build: require patched Go release artifacts

.github/workflows/ci-docker.yml

@@ -41,10 +41,21 @@ jobs:
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 https://github.com/docker/build-push-action/releases/tag/v7.3.0
         with:
           context: .
+          load: true
           push: false
           platforms: linux/${{ matrix.arch }}
-          tags: ${{ steps.meta.outputs.tags }}
+          tags: |
+            ${{ steps.meta.outputs.tags }}
+            handshake-node:ci-${{ matrix.arch }}
           labels: ${{ steps.meta.outputs.labels }}
           build-args: |
             VERSION=${{ github.ref_type == 'tag' && github.ref_name || '' }}
             COMMIT_HASH=${{ github.sha }}
+      - name: scan image
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 https://github.com/aquasecurity/trivy-action/releases/tag/v0.36.0
+        with:
+          version: v0.72.0
+          image-ref: handshake-node:ci-${{ matrix.arch }}
+          scanners: vuln
+          severity: HIGH,CRITICAL
+          exit-code: '1'

.github/workflows/go-test.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: 1.26.x
+  GO_VERSION: 1.26.5
 
 jobs:
   build:
@@ -30,6 +30,23 @@ jobs:
       - name: build
         run: make build
 
+  vulnerability:
+    name: vuln
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 https://github.com/actions/checkout/releases/tag/v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 https://github.com/actions/setup-go/releases/tag/v6.5.0
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          cache-dependency-path: |
+            go.sum
+            hnsutil/go.sum
+            hnsutil/psbt/go.sum
+      - name: vulnerability scan
+        run: make vuln
+
   unit-cover:
     name: unit-cover
     runs-on: ubuntu-latest

.github/workflows/golangci-lint.yml

@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 env:
-  GO_VERSION: 1.26.x
+  GO_VERSION: 1.26.5
 
 jobs:
   golangci:

.github/workflows/publish.yml

@@ -10,7 +10,7 @@ concurrency: ${{ github.ref }}
 
 env:
   APPLICATION_NAME: handshake-node
-  GO_VERSION: 1.26.x
+  GO_VERSION: 1.26.5
 
 jobs:
   create-draft-release:

Dockerfile

@@ -1,10 +1,10 @@
-FROM ghcr.io/blinklabs-io/go:1.26.3-1 AS build
+FROM golang:1.26.5-bookworm@sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651 AS build
 
 WORKDIR /code
 COPY . .
 RUN GOBIN=/out make release-install
 
-FROM alpine:3.21
+FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 ARG VERSION
 ARG COMMIT_HASH

Makefile

@@ -2,6 +2,7 @@ PKG := github.com/blinklabs-io/handshake-node
 
 LINT_PKG := github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 GOIMPORTS_PKG := golang.org/x/tools/cmd/goimports
+VULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
 
 GO_BIN := ${shell go env GOBIN}
 
@@ -12,9 +13,11 @@ endif
 
 LINT_BIN := $(GO_BIN)/golangci-lint
 GOIMPORTS_BIN := $(GO_BIN)/goimports
+VULNCHECK_BIN := $(GO_BIN)/govulncheck
 
 LINT_COMMIT := v2.1.6
 GOIMPORTS_COMMIT := a24facf9e5586c95743d2f4ad15d148c7a8cf00b
+VULNCHECK_COMMIT := v1.6.0
 
 GOBUILD := go build -v
 GOINSTALL := go install -v 
@@ -52,6 +55,10 @@ $(LINT_BIN):
 	@$(call print, "Fetching linter")
 	$(GOINSTALL) $(LINT_PKG)@$(LINT_COMMIT)
 
+$(VULNCHECK_BIN):
+	@$(call print, "Fetching vulnerability scanner")
+	$(GOINSTALL) $(VULNCHECK_PKG)@$(VULNCHECK_COMMIT)
+
 #? goimports: Install goimports
 goimports:
 	@$(call print, "Installing goimports.")
@@ -123,6 +130,13 @@ integration:
 	@$(call print, "Running tagged RPC integration tests.")
 	$(GOTEST_DEV) ./integration -count=1 -test.timeout=20m
 
+#? vuln: Check all modules for reachable known vulnerabilities
+vuln: $(VULNCHECK_BIN)
+	@$(call print, "Checking for reachable known vulnerabilities.")
+	$(VULNCHECK_BIN) ./...
+	cd hnsutil && $(VULNCHECK_BIN) ./...
+	cd hnsutil/psbt && $(VULNCHECK_BIN) ./...
+
 #? hsd-interop: Run live protocol tests against pinned hsd (requires HSD_DIR)
 hsd-interop:
 	@$(call print, "Running live hsd interoperability protocol tests.")
@@ -167,6 +181,7 @@ tidy-module:
 	unit-cover \
 	unit-race \
 	integration \
+	vuln \
 	hsd-interop \
 	hnsparity \
 	fmt \

README.md

@@ -30,7 +30,8 @@ The current release is 0.1.1-rc1, a mainnet release candidate. It includes:
 
 ## Requirements
 
-[Go](https://go.dev/doc/install) 1.25 or newer.
+[Go](https://go.dev/doc/install) 1.26.5 or newer. The module toolchain
+directive automatically selects a patched Go toolchain when supported.
 
 ## Build
 

go.mod

@@ -43,3 +43,5 @@ replace (
 )
 
 go 1.25.0
+
+toolchain go1.26.5

hnsutil/go.mod

@@ -2,6 +2,8 @@ module github.com/blinklabs-io/handshake-node/hnsutil
 
 go 1.25.0
 
+toolchain go1.26.5
+
 require (
 	github.com/aead/siphash v1.0.1
 	github.com/blinklabs-io/handshake-node v0.0.0-00010101000000-000000000000

hnsutil/psbt/go.mod

@@ -2,6 +2,8 @@ module github.com/blinklabs-io/handshake-node/hnsutil/psbt
 
 go 1.25.0
 
+toolchain go1.26.5
+
 require (
 	github.com/blinklabs-io/handshake-node v0.0.0-00010101000000-000000000000
 	github.com/blinklabs-io/handshake-node/chaincfg/chainhash v0.0.0-00010101000000-000000000000