Skip to content

Add Dependabot configuration and govulncheck workflow #644

Description

Problem

Issue #613 reported 26 CVEs in go-sqlcmd v1.9.0 that went undetected because:

  1. No dependabot.yml file exists - Dependabot won't auto-create PRs for vulnerable dependencies without configuration
  2. No govulncheck in CI - No proactive scanning for Go vulnerabilities

Proposed Solution

1. Add .github/dependabot.yml

This will:

  • Auto-create PRs for outdated/vulnerable Go dependencies weekly
  • Keep GitHub Actions up to date (e.g., actions/checkout@v2 to v4)

2. Add .github/workflows/security.yml with govulncheck

This will:

  • Run on every PR and push to main
  • Run weekly to catch new CVEs even without code changes
  • Fail the build if vulnerabilities are detected

3. Update pr-validation.yml Go version

Current workflow uses Go 1.22, should use stable or specify 1.24+.

Related

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions