Scan Go stdlib at the patched 1.26.x toolchain

The go directive in the three go.mod files must stay 1.26.0 until
netdata, which vendors this source, raises its own Go toolchain.
osv-scanner keys stdlib CVEs to that directive (69 code scanning
alerts, red Supply Chain Security) and the Static Analysis workflow
installed exactly go 1.26.0 via go-version-file, so govulncheck
reported reachable stdlib vulnerabilities fixed in later patches.

Add osv-scanner.toml with GoVersionOverride next to each go.mod and
switch the Static Analysis setup-go to the latest 1.26.x patch
release. CI and developers build with the patched stdlib; go.mod is
untouched so the vendored source still accepts netdata's toolchain.
Inline comments state the removal condition. Tracked as SOW-0019.

Author: ktsaou

.agents/sow/done/SOW-0019-20260610-go-stdlib-cve-scanner-policy.md

@@ -0,0 +1,140 @@
+# SOW-0019 - Go stdlib CVE scanner policy while go.mod is pinned for netdata
+
+## Status
+
+Status: completed
+
+Sub-state: scanner configuration shipped; constraint recorded; committed with this SOW.
+
+## Requirements
+
+### Purpose
+
+Keep CI green and GitHub Code Scanning meaningful while the Go module directive must stay at `go 1.26.0` for netdata vendoring compatibility.
+
+### User Request
+
+"do not change go.mod because netdata is 1.26 and when vendored it breaks netdata. We wait for netdata to increase it. Do the others." — 2026-06-10. Followed by "ci OSV fails".
+
+### Assistant Understanding
+
+Facts:
+
+- The three Go modules (`src/go`, `bench/drivers/go`, `tests/fixtures/go`) declare `go 1.26.0`. Raising the directive would make the vendored source require a newer toolchain than netdata currently builds with.
+- osv-scanner keys Go stdlib vulnerabilities to the `go.mod` directive: 23 CVEs × 3 modules = 69 GitHub Code Scanning alerts and a red Supply Chain Security workflow.
+- govulncheck scans with the installed toolchain's stdlib; CI's `setup-go` used `go-version-file: go.mod`, installing exactly 1.26.0, so the two reachable stdlib vulns (GO-2026-4971, GO-2026-4602) failed all three Static Analysis Go jobs.
+- The `go` directive is a minimum language version: building/testing with a newer 1.26.x patch toolchain is fully compatible and does not affect the vendored source.
+
+Unknowns:
+
+- None.
+
+### Acceptance Criteria
+
+- go.mod files unchanged.
+- OSV-Scanner and govulncheck pass with the patched 1.26.x toolchain.
+- The waiver is documented in-line where it is configured, with the removal condition.
+
+## Analysis
+
+Sources checked: `.github/workflows/supply-chain-security.yml` (osv job), `.github/workflows/static-analysis.yml` (Go matrix setup-go), local `osv-scanner 2.3.8` and `govulncheck` runs, GitHub Code Scanning alert list (69 osv alerts).
+
+Risk accepted by user: anyone building the vendored source with a Go 1.26.0-1.26.3 toolchain (today: netdata) gets the vulnerable stdlib. This is netdata's pending toolchain bump; tracked as the removal condition below.
+
+## Pre-Implementation Gate
+
+Status: ready
+
+Problem / root-cause model: scanner findings are keyed to the go.mod directive (osv-scanner) or the installed toolchain (govulncheck), while the directive is pinned for downstream vendoring compatibility — the findings do not describe this repo's own CI/test artifacts when built with the patched toolchain.
+
+Evidence reviewed: see Analysis; local runs reproduced both the failure and the fix.
+
+Affected contracts and surfaces: CI workflows and scanner configs only; no library code, no go.mod.
+
+Existing patterns to reuse: `supply-chain-security.yml` already uses `go-version: "1.26.x"`; osv-scanner's documented per-lockfile-directory `osv-scanner.toml` with `GoVersionOverride`.
+
+Risk and blast radius: scanner-config only. The override masks stdlib findings for the 1.26.0-directive interpretation; mitigated by in-file comments stating the removal condition.
+
+Sensitive data handling plan: none involved; configs contain only version numbers and public CVE context.
+
+Implementation plan: (1) `osv-scanner.toml` with `GoVersionOverride = "1.26.4"` next to each go.mod; (2) `static-analysis.yml` setup-go switched from `go-version-file` to `go-version: "1.26.x"` with a comment.
+
+Validation plan: local `osv-scanner scan --recursive .` from repo root (config pickup), local `govulncheck` per module with 1.26.4, `actionlint`, then CI on push.
+
+Artifact impact plan: AGENTS.md unaffected; no runtime skills; specs unaffected (no product behavior); operator docs unaffected; SOW completed+committed together.
+
+Open-source reference evidence: osv-scanner documented configuration option `GoVersionOverride` (google/osv-scanner, verified against local v2.3.8 behavior).
+
+Open decisions: none — user decided the go.mod freeze and accepted the waiting period.
+
+## Implications And Decisions
+
+1. go.mod stays at `go 1.26.0` until netdata raises its Go toolchain (user decision).
+2. Scanner noise is suppressed via toolchain-version override, not per-CVE ignores (assistant choice: one knob, self-describing, removed together with the constraint).
+
+## Plan
+
+1. Add the three osv-scanner.toml files; switch Static Analysis toolchain; validate; commit; push.
+
+## Execution Log
+
+### 2026-06-10
+
+- Added `osv-scanner.toml` (`GoVersionOverride = "1.26.4"` with removal-condition comment) to `src/go/`, `bench/drivers/go/`, `tests/fixtures/go/`.
+- `static-analysis.yml`: setup-go `go-version-file` → `go-version: "1.26.x"` with explanatory comment.
+
+## Validation
+
+Acceptance criteria evidence:
+
+- go.mod files untouched (`git diff` contains only workflow + toml changes).
+- Local `osv-scanner scan --recursive .` from repo root: "No issues found" (was 23 stdlib CVEs/module).
+- Local `govulncheck ./...` with go1.26.4 in `src/go` and `tests/fixtures/go`: "No vulnerabilities found."
+- `actionlint`: clean.
+
+Tests or equivalent validation: scanner runs above; CI verification on push (remote evidence recorded in Followup if divergent).
+
+Real-use evidence: the scanners themselves are the runnable path; both executed locally pre-push.
+
+Reviewer findings: external reviewers not run — scanner configuration change, validated by running the scanners.
+
+Same-failure scan: searched workflows for other `go-version-file` uses — none remain; coverage and supply-chain workflows already use `1.26.x`.
+
+Sensitive data gate: no secrets or sensitive data in configs, SOW, or comments.
+
+Artifact maintenance gate:
+
+- AGENTS.md: no update — no workflow-for-assistants change.
+- Runtime project skills: none exist.
+- Specs: no update — no product/protocol behavior change.
+- End-user/operator docs: no update — CI-internal configuration.
+- End-user/operator skills: no update — integrator skill unaffected.
+- SOW lifecycle: completed and committed with the change; removal condition tracked in Followup.
+
+Specs update: not needed (see gate). Project skills update: not needed. End-user/operator docs update: not needed. End-user/operator skills update: not needed.
+
+Lessons:
+
+- When a dependency floor is frozen by a downstream consumer, configure scanners to evaluate the toolchain actually used and document the waiver inline with its removal condition, instead of accumulating per-CVE ignores.
+
+Follow-up mapping:
+
+- When netdata raises its Go toolchain: bump the `go` directive in the three go.mod files, delete the three `osv-scanner.toml` files, and revert `static-analysis.yml` to `go-version-file`. The inline comments state this condition at every touch point.
+
+## Outcome
+
+CI scanner failures caused by the frozen `go 1.26.0` directive are resolved without touching go.mod: osv-scanner and govulncheck now evaluate the stdlib at the patched 1.26.x toolchain CI actually builds with. The 69 stdlib CVE alerts close on the next clean OSV upload. The waiver and its removal condition are documented inline.
+
+## Lessons Extracted
+
+See Lessons under Validation.
+
+## Followup
+
+- Remove the override (three `osv-scanner.toml` files) and restore `go-version-file` once netdata moves past Go 1.26.0 and the go.mod directives are bumped.
+
+## Regression Log
+
+None yet.
+
+Append regression entries here only after this SOW was completed or closed and later testing or use found broken behavior. Use a dated `## Regression - YYYY-MM-DD` heading at the end of the file. Never prepend regression content above the original SOW narrative.

.github/workflows/static-analysis.yml

@@ -135,7 +135,11 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: ${{ matrix.module }}/go.mod
+          # Latest 1.26 patch toolchain, NOT go-version-file: the go.mod
+          # directive must stay 1.26.0 until netdata (which vendors this
+          # source) raises its Go toolchain, but govulncheck must scan the
+          # stdlib at the patched version CI actually builds with.
+          go-version: "1.26.x"
           cache: false
 
       - name: Install Go analysis tools

bench/drivers/go/osv-scanner.toml

@@ -0,0 +1,6 @@
+# CI/dev toolchains build with the latest Go 1.26.x patch release. The go
+# directive in go.mod must stay 1.26.0 until netdata (which vendors this
+# source) raises its own Go toolchain; bumping it would break netdata builds.
+# This override scans the stdlib at the toolchain version actually used.
+# Remove when netdata moves past Go 1.26.0 and go.mod is bumped.
+GoVersionOverride = "1.26.4"

src/go/osv-scanner.toml

@@ -0,0 +1,6 @@
+# CI/dev toolchains build with the latest Go 1.26.x patch release. The go
+# directive in go.mod must stay 1.26.0 until netdata (which vendors this
+# source) raises its own Go toolchain; bumping it would break netdata builds.
+# This override scans the stdlib at the toolchain version actually used.
+# Remove when netdata moves past Go 1.26.0 and go.mod is bumped.
+GoVersionOverride = "1.26.4"

tests/fixtures/go/osv-scanner.toml

@@ -0,0 +1,6 @@
+# CI/dev toolchains build with the latest Go 1.26.x patch release. The go
+# directive in go.mod must stay 1.26.0 until netdata (which vendors this
+# source) raises its own Go toolchain; bumping it would break netdata builds.
+# This override scans the stdlib at the toolchain version actually used.
+# Remove when netdata moves past Go 1.26.0 and go.mod is bumped.
+GoVersionOverride = "1.26.4"