Security Issues (4)

run: |
  go install golang.org/x/tools/cmd/goimports@v0.33.0
  if [ -n "$(goimports -l .)" ]; then
    echo "goimports found files that need formatting:"
    goimports -l .
    exit 1
  fi

Security Issues (4)

run: |
  go install golang.org/x/tools/cmd/goimports@v0.33.0
  if [ -n "$(goimports -l .)" ]; then
    echo "goimports found files that need formatting:"
    goimports -l .
    exit 1
  fi

Performance Issues (1)

Quality Issues (1)

go install golang.org/x/tools/cmd/goimports@v0.33.0
if [ -n "$(goimports -l .)" ]; then
  echo "Go files are not formatted with goimports:"
  goimports -l .
  exit 1
fi

Powered by Visor from Probelabs

Last updated: 2026-04-14T10:57:19.403Z | Triggered by: pr_updated | Commit: c2444a0

💡 TIP: You can chat with Visor using /visor ask <your question>

This PR addresses critical failures in the ci-test.yml and release.yml workflows that have been blocking CI and releases. It introduces three main changes: removing the sbom job to resolve a permissions error, fixing a goimports command that was failing tests, and correcting Docker base image digests to support multi-architecture builds.

While the PR successfully unblocks the pipelines, it introduces significant side effects. The removal of the sbom job eliminates a key software supply chain security artifact. Additionally, the fix to the goimports step inadvertently disables the automated code formatting check, weakening code quality enforcement.

Files Changed Analysis

• .github/workflows/release.yml: The sbom job has been completely removed to work around a workflow-level permission error (id-token: write was required but not granted).
• .github/workflows/ci-test.yml: The command go run ... goimports ... -l . was replaced with go install .... This fixes a "command not found" error but no longer performs the formatting check, as the -l . flags that list unformatted files have been removed.
• .github/workflows/linter.yaml: The gotestsum dependency is updated from v1.12.1 to v1.13.0.
• ci/Dockerfile.distroless: The base images (debian:trixie-slim and gcr.io/distroless/static-debian12:nonroot) are no longer pinned to specific SHA256 digests. This allows Docker to use multi-platform manifest lists, fixing builds for non-amd64 architectures.

Architecture & Impact Assessment

• What this PR accomplishes: It provides an immediate fix for broken CI/CD pipelines, unblocking releases and pull request checks.
• Key technical changes introduced:
  1. Removal of SBOM Generation: The sbom job is deleted from the release workflow.
  2. Disabling of Go Formatting Check: The goimports hygiene check is effectively disabled.
  3. Enabling Multi-Arch Docker Builds: Dockerfiles are corrected to use multi-platform base images.
• Affected system components:
  • Release Workflow: The workflow is now functional but no longer produces a Software Bill of Materials (SBOM), which reduces visibility into software supply chain security.
  • CI Code Quality: The automated check for Go import formatting is no longer active, potentially leading to inconsistent code style.

graph TD
    subgraph "Release Workflow (Before)"
        A[goreleaser] --> B{sbom job};
        B --x|"Fails due to id-token permission error"| C[Workflow Failure];
    end

    subgraph "Release Workflow (After)"
        D[goreleaser] --> E[Release Succeeds];
        F((No SBOM Generated));
        E --> F;
    end

Scope Discovery & Context Expansion

• The changes are localized to CI/CD configuration files, but their impact is significant. The removal of the sbom job should be treated as a temporary measure. The underlying issue is a permissions mismatch that can be resolved by granting id-token: write at the job level within release.yml, which would be a more robust and secure solution.
• The modification to ci-test.yml represents a regression in code quality enforcement. The intended fix for the "command not found" error should be followed by a step that executes the goimports -l . check to ensure code formatting is still validated.

Powered by Visor from Probelabs

Last updated: 2026-04-14T10:57:26.728Z | Triggered by: pr_updated | Commit: c2444a0

💡 TIP: You can chat with Visor using /visor ask <your question>

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

/release to release-5.8