Modernize secrets-init and remediate gRPC authorization bypass

[ibrahimlawal-paystack]

Summary

• Restore published nested-key behavior and preserve environment values containing literal = by splitting only on the first delimiter.
• Upgrade the runtime to Go 1.26.5, migrate cloud integrations to maintained SDKs, and update mature compatible dependencies.
• Upgrade gRPC-Go to 1.82.0, above the patched 1.79.3 floor for CVE-2026-33186.
• Prevent resolved environments and command arguments from appearing in debug or signal-error logs.
• Harden build and release automation with immutable action and base-image inputs, tag-only publication, short-lived registry authentication, reproducible builds, vulnerability checks, and release checksums.

Security Rationale

CVE-2026-33186 / GHSA-p77j-4mvh-x3m3 is a critical authorization bypass in gRPC-Go. A malformed HTTP/2 :path without the required leading slash could reach a handler while path-based deny rules evaluated a different string. Patched releases reject the non-canonical path before authorization or handler execution.

A search of public forks did not identify a maintained patched alternative. Updating the upstream dependency is therefore the stable remediation path. Existing consumer images must also rebuild against a patched secrets-init release; updating only newly introduced base images would leave older consumers carrying the vulnerable binary.

Dependency Policy

• Select the newest compatible release that is at least six days old.
• Use a newer release immediately only when no mature patched version exists.
• gRPC-Go 1.82.0 is mature and remains above the patched floor; 1.82.1 had not reached the maturity window when this update was prepared.

Validation

• make verify
• make platform-build
• make CGO_ENABLED=1 test-race
• actionlint -no-color .github/workflows/*.yaml
• shellcheck scripts/build.sh scripts/write-checksums.sh
• govulncheck ./...: zero reachable vulnerabilities
• SHA-256 verification for all four release binaries
• Binary architecture verification for Darwin and Linux on amd64 and arm64

Notes

• The vulnerability scan reports one module-only issue in an unimported package; no vulnerable symbol is reachable.
• A full Docker build was not run locally because no Docker daemon was available. The Docker build and release-binary build use the same checked-in build script.

Advisory: GHSA-p77j-4mvh-x3m3

[ibrahimlawal-paystack]

@reneed-paystack @husayn-paystack @shabih-paystack CI is green on the current head: https://github.com/ibrahimlawal-paystack/secrets-init/actions/runs/29592815600. Could you please review this modernization and gRPC security update?

[ibrahimlawal-paystack]

Bot review: One CI coverage regression remains in the lint migration.

[ibrahimlawal-paystack]

@reneed-paystack @husayn-paystack @shabih-paystack The current head is green: https://github.com/ibrahimlawal-paystack/secrets-init/actions/runs/29758982927.

It addresses the review feedback and adds immutable action/image pins, tag-only releases, a shared reproducible build path, release checksums, vulnerability gating, and regression coverage for secret-safe logging. Please review the latest head when you can.

[ibrahimlawal-paystack]

Bot review: Existing discussion covers the intentional branch glob and the strings.Cut behavior. The runtime and security changes look sound; one release-validation gap remains.

[ibrahimlawal-paystack]

@shabih-paystack @husayn-paystack I can't merge or release. I only have read permissions here. Can you please help release so we can verify the fix?

[husayn-paystack]

@ibrahimlawal-paystack why are the test results pointing to your fork, and not on this repo itself?

[ibrahimlawal-paystack]

@ibrahimlawal-paystack why are the test results pointing to your fork, and not on this repo itself?

@husayn-paystack I have only read access to this repo at the moment

[ibrahimlawal-paystack]

Bot review: Current-head review retained three release blockers. The prior fork run predates the new Go advisory, Shabih’s approval is on an older head, and PaystackHQ currently has no exact-head status checks; after fixing these findings, the corrected SHA still needs Paystack-owned CI or maintainer attestation before merge or release.