| name | golang-cve-update |
| description | Scans Go repositories for CVEs with govulncheck and upgrades the Go toolchain only when a matching tag exists on registry.access.redhat.com/ubi9/go-toolset. Use when checking Go CVEs, remediating stdlib or module vulnerabilities, bumping go.mod or Dockerfile Go versions, or validating Red Hat UBI9 go-toolset availability. Make sure to use this skill whenever the user mentions Go CVEs, govulncheck, golang version bumps, or ubi9/go-toolset image availability. |
| user-invocable | true |
| allowed-tools | ["Bash","Read","Write","Edit","Glob","Grep"] |
Go CVE Check and Toolset-Gated Update
Check a Go repository for known vulnerabilities, determine the minimum fixed Go version, and update the repo only if registry.access.redhat.com/ubi9/go-toolset publishes a tag for that exact Go version.
Hard rule
Do not bump the Go version unless a matching ubi9/go-toolset tag exists.
Before any edit, run (use an absolute path to this skill when working outside dev-skills):
scripts/check-toolset-version.sh <target-version>
- Exit
0 → safe to update to <target-version>
- Exit
1 → report the version is unavailable; stop without changing Go version files
- Exit
2 → registry or input error; fix and retry
Workflow
Copy and track progress:
Task Progress:
- [ ] Step 1: Detect current Go version
- [ ] Step 2: Scan for CVEs
- [ ] Step 3: Determine target Go version
- [ ] Step 4: Verify ubi9/go-toolset tag exists
- [ ] Step 5: Update version references (only if Step 4 passed)
- [ ] Step 6: Report findings
Step 1: Detect current Go version
Read version pins from (see reference.md for patterns):
go.mod (go and optional toolchain directives)- Container files referencing
registry.access.redhat.com/ubi9/go-toolset
- CI workflows,
.go-version, Makefile, Dockerfile*, Containerfile*
Record every location and the version it pins. For go.mod, also note whether toolchain is active or commented out (e.g. // toolchain go1.26.3).
Step 2: Scan for CVEs
From the target repository root, run the bundled script (use an absolute path to this skill when working outside dev-skills):
scripts/scan-vulnerabilities.sh
Also run module-only scan when stdlib is clean but dependencies are not:
govulncheck -test ./...
Capture:
- Vulnerability IDs (e.g.
GO-2025-XXXX)
- Affected packages
- Fixed in version from govulncheck output
Step 3: Determine target Go version
- Stdlib / toolchain CVEs — use the highest
Fixed in: stdlib@goX.Y.Z (or toolchain@goX.Y.Z) across findings.
- Module-only CVEs — prefer
go get -u / go mod tidy on affected modules; do not bump Go unless a stdlib fix requires it.
- When multiple fixes apply, choose the minimum Go version that satisfies all stdlib fixes.
- Compare with the current pin; if already satisfied, report clean and skip updates.
Step 4: Verify ubi9/go-toolset tag (mandatory gate)
From the target repository root, run (use an absolute path to this skill when working outside dev-skills):
TAG=$(scripts/check-toolset-version.sh "$TARGET_VERSION")
echo "Matched tag: $TAG"
Optional — list all tags for the version (newest build suffix first):
scripts/list-toolset-tags.sh "$TARGET_VERSION"
If Step 4 fails: tell the user the CVE fix requires Go $TARGET_VERSION but no matching ubi9/go-toolset image exists. List the nearest available tags:
scripts/list-toolset-tags.sh "$(echo "$TARGET_VERSION" | cut -d. -f1-2)"
Do not update Go version files. Suggest waiting for Red Hat to publish the image or escalating.
Step 5: Update version references (only after Step 4 passes)
Update every pin found in Step 1 consistently:
| File kind | Action |
|---|
go.mod | Set go to 1.Y.Z. For toolchain: update the version only when an active (uncommented) toolchain go1.X.Y line already exists; if it is commented out, update the version on that commented line but do not uncomment it; never add a new toolchain line |
ubi9/go-toolset references | Set image tag to $TARGET_VERSION (or a timestamped tag from Step 4 if the repo pins build IDs) |
CI / .go-version | Match $TARGET_VERSION |
After edits:
go mod tidy
go test ./...
Re-run govulncheck from Step 2.
Step 6: Report
Use this template:
## Go CVE scan summary
**Repository:** [path]
**Previous Go version:** [version]
**Target Go version:** [version or "none"]
**ubi9/go-toolset tag:** [matched tag or "not available"]
### Findings
- [GO-XXXX] [package] — fixed in [version]
### Actions taken
- [Updated go.mod to 1.Y.Z / No Go bump — toolset tag unavailable / No vulnerabilities found]
### Remaining issues
- [module CVEs needing dependency bumps, or none]
Utility scripts
When invoking from another repository, prefix with the absolute path to this skill
directory (e.g.
/path/to/eval-hub-skills/dev-skills/golang-cve-update/scripts/check-toolset-version.sh).
Registry tag lookups are cached for 5 minutes; set GOLANG_CVE_UPDATE_NO_CACHE=1 to
bypass.
Additional resources
