Modernize secrets-init and remediate gRPC authorization bypass

[ibrahimlawal-paystack]

Summary

• Restore published nested-key behavior and preserve environment values containing literal = by splitting only on the first delimiter.
• Upgrade the runtime to Go 1.26.5, migrate cloud integrations to maintained SDKs, and update mature compatible dependencies.
• Upgrade gRPC-Go to 1.82.0, above the patched 1.79.3 floor for CVE-2026-33186.
• Prevent resolved environments and command arguments from appearing in debug or signal-error logs.
• Harden build and release automation with immutable action and base-image inputs, tag-only publication, short-lived registry authentication, reproducible builds, vulnerability checks, and release checksums.

Security Rationale

CVE-2026-33186 / GHSA-p77j-4mvh-x3m3 is a critical authorization bypass in gRPC-Go. A malformed HTTP/2 :path without the required leading slash could reach a handler while path-based deny rules evaluated a different string. Patched releases reject the non-canonical path before authorization or handler execution.

A search of public forks did not identify a maintained patched alternative. Updating the upstream dependency is therefore the stable remediation path. Existing consumer images must also rebuild against a patched secrets-init release; updating only newly introduced base images would leave older consumers carrying the vulnerable binary.

Dependency Policy

• Select the newest compatible release that is at least six days old.
• Use a newer release immediately only when no mature patched version exists.
• gRPC-Go 1.82.0 is mature and remains above the patched floor; 1.82.1 had not reached the maturity window when this update was prepared.

Validation

• make verify
• make platform-build
• make CGO_ENABLED=1 test-race
• actionlint -no-color .github/workflows/*.yaml
• shellcheck scripts/build.sh scripts/write-checksums.sh
• govulncheck ./...: zero reachable vulnerabilities
• SHA-256 verification for all four release binaries
• Binary architecture verification for Darwin and Linux on amd64 and arm64

Notes

• The vulnerability scan reports one module-only issue in an unimported package; no vulnerable symbol is reachable.
• A full Docker build was not run locally because no Docker daemon was available. The Docker build and release-binary build use the same checked-in build script.

Advisory: GHSA-p77j-4mvh-x3m3

[ibrahimlawal-paystack]

@reneed-paystack @husayn-paystack @shabih-paystack CI is green on the current head: https://github.com/ibrahimlawal-paystack/secrets-init/actions/runs/29592815600. Could you please review this modernization and gRPC security update?

[ibrahimlawal-paystack]

Bot review: One CI coverage regression remains in the lint migration.

[ibrahimlawal-paystack]

@reneed-paystack @husayn-paystack @shabih-paystack The current head is green: https://github.com/ibrahimlawal-paystack/secrets-init/actions/runs/29758982927.

It addresses the review feedback and adds immutable action/image pins, tag-only releases, a shared reproducible build path, release checksums, vulnerability gating, and regression coverage for secret-safe logging. Please review the latest head when you can.

[ibrahimlawal-paystack]

Bot review: Existing discussion covers the intentional branch glob and the strings.Cut behavior. The runtime and security changes look sound; one release-validation gap remains.

[ibrahimlawal-paystack]

@shabih-paystack @husayn-paystack I can't merge or release. I only have read permissions here. Can you please help release so we can verify the fix?

[husayn-paystack]

@ibrahimlawal-paystack why are the test results pointing to your fork, and not on this repo itself?

[ibrahimlawal-paystack]

@ibrahimlawal-paystack why are the test results pointing to your fork, and not on this repo itself?

@husayn-paystack I have only read access to this repo at the moment

[ibrahimlawal-paystack]

Bot review: Current-head review retained three release blockers. The prior fork run predates the new Go advisory, Shabih’s approval is on an older head, and PaystackHQ currently has no exact-head status checks; after fixing these findings, the corrected SHA still needs Paystack-owned CI or maintainer attestation before merge or release.

[ibrahimlawal-paystack]

Bot review: [P1] Move grpc-go past the active vulnerability floor

govulncheck ./..., which make verify now requires, reports GO-2026-6061 for grpc-go v1.82.0 and exits 3; the advisory was published after the successful fork run and is fixed in v1.82.1. The traces reach the Google Secret Manager client, so the next CI or tag release fails before publication. Upgrade to at least v1.82.1 and rerun the exact-head verification.

[ibrahimlawal-paystack]

Bot review: [P1] Serialize all release publication

${{ github.workflow }}-${{ github.ref }} gives the Docker and GitHub release workflows different groups and also lets different tags publish concurrently. An older tag can therefore finish last and move the mutable latest tags backward while release artifacts are being published independently. Use one repository-wide publication key and explicit ordering for every release workflow/tag.

[ibrahimlawal-paystack]

Bot review: [P1] Smoke release platforms before promoting latest

This step pushes the versioned and mutable tags for both amd64 and arm64 in one operation. The separate PR smoke test only runs the native image, so an arm64-only defect or release-build failure can leave latest pointing at an unverified manifest. Publish the immutable versioned digest first, smoke every release platform, then promote that verified digest to latest.