deploy/audit.sh

 1#!/bin/sh
 2# Security checks to run before a release (and periodically). Exits non-zero
 3# on any finding so it can gate CI.
 4set -eu
 5cd "$(dirname "$0")/.."
 6
 7echo "== go vet =="
 8go vet ./...
 9
10echo "== govulncheck =="
11go run golang.org/x/vuln/cmd/govulncheck@latest ./...
12
13echo "== fuzz smoke (10s each parser) =="
14go test -run xxx -fuzz FuzzReadPktLine -fuzztime 10s ./internal/gitd/
15go test -run xxx -fuzz FuzzParseCommit -fuzztime 10s ./internal/sig/
16go test -run xxx -fuzz FuzzDecodeArmorAndParseSSHSig -fuzztime 10s ./internal/sig/
17go test -run xxx -fuzz FuzzParsePGPKey -fuzztime 10s ./internal/sig/
18go test -run xxx -fuzz FuzzTokenizeNoPanic -fuzztime 10s ./internal/protocol/
19
20echo "== all clear =="