Publish release binaries govulncheck can assess

.github/workflows/ci.yml

@@ -126,6 +126,8 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
+    env:
+      GOVULNCHECK_VERSION: v1.6.0
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -135,8 +137,8 @@ jobs:
         with:
           go-version-file: go.mod
           cache: false
-      - name: Check reachable Go vulnerabilities
-        run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
+      - name: Check reachable Go vulnerabilities in the source
+        run: go run "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" ./...
       - name: Build GoReleaser snapshot artifacts
         uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
@@ -145,6 +147,8 @@ jobs:
           args: release --snapshot --clean --skip=publish
       - name: Verify and prepare all release artifacts
         run: scripts/prepare-artifact-scan-rootfs.sh
+      - name: Check reachable Go vulnerabilities in each release binary
+        run: scripts/govulncheck-release-binaries.sh
       - name: Import release artifacts for scanning
         run: docker import artifact-scan/rootfs.tar stackstate-backup-cli:security-scan
       - name: Scan release artifacts with Trivy, Grype, and VEX

.goreleaser.yml

@@ -17,7 +17,7 @@ builds:
   - windows_amd64
   main: .
   ldflags:
-  - -s -w -X github.com/stackvista/stackstate-backup-cli/cmd/version.Version={{.Version}}
+  - -w -X github.com/stackvista/stackstate-backup-cli/cmd/version.Version={{.Version}}
     -X github.com/stackvista/stackstate-backup-cli/cmd/version.Commit={{.Commit}}
     -X github.com/stackvista/stackstate-backup-cli/cmd/version.Date={{.Date}}
   binary: sts-backup

scripts/govulncheck-release-binaries.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+# Binary-mode govulncheck can only judge which packages are linked while the
+# release binaries keep their symbol table, so stripping it again (`-s` in the
+# GoReleaser ldflags) makes this fail instead of publishing artifacts whose
+# reachability nobody can assess.
+
+set -euo pipefail
+
+rootfs_dir="${1:-artifact-scan/rootfs}"
+govulncheck_version="${GOVULNCHECK_VERSION:-v1.6.0}"
+expected_binaries=5
+binaries=()
+
+while IFS= read -r binary; do
+  binaries+=("${binary}")
+done < <(find "${rootfs_dir}" -type f \( -name sts-backup -o -name sts-backup.exe \) -print | sort)
+
+if [[ "${#binaries[@]}" -ne "${expected_binaries}" ]]; then
+  echo "Expected ${expected_binaries} release binaries under '${rootfs_dir}', found ${#binaries[@]}" >&2
+  exit 1
+fi
+
+status=0
+for binary in "${binaries[@]}"; do
+  echo "== ${binary}"
+  if ! go run "golang.org/x/vuln/cmd/govulncheck@${govulncheck_version}" -mode=binary "${binary}"; then
+    status=1
+  fi
+done
+
+exit "${status}"