.github/workflows: improve test.yml

Author: FiloSottile

.github/workflows/test.yml

@@ -1,25 +1,58 @@
 name: Go tests
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+  schedule: # daily at 09:42 UTC
+    - cron: '42 9 * * *'
+  workflow_dispatch:
 permissions:
   contents: read
 jobs:
   test:
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go:
+          - { go-version: stable }
+          - { go-version: oldstable }
+          - { go-version-file: go.mod }
+        deps:
+          - locked
+          - latest
     steps:
-      - name: Install hurl
+      - name: Install hurl 4.1.0
         run: |
           curl --location --remote-name https://github.com/Orange-OpenSource/hurl/releases/download/4.1.0/hurl_4.1.0_amd64.deb
           sudo apt-get update && sudo apt-get install ./hurl_4.1.0_amd64.deb
-      - name: Checkout repository
-        uses: actions/checkout@v2
+      - uses: actions/checkout@v5
         with:
-          fetch-depth: 0
-      - name: Install Go (from go.mod)
-        uses: actions/setup-go@v4
+          persist-credentials: false
+      - uses: actions/setup-go@v6
         with:
-          go-version-file: go.mod
-          check-latest: true
-      - name: Run tests
-        run: go test ./...
-      - name: Run tests (short + race)
-        run: go test -short -race ./...
+          go-version: ${{ matrix.go.go-version }}
+          go-version-file: ${{ matrix.go.go-version-file }}
+      - run: go get -u
+        if: matrix.deps == 'latest'
+      - run: go test ./...
+      - run: go test -short -race ./...
+  staticcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
+  govulncheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

bastion/bastion.go

@@ -59,6 +59,8 @@ func (kh keyHash) String() string {
 	return hex.EncodeToString(kh[:])
 }
 
+type backendContextKey struct{}
+
 // New returns a new Bastion.
 //
 // The Config must not be modified after the call to New.
@@ -74,7 +76,7 @@ func New(c *Config) (*Bastion, error) {
 	b.proxy = &httputil.ReverseProxy{
 		Rewrite: func(pr *httputil.ProxyRequest) {
 			pr.Out.URL.Scheme = "https" // needed for the required :scheme header
-			pr.Out.Host = pr.In.Context().Value("backend").(string)
+			pr.Out.Host = pr.In.Context().Value(backendContextKey{}).(string)
 			pr.SetXForwarded()
 			// We don't interpret the query, so pass it on unmodified.
 			pr.Out.URL.RawQuery = pr.In.URL.RawQuery
@@ -158,7 +160,7 @@ func (b *Bastion) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "request must start with /KEY_HASH/", http.StatusNotFound)
 		return
 	}
-	ctx := context.WithValue(r.Context(), "backend", kh)
+	ctx := context.WithValue(r.Context(), backendContextKey{}, kh)
 	r = r.Clone(ctx)
 	r.URL.Path = "/" + path
 	b.proxy.ServeHTTP(w, r)

cmd/litewitness/litewitness.go

@@ -233,14 +233,14 @@ func indexHandler(w *witness.Witness) http.HandlerFunc {
 		fmt.Fprintf(rw, "# litewitness %s\n\n", html.EscapeString(*nameFlag))
 		fmt.Fprintf(rw, "%s\n\n", html.EscapeString(w.VerifierKey()))
 		fmt.Fprintf(rw, "## Logs\n\n")
-		sqlitex.Exec(db, "SELECT origin, tree_size, tree_hash FROM log",
-			func(stmt *sqlite.Stmt) error {
+		sqlitex.Execute(db, "SELECT origin, tree_size, tree_hash FROM log", &sqlitex.ExecOptions{
+			ResultFunc: func(stmt *sqlite.Stmt) error {
 				fmt.Fprintf(rw, "- %s\n  (size %d, root %s)\n\n",
 					html.EscapeString(stmt.ColumnText(0)),
 					stmt.ColumnInt64(1), stmt.ColumnText(2))
 				return nil
 			},
-		)
+		})
 	}
 }
 

cmd/witnessctl/witnessctl.go

@@ -80,7 +80,7 @@ func openDB(dbPath string) *sqlite.Conn {
 
 func addLog(db *sqlite.Conn, origin string) {
 	treeHash := merkle.HashEmptyTree()
-	if err := sqlitex.Exec(db, "INSERT INTO log (origin, tree_size, tree_hash) VALUES (?, 0, ?)",
+	if err := sqlitexExec(db, "INSERT INTO log (origin, tree_size, tree_hash) VALUES (?, 0, ?)",
 		nil, origin, base64.StdEncoding.EncodeToString(treeHash[:])); err != nil {
 		log.Fatalf("Error adding log: %v", err)
 	}
@@ -95,15 +95,15 @@ func addKey(db *sqlite.Conn, origin string, vk string) {
 	if v.Name() != origin {
 		log.Printf("Warning: verifier key name %q does not match origin %q.", v.Name(), origin)
 	}
-	err = sqlitex.Exec(db, "INSERT INTO key (origin, key) VALUES (?, ?)", nil, origin, vk)
+	err = sqlitexExec(db, "INSERT INTO key (origin, key) VALUES (?, ?)", nil, origin, vk)
 	if err != nil {
 		log.Fatalf("Error adding key: %v", err)
 	}
 	log.Printf("Added key %q.", vk)
 }
 
 func delKey(db *sqlite.Conn, origin string, vk string) {
-	err := sqlitex.Exec(db, "DELETE FROM key WHERE origin = ? AND key = ?", nil, origin, vk)
+	err := sqlitexExec(db, "DELETE FROM key WHERE origin = ? AND key = ?", nil, origin, vk)
 	if err != nil {
 		log.Fatalf("Error deleting key: %v", err)
 	}
@@ -132,7 +132,7 @@ func addSigsumLog(db *sqlite.Conn, keyFlag string) {
 }
 
 func listLogs(db *sqlite.Conn) {
-	if err := sqlitex.Exec(db, `
+	if err := sqlitexExec(db, `
 	SELECT json_object(
 		'origin', log.origin,
 		'size', log.tree_size,
@@ -152,3 +152,7 @@ func listLogs(db *sqlite.Conn) {
 		log.Fatalf("Error listing logs: %v", err)
 	}
 }
+
+func sqlitexExec(conn *sqlite.Conn, query string, resultFn func(stmt *sqlite.Stmt) error, args ...any) error {
+	return sqlitex.Execute(conn, query, &sqlitex.ExecOptions{ResultFunc: resultFn, Args: args})
+}

internal/witness/witness.go

@@ -303,7 +303,7 @@ func (w *Witness) getKeys(origin string) (note.Verifiers, error) {
 func (w *Witness) dbExec(query string, resultFn func(stmt *sqlite.Stmt) error, args ...interface{}) error {
 	w.dmMu.Lock()
 	defer w.dmMu.Unlock()
-	err := sqlitex.Exec(w.db, query, resultFn, args...)
+	err := sqlitexExec(w.db, query, resultFn, args...)
 	if err != nil {
 		w.log.Error("database error", "error", err)
 	}
@@ -313,10 +313,14 @@ func (w *Witness) dbExec(query string, resultFn func(stmt *sqlite.Stmt) error, a
 func (w *Witness) dbExecWithChanges(query string, resultFn func(stmt *sqlite.Stmt) error, args ...interface{}) (int, error) {
 	w.dmMu.Lock()
 	defer w.dmMu.Unlock()
-	err := sqlitex.Exec(w.db, query, resultFn, args...)
+	err := sqlitexExec(w.db, query, resultFn, args...)
 	if err != nil {
 		w.log.Error("database error", "error", err)
 		return 0, err
 	}
 	return w.db.Changes(), nil
 }
+
+func sqlitexExec(conn *sqlite.Conn, query string, resultFn func(stmt *sqlite.Stmt) error, args ...any) error {
+	return sqlitex.Execute(conn, query, &sqlitex.ExecOptions{ResultFunc: resultFn, Args: args})
+}

internal/witness/witness_test.go

@@ -13,7 +13,6 @@ import (
 	"golang.org/x/mod/sumdb/note"
 	"golang.org/x/mod/sumdb/tlog"
 	"sigsum.org/sigsum-go/pkg/merkle"
-	"zombiezen.com/go/sqlite/sqlitex"
 )
 
 func TestRace(t *testing.T) {
@@ -28,11 +27,11 @@ func TestRace(t *testing.T) {
 	origin := "sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562"
 
 	treeHash := merkle.HashEmptyTree()
-	fatalIfErr(t, sqlitex.Exec(w.db, "INSERT INTO log (origin, tree_size, tree_hash) VALUES (?, 0, ?)",
+	fatalIfErr(t, sqlitexExec(w.db, "INSERT INTO log (origin, tree_size, tree_hash) VALUES (?, 0, ?)",
 		nil, origin, base64.StdEncoding.EncodeToString(treeHash[:])))
 	k, err := note.NewEd25519VerifierKey(origin, pk[:])
 	fatalIfErr(t, err)
-	fatalIfErr(t, sqlitex.Exec(w.db, "INSERT INTO key (origin, key) VALUES (?, ?)", nil, origin, k))
+	fatalIfErr(t, sqlitexExec(w.db, "INSERT INTO key (origin, key) VALUES (?, ?)", nil, origin, k))
 
 	_, err = w.processAddCheckpointRequest([]byte(`old 0
 

note.go

@@ -50,7 +50,6 @@ type verifier struct {
 	name   string
 	hash   uint32
 	verify func(msg, sig []byte) bool
-	key    ed25519.PublicKey
 }
 
 func (v *verifier) Name() string                { return v.name }