Development record
make preflight does not run the two hosted scans CI runs on every pull request, gitleaks over the commits the pull request would land and govulncheck over the module, so a finding either of them makes is found only after the push, in a hosted run. Between 2026-10-18 and 2026-10-26 they failed 12 of 32 failed CI runs: govulncheck 10 (one newly published standard-library vulnerability, on every pull request and queue entry from 2026-10-21 until the toolchain moved to go1.26.10 on 2026-10-22) and gitleaks 2.
issueresolvedminoriss-2610261151381604
make preflight does not run the two hosted scans CI runs on every pull request, gitleaks over the commits the pull request would land and govulncheck over the module, so a finding either of them makes is found only after the push, in a hosted run. Between 2026-10-18 and 2026-10-26 they failed 12 of 32 failed CI runs: govulncheck 10 (one newly published standard-library vulnerability, on every pull request and queue entry from 2026-10-21 until the toolchain moved to go1.26.10 on 2026-10-22) and gitleaks 2.
Frontmatter
| id | iss-2610261151381604 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2610261151381604-make-preflight-does-not-run-the-two.md
open on GitHub ↗ · commit history ↗
Referenced by1
- iss-2610261151481013When the default branch itself fails a hosted check, every branch pushed meanwhile pays a hosted run that is certain to fail, and nothing local says so before the push. From 2026-10-21 to 2026-10-22 a newly published Go standard-library vulnerability failed govulncheck on the nightly run and then on every pull request and queue entry, 10 runs, for about a day and a half, until the toolchain bump landed. A branch that changed neither go.mod nor go.sum could not have introduced it, and its author could have been told to land the bump first.blocks
mentions2
- dcn-26102611523294512026-10-26 — The product thinker adopted the remedies of iss-2609061525437969 (narrowed to pull-request bodies), iss-220 (its compose half only) and iss-2610241424265464, and asked for them and the newly filed iss-2610261151381604, iss-2610261151481013 and iss-2610261152125261 to be built first. Grounds: of 32 failed hosted CI runs between 2026-10-18 and 2026-10-26, 13 were deterministic checks that could have run before the push (a pull-request body without its Assisted-by line 7, an undeclared issue id on the pull-request form 4, gitleaks 2), and 10 more were one govulncheck finding that stood on the default branch itself. Each check moves to the earliest local point that sees its input: the commit-msg hook, the shell guard before gh pr create, abcd land's composed body, or the preflight before its test stages.
- itd-2610261025516272Private repos land checked work without renting CI