chore(ci): bump go-FuSa pin from v0.30.0 to v0.36.0 - #49
Merged
Conversation
v0.36.0 adopts x-FuSa spec v1.13.0/v1.14.0 schema conformance, including safetyGoals[].fssrRefs (MUST, >=1 entry) replacing the old singular fssrRef/requirements field. Migrate .fusa-hara.json's five safety goals from "requirements" to "fssrRefs" so HARA006/HARA007 stay green — all referenced requirement ids are already registered in .fusa-reqs.json. Verified locally against the pinned binary: check, trace, cyber, vuln, and qualify all exit 0 (0 errors); the new v0.36.0 stubcheck content-quality rules (FUSA-STUB001/002) raise no findings on this repo's evidence files. Closes #48 Signed-off-by: Matt <47545907+SoundMatt@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #48
Summary
go-FuSaversion in both.github/workflows/ci.yml(gofusajob) and.github/workflows/release.yml(regenerate-safety-artifactsjob) fromv0.30.0tov0.36.0.safetyGoals[].fssrRefsis now a[]string(MUST, ≥1 entry), replacing the field this repo previously calledrequirements. Migrated.fusa-hara.json's five safety goals fromrequirementstofssrRefs— all referenced requirement ids (REQ-SAFETY-001,REQ-SEC-001,REQ-VIRT-004, etc.) are already registered in.fusa-reqs.json, so this is a rename, not new content.stubcheckpackage, rulesFUSA-STUB001/FUSA-STUB002). Verified it raises no findings against this repo's evidence files.Verification
Installed
gofusa@v0.36.0locally and ran every gofusa step from both workflows against this branch:ci.yml (
gofusajob):gofusa check ./...— exit 0, 0 errors (222 warnings / 142 infos, pre-existing categories — LINT/CYBER/ANA/etc.)gofusa trace -req-coverage 100— 100% (94/94 requirements traced, 67/67 functions annotated)gofusa cyber— exit 0, 0 errorsgofusa vuln— exit 0, 0 findingsgofusa qualify— exit 0, 46/46 qualification cases passedrelease.yml (
regenerate-safety-artifactsjob, all steps):fmea -cyber,check,cyber,tara,verify,coverage,boundary,sci,safety-case,release,iec61508,iso26262all exit 0.iec62443reported 1 gap (provenance.json missing builder field) only because it was run outsideGITHUB_ACTIONSlocally — that field auto-populates fromGITHUB_ACTIONS/GITHUB_WORKFLOW_REFin real CI, and the workflow step already runs with|| trueregardless, so it wouldn't fail the job either way.No bug found in go-FuSa itself — the schema change is intentional and well-documented in its v0.36.0 PR (SoundMatt/go-FuSa#55), and this repo's evidence file just needed the corresponding field rename.
Convention check
Reviewed recent history for similar CI/tooling-pin changes (
fix(ci): allow non-zero exit from gofusa gap report commands,fix(ci): fix YAML parse error in release workflow commit message, etc.) — none of these got a version bump/tag of their own; they were plain merges tomain. Following that convention here: no tag for this PR.