From 90913fffa113186f8a42e83ed72a09facd261141 Mon Sep 17 00:00:00 2001 From: Tobias Gesellchen Date: Sun, 24 May 2026 14:31:29 +0200 Subject: [PATCH] fix(ci): remove nancy from Vulnerability Scan job nancy was installed from github.com/sonatypecommunity/nancy which is a non-existent package (correct org is sonatype-nexus-community). nancy v2.0.0 also has replace- directive issues that break go install. govulncheck already covers Go CVE scanning via the official Go vulnerability database, making nancy redundant here. The nancy-report.json artifact referenced in the upload step was never actually produced by the pipeline anyway. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/security.yml | 21 ++------------------- 1 file changed, 2 insertions(+), 19 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 8633728..63b8be3 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -29,10 +29,8 @@ jobs: - name: Install libpcap run: sudo apt-get install -y libpcap-dev - - name: Install security scanning tools - run: | - go install golang.org/x/vuln/cmd/govulncheck@latest - go install github.com/sonatypecommunity/nancy@latest + - name: Install govulncheck + run: go install golang.org/x/vuln/cmd/govulncheck@latest - name: Run govulncheck (Official Go vulnerability scanner) run: | @@ -40,21 +38,6 @@ jobs: govulncheck ./... echo "::endgroup::" - - name: Run Nancy vulnerability scanner - run: | - echo "::group::Running Nancy dependency scanner" - go list -json -deps ./... | nancy sleuth - echo "::endgroup::" - - - name: Upload vulnerability scan results - if: failure() - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: vulnerability-scan-results - path: | - vulnerability-report.json - nancy-report.json - static-analysis: name: Static Security Analysis runs-on: ubuntu-latest