feat: add typed ClickHouse read package (pkg/proto/clickhouse) #333
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: govulncheck | |
| on: | |
| pull_request: | |
| paths: | |
| - '**.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - '.github/workflows/govulncheck.yaml' | |
| permissions: | |
| contents: read | |
| jobs: | |
| govulncheck: | |
| name: govulncheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| check-latest: true | |
| - name: Install govulncheck | |
| # Pinned to v1.3.0: govulncheck v1.4.0 (latest) panics with | |
| # "ForEachElement called on type containing *types.TypeParam" when scanning | |
| # this codebase's generics under Go 1.26 — a bug in its bundled x/tools | |
| # v0.46.0 (golang/go#80055, fixed by CL 786280 but not yet tagged; tracked | |
| # in golang/go#80139). v1.3.0 ships the unaffected x/tools v0.44.0. Move | |
| # back to @latest once x/vuln releases a version > v1.4.0 with the fix. | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.3.0 | |
| - name: Run govulncheck | |
| run: | | |
| set +e | |
| OUTPUT=$(govulncheck ./... 2>&1) | |
| EXIT_CODE=$? | |
| set -e | |
| echo "$OUTPUT" | |
| if [ $EXIT_CODE -eq 0 ]; then | |
| echo "" | |
| echo "No vulnerabilities found" | |
| exit 0 | |
| fi | |
| # Known unfixable vulnerabilities (Fixed in: N/A upstream): | |
| # GO-2026-4479 pion/dtls/v2 — random nonce in AES-GCM | |
| # GO-2026-4883 docker/docker (moby) — server-side plugin privilege off-by-one | |
| # GO-2026-4887 docker/docker (moby) — server-side AuthZ plugin bypass | |
| # The two docker vulns are server-side; we only use the client (via | |
| # testcontainers in codegen, and via go-builder-client transitively). | |
| # | |
| # Stdlib advisories — pinned to 1.26.2 to match goreleaser-cross:v1.26 | |
| # (no v1.26.3+ image yet). Remove these once the container catches up and | |
| # go.mod/Dockerfile move past the listed fix version: | |
| # GO-2026-4918 net/http (fixed in go1.26.3; x/net portion via v0.53.0 bump) | |
| # GO-2026-4971 net (fixed in go1.26.3) | |
| # GO-2026-4977 net/mail (fixed in go1.26.3) | |
| # GO-2026-4980 html/template (fixed in go1.26.3) | |
| # GO-2026-4982 html/template (fixed in go1.26.3) | |
| # GO-2026-4986 net/mail (fixed in go1.26.3) | |
| # GO-2026-5037 crypto/x509 (fixed in go1.26.4) | |
| # GO-2026-5039 net/textproto (fixed in go1.26.4) | |
| ALLOWED='GO-2026-4479|GO-2026-4883|GO-2026-4887|GO-2026-4918|GO-2026-4971|GO-2026-4977|GO-2026-4980|GO-2026-4982|GO-2026-4986|GO-2026-5037|GO-2026-5039' | |
| REPORTED=$(echo "$OUTPUT" | grep -oE 'Vulnerability #[0-9]+: GO-[0-9]+-[0-9]+' | grep -oE 'GO-[0-9]+-[0-9]+' | sort -u) | |
| UNEXPECTED=$(echo "$REPORTED" | grep -vE "^($ALLOWED)$" || true) | |
| if [ -z "$UNEXPECTED" ] && [ -n "$REPORTED" ]; then | |
| echo "" | |
| echo "Only known unfixable vulnerabilities found:" | |
| echo "$REPORTED" | sed 's/^/ /' | |
| exit 0 | |
| fi | |
| echo "" | |
| echo "New vulnerabilities found! Please fix them before merging." | |
| exit 1 |