🤖 ci: establish a jointly green security baseline

[ThomasK33]

Observed blocker

PR #92's focused MCP update removes four native govulncheck advisory sections without adding findings. Its test, build, vendor, lint and docs checks pass locally. The CI-equivalent vulnerability scan still fails on both baseline and candidate:

• Baseline: b1d48e3a64b42a23cb0cfaee8c30f3f21b761424, 55 symbol-result advisory sections.
• Candidate: fc52a605d202286b59794449e34c9dc8738186d9, 51 sections.
• Go 1.25.7, govulncheck 1.1.4; both native scan commands exit 3.

These are static-analysis findings, not a claim that every advisory is exploitable in a deployment. Frozen-database Trivy filesystem/image comparison is still pending. A successful make lint does not include the separate vulnerability-scanning step run by CI.

Decision

Accept a bounded, non-publishing compatibility experiment to identify the smallest supported toolchain/dependency set that passes the required security gates together. Advisory fix versions are lower bounds, not a tested solution or automatic upgrade targets.

A pure toolchain prerequisite would still fail on vulnerable dependencies. A dependency prerequisite excluding the MCP fixes would still fail on MCP findings. Do not create an unmergeable stack or waive inherited failures just to preserve artificial PR boundaries.

Experiment boundaries

1. Verify current supported Go and Coder release channels from primary sources. Select exact versions deliberately; do not choose the numerically newest release by default.
2. Use isolated source snapshots and scanner databases. Retain source/tool/database identities, commands, native exits, dependency inventories, and baseline/candidate differences. Reuse the ongoing Trivy baseline rather than duplicate it.
3. Try at most three deliberate candidate dependency graphs. Private toolchain/dependency edits and strictly necessary compatibility fixes are allowed. No experimental pushes, new PRs, release/image publishing, CI suppressions, branch-rule changes, or unrelated cleanup.
4. Run actual CI-equivalent security analysis plus test/build/vendor/lint/docs gates. A scanner loading failure, incomplete analysis, or reduced finding count is not a pass. Hands-on verification must include screenshots and video, accurately labeled.
5. Keep publishing configuration under issue 🤖 ci: diagnose and restore verified main image publishing #98's owner. Share the proposed toolchain before any delivery integration; rerun its non-publishing main/release checks with an adopted toolchain.
6. Return a tested set and delivery boundaries, or a specific blocker when the candidate budget is exhausted. Substantial API redesign requires a new scope decision.

Delivery decision after the experiment

Split only if each proposed PR can independently satisfy the existing gates. Otherwise, explicitly reopen #92's scope for the smallest tested, jointly green security remediation, with understandable commit boundaries and updated acceptance criteria. This issue does not yet authorize that expansion or experimental publication.

Keep existing dependency PRs open. No review-counter resets, replacement PRs, premature review requests, or automatic merges. Repository policy still reserves merging to the user. Maintainer owns the scope decision and post-merge verification.

---

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: xhigh

[ThomasK33]

Scope decision: adopt graph 2 for combined delivery in PR #92

The private experiment used two of its three allowed candidates. Graph 2 passed all requested local repository and native security gates on tree e1a059e4988c6f00db898f6457abe04dd7a15871, based on PR #92 head fc52a605d202286b59794449e34c9dc8738186d9.

PR #92 will be explicitly expanded to a cohesive security-baseline and CI-compatibility repair. It is not ready to merge. This is a deliberate scope change, not an unexplained dependency expansion.

Why one delivery unit

The merge queue forces the full Go, workflow and Terraform checks. A toolchain-only fix, dependency-only fix excluding MCP, scanner-only fix, or scripts-only helper fix would leave other required gates failing. Separate red prerequisite PRs would not be independently landable. Keep the work reviewable as distinct logical commits inside the existing PR; do not create a replacement PR or reset review counts.

Authorized scope

1. Preserve the focused MCP SDK 1.4.1 remediation, regression tests, and deployment-limit documentation already in 🤖 fix: restore the supported security baseline and CI compatibility #92.
2. Integrate the tested Go 1.26.8 / Coder 2.35.8 Security Support graph. Explicit security corrections are gRPC 1.83.2, x/crypto 0.55.0 and x/mod 0.40.0, with the necessary transitive resolution. No application compatibility fixes were needed. Update directly affected toolchain documentation/pins; do not modernize unrelated dependencies.
3. Repair Trivy installation by explicitly selecting the available current 0.74.0 release at all five scan invocations, retaining the pinned action commit and existing enforcement. Prove installation and filesystem, image and Terraform-config scan compatibility before publishing this change; the old scanner's green results are not a substitute.
4. Correct the Codex-comments helper so it recognizes actual summary metadata and the exact clean security-review reply as non-findings. Keep real comments, unresolved threads, malformed/lookalike metadata, and quoted-marker findings blocking. Metadata must never count as review approval. Add offline regression tests.

Size and evidence

The tested graph changes 374 modules relative to the scoped #92 candidate: 152 additions, 14 removals and 208 version changes. Its generated dependency patch changes 2,320 files, with 305,522 additions and 210,083 deletions; only go.mod and go.sum change outside vendor/. This is substantial dependency churn, not a small ordinary source diff. Preserve the full inventory and explain consequential direct/transitive changes in the PR.

Against the same frozen databases, native main→graph-2 results were govulncheck 55→0, Trivy filesystem 41→0, and Trivy image 60→0 gated findings. Six non-called govulncheck advisories remain outside its failing symbol-level gate. These results do not establish deployment exploitability or production readiness.

Remaining delivery gates and exclusions

• Validate the complete unchanged integrated tree: tests/race, build, vendor, lint, docs, actionlint, native security scans, and the helper regression suite.
• Run actual hosted and merge-queue checks, including real Kind/CNPG/template E2E and Terraform scans. No suppressions, weakened checks, altered branch rules, or substitute status claims.
• Coordinate with issue 🤖 ci: diagnose and restore verified main image publishing #98's owner for non-publishing main/release packaging on Go 1.26.8 and the adopted graph. Do not change the GoReleaser publishing repair or push images/releases.
• Preserve PR 🤖 ci: repair main-channel GoReleaser preparation #99 at 8aa69887a61ccca0d21964eebc98d552c0a764bc where possible. Its four historical assessments count; review capacity and a valid fresh-check route must be reconciled before any head change.
• 🤖 fix: restore the supported security baseline and CI compatibility #92 currently has zero completed/pending assessments. Request separately attributed normal/security reviews only after the combined candidate and checks stabilize; reserve the independent final assessment within six lifetime assessments. Automatic assessments count too.
• Existing dependency PRs remain open. No merging, enqueuing, auto-merge, cloud deployment, unrelated cleanup, broad API redesign, or new authentication subsystem is authorized.

The scoped PR #92 workspace owns integration and CI/review readiness. The maintainer owns this scope decision; the user retains the repository's merge step. Issue #100 remains open until the security/CI baseline is verified after an authorized landing.

---

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: xhigh