.google.com/go v0.123.0go: downloading github.com/google/go-cmp v0.7.0go: downloading github.com/gorilla/websocket v1.5.3go: downloading golang.org/x/mod v0.40.0go: downloading github.com/bahlo/generic-list-go v0.2.0go: downloading github.com/buger/jsonparser v1.6.1go: downloading go.yaml.in/yaml/v4 v4.0.0-rc.6go: downloading github.com/tidwall/match v1.2.0go: downloading github.com/tidwall/pretty v1.2.1go: downloading github.com/xo/terminfo v1.0.0go: downloading github.com/googleapis/gax-go/v2 v2.24.0go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0go: downloading go.opentelemetry.io/otel v1.45.0go: downloading go.opentelemetry.io/otel/trace v1.45.0go: downloading golang.org/x/net v0.58.0go: downloading google.golang.org/api v0.293.0go: downloading cloud.google.com/go/compute/metadata v0.9.0go: downloading github.com/google/s2a-go v0.1.9go: downloading google.golang.org/grpc v1.83.1go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.20go: downloading go.opentelemetry.io/otel/metric v1.45.0go: downloading google.golang.org/protobuf v1.36.12go: downloading github.com/felixge/httpsnoop v1.1.0go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688go: downloading github.com/go-logr/logr v1.4.4go: downloading github.com/cespare/xxhash/v2 v2.3.0go: downloading golang.org/x/text v0.41.0go: downloading github.com/go-logr/stdr v1.2.2go: downloading go.opentelemetry.io/auto/sdk v1.2.1go: downloading golang.org/x/sys v0.47.0go: downloading golang.org/x/crypto v0.55.0
successstaticcheck 15s
Run
go run honnef.co/go/tools/cmd/staticcheck@${STATICCHECK_VERSION} ./...go: downloading honnef.co/go/tools v0.8.1go: downloading golang.org/x/tools v0.44.1-0.20260420230617-19499e7caabcgo: downloading golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678go: downloading golang.org/x/sync v0.20.0go: downloading golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaago: downloading github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089cgo: downloading golang.org/x/mod v0.35.0
successRelease binary is reproducible from a clean tree 3s
Run
set -euo pipefail
git diff --quiet || { echo "::error::working tree dirty before build"; git status --short; exit 1; }
CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X rickub.com/rickub/cli/cmd.Version=security-scan" -o "${RUNNER_TEMP}/rickub" .
"${RUNNER_TEMP}/rickub" version
rickub security-scan (linux/amd64)
Post Set up Go
(node:4369) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.(Use `node --trace-deprecation ...` to show where the warning was created)[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOMODCACHE[command]/tmp/hostedtoolcache/go/1.26.9/x64/bin/go env GOCACHE/tmp/home/go/pkg/mod/tmp/home/.cache/go-buildCache hit occurred on the primary key setup-go-Linux-x64-ubuntu22-go-1.26.9-e83b8c1f582e6d931577fc73618a9a9b192b6857b1971d1da5ce8a7a9b35f205, not saving cache.
No test reports for this run.
Tell a job where its test runner writes its report and this tab fills in: how many tests passed, failed and were skipped, a bar of the result at a glance, then every failure first — with the assertion that failed and the output around it — over a per-suite list of cases and their durations. No scrolling a log for the word FAIL.
It is one reports: key on the job — a job key, not a step, so the report is collected whatever the job concluded. JUnit XML and go test -json are both understood, and most runners already emit one of them. reports: is a rickub extension and works only in .rickub/workflows/; in .github/workflows/ it is a parse error on purpose, because those files are also meant to run on github.com.