deps(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 #269
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Build, test, and push the lwauth image. | |
| # | |
| # Stock build only. Hardened-image build (dhi.io/golang + dhi.io/alpine) | |
| # is deferred to a later milestone. | |
| name: build | |
| on: | |
| push: | |
| branches: [ main ] | |
| tags: [ "v*" ] | |
| pull_request: | |
| branches: [ main ] | |
| # Default to least privilege at the workflow level. Jobs that genuinely | |
| # need to push images or mint OIDC tokens (signing, provenance) opt back | |
| # in via per-job `permissions:` blocks below. A compromised dependency | |
| # pulled into the test or e2e job thus starts with read-only access to | |
| # the repo and nothing else. | |
| permissions: | |
| contents: read | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE: ${{ github.repository }} | |
| jobs: | |
| test: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: ui/console/package-lock.json | |
| - name: build console UI | |
| run: cd ui/console && npm ci && npm run build | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: '1.26.2' | |
| cache: true | |
| - run: go vet ./... | |
| - run: go test -race ./... | |
| # K-CRYPTO-2 (Tier A5): FIPS 140-3 matrix entry. | |
| # | |
| # Builds the binaries with GOFIPS140 set so Go's in-tree FIPS module is | |
| # linked, runs the full test suite under the same module so a primitive | |
| # that only differs in FIPS mode (e.g. an RSA key < 2048 bits, an MD5 | |
| # fallback) surfaces as a test failure here rather than at promotion. | |
| # `make fips-verify` exec's the artifact and asserts buildinfo.FIPSEnabled | |
| # is true — catches a misconfigured matrix entry (wrong toolchain, | |
| # GOFIPS140 unset, env stripped by a downstream action) before the | |
| # image is ever pushed. | |
| fips-test: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: '22' | |
| cache: npm | |
| cache-dependency-path: ui/console/package-lock.json | |
| - name: build console UI | |
| run: cd ui/console && npm ci && npm run build | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: '1.26.2' | |
| cache: true | |
| - name: vet (FIPS) | |
| run: GOFIPS140=v1.0.0 go vet ./... | |
| - name: test (FIPS, race) | |
| run: GOFIPS140=v1.0.0 go test -race -count=1 ./... | |
| - name: build FIPS binaries | |
| run: make fips | |
| - name: verify FIPS binary self-reports fips_enabled=true | |
| run: make fips-verify | |
| build: | |
| runs-on: ubuntu-24.04 | |
| needs: test | |
| # Only this job pushes images and signs provenance, so it's the only | |
| # one that needs write+OIDC scopes. On pull_request runs the push | |
| # itself is skipped (see `push:` below) but we still mint provenance | |
| # for the locally-built image. | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE }} | |
| tags: | | |
| type=sha | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - id: push | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| provenance: true | |
| sbom: true | |
| # cache-to is gated to trusted (non-PR) events only: an untrusted | |
| # PR build must never be able to write into a cache scope a later | |
| # privileged push/sign job reads from (CWE-829, cache poisoning | |
| # across the trust boundary). Reading (cache-from) stays | |
| # unconditional -- an untrusted job only consuming a trusted | |
| # cache is safe, since nothing flows back from it. | |
| cache-from: type=gha,scope=build | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=build' || '' }} | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| COMMIT=${{ github.sha }} | |
| # Sign the pushed image by digest (keyless, Sigstore/Rekor) -- | |
| # docs/operations/supply-chain.md documents verifying this signature. | |
| - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v3.8.0 | |
| if: github.event_name != 'pull_request' | |
| - name: Sign image (keyless, by digest) | |
| if: github.event_name != 'pull_request' | |
| run: cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}@${{ steps.push.outputs.digest }} | |
| # K-CRYPTO-2 (Tier A5): publish a separately-tagged FIPS image. The | |
| # tag suffix `-fips` and the `org.lightweightauth.fips140` label set | |
| # in Dockerfile.fips give image-policy admission webhooks two | |
| # independent ways to match the artifact, so a stock-image deploy | |
| # that lands in a regulated namespace fails closed instead of | |
| # silently serving from the wrong crypto module. The Dockerfile's | |
| # build stage runs `--print-build-info | grep fips_enabled=true` so a | |
| # toolchain regression that drops FIPS support breaks the image | |
| # build, not a downstream incident. | |
| build-fips: | |
| runs-on: ubuntu-24.04 | |
| needs: fips-test | |
| # Hardened-image builds require dhi.io credentials which are only | |
| # available on push events (never on PRs from forks). | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0 | |
| # Authenticate to dhi.io to pull hardened base images (golang, alpine). | |
| # Credentials are stored as GitHub encrypted secrets. The docker/login-action | |
| # masks the token from workflow logs automatically. This step ONLY runs on | |
| # push events (job-level `if:` guard) so fork PRs never access the secret. | |
| - name: Log in to dhi.io (hardened base images) | |
| uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: dhi.io | |
| username: ${{ secrets.DHI_USERNAME }} | |
| password: ${{ secrets.DHI_TOKEN }} | |
| - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE }} | |
| flavor: | | |
| suffix=-fips,onlatest=true | |
| tags: | | |
| type=sha | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| - id: push | |
| uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0 | |
| with: | |
| context: . | |
| file: Dockerfile.fips | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| provenance: true | |
| sbom: true | |
| # This job already never runs on pull_request (job-level `if:` | |
| # above), so cache-to is not currently reachable from an untrusted | |
| # context -- gated anyway so the cache config doesn't become a | |
| # silent landmine if that job-level guard is ever loosened later. | |
| cache-from: type=gha,scope=build-fips | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=build-fips' || '' }} | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| COMMIT=${{ github.sha }} | |
| GOFIPS140_VER=v1.0.0 | |
| # Sign the pushed image by digest (keyless, Sigstore/Rekor) -- same | |
| # coverage as the stock image; this job already never runs on PRs. | |
| - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v3.8.0 | |
| - name: Sign FIPS image (keyless, by digest) | |
| run: cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE }}@${{ steps.push.outputs.digest }} | |
| # Boots the freshly built control-plane image in a real (ephemeral, | |
| # in-CI) kind cluster and hits /healthz + /version before the image is | |
| # ever considered promotable. Catches startup-wiring panics (e.g. a | |
| # duplicate http.ServeMux route registration) that a unit test can miss | |
| # but that `go test ./...` staying green would otherwise let through to | |
| # the registry. Mirrors scripts/dev_up.py's proven local-dev pattern. | |
| smoke-controlplane: | |
| runs-on: ubuntu-24.04 | |
| needs: test | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 | |
| # Single-platform, load: true build — separate from build-controlplane's | |
| # multi-platform buildx output below, which can't be docker-loaded. | |
| - uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 | |
| with: | |
| context: . | |
| file: Dockerfile.controlplane | |
| platforms: linux/amd64 | |
| load: true | |
| tags: lwauth-controlplane:ci | |
| # Shares a cache scope with build-controlplane below (same | |
| # Dockerfile). This job runs on every push AND every PR (including | |
| # forks) with no job-level trust gate, so cache-to is conditional: | |
| # a trusted push-to-main run may safely prime the shared cache | |
| # (same trust level as build-controlplane itself), but an | |
| # untrusted PR run must never be able to write into a scope the | |
| # trusted build-controlplane job (push+cosign-sign) later reads | |
| # from (CWE-829, cache poisoning across the trust boundary). | |
| # cache-from stays unconditional -- reading a trusted cache into | |
| # an untrusted PR build is safe, nothing flows back from it. | |
| cache-from: type=gha,scope=build-controlplane | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=build-controlplane' || '' }} | |
| build-args: | | |
| VERSION=ci | |
| COMMIT=${{ github.sha }} | |
| - name: Install kind | |
| run: | | |
| curl -Lo ./kind https://kind.sigs.k8s.io/dl/v0.23.0/kind-linux-amd64 | |
| chmod +x ./kind | |
| sudo mv ./kind /usr/local/bin/kind | |
| - name: Install kubectl | |
| run: | | |
| curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" | |
| chmod +x kubectl | |
| sudo mv kubectl /usr/local/bin/kubectl | |
| - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: "v3.16.0" | |
| - name: Create kind cluster | |
| run: kind create cluster --name lwauth-ci --wait 60s | |
| - name: Load image into kind | |
| run: kind load docker-image lwauth-controlplane:ci --name lwauth-ci | |
| - name: Deploy and wait for rollout | |
| run: | | |
| helm upgrade --install lwauth-cp deploy/helm/lightweightauth-controlplane \ | |
| --namespace lwauth-system --create-namespace \ | |
| --set image.repository=lwauth-controlplane \ | |
| --set image.tag=ci \ | |
| --set image.pullPolicy=Never \ | |
| --set replicaCount=1 \ | |
| --set leaderElection.enabled=false \ | |
| --set service.type=ClusterIP | |
| kubectl rollout status deployment -n lwauth-system --timeout=90s | |
| - name: Verify /healthz and /version | |
| run: | | |
| kubectl port-forward -n lwauth-system svc/lwauth-cp-lightweightauth-controlplane 8443:8443 & | |
| sleep 3 | |
| curl -fsS http://localhost:8443/healthz | |
| got=$(curl -fsS http://localhost:8443/version | jq -r .commit) | |
| if [[ "$got" != "${{ github.sha }}" ]]; then | |
| echo "::error::commit mismatch: image reports $got, expected ${{ github.sha }}" | |
| exit 1 | |
| fi | |
| - name: Dump pod logs on failure | |
| if: failure() | |
| run: kubectl logs -n lwauth-system -l app.kubernetes.io/name=lightweightauth-controlplane --all-containers --tail=200 | |
| - name: Delete kind cluster | |
| if: always() | |
| run: kind delete cluster --name lwauth-ci | |
| build-controlplane: | |
| runs-on: ubuntu-24.04 | |
| needs: [test, smoke-controlplane] | |
| permissions: | |
| contents: read | |
| packages: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 | |
| - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| if: github.event_name != 'pull_request' | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0 | |
| with: | |
| images: ${{ env.REGISTRY }}/mikeappsec/lwauth-controlplane | |
| tags: | | |
| type=sha | |
| type=ref,event=branch | |
| type=semver,pattern={{version}} | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - id: push | |
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 | |
| with: | |
| context: . | |
| file: Dockerfile.controlplane | |
| platforms: linux/amd64,linux/arm64 | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| provenance: true | |
| sbom: true | |
| # cache-to gated to trusted (non-PR) events only -- see the | |
| # cache-from-only comment on smoke-controlplane above for why: | |
| # this job (push+cosign-sign) must never consume a cache entry an | |
| # untrusted PR build could have written into this same scope. | |
| cache-from: type=gha,scope=build-controlplane | |
| cache-to: ${{ github.event_name != 'pull_request' && 'type=gha,mode=max,scope=build-controlplane' || '' }} | |
| build-args: | | |
| VERSION=${{ github.ref_name }} | |
| COMMIT=${{ github.sha }} | |
| # Sign the pushed image by digest (keyless, Sigstore/Rekor) so the | |
| # infra repo's promotion workflow can independently verify it came | |
| # from this exact workflow+branch before promoting it to production. | |
| - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v3.8.0 | |
| if: github.event_name != 'pull_request' | |
| - name: Sign control-plane image (keyless, by digest) | |
| if: github.event_name != 'pull_request' | |
| run: cosign sign --yes ${{ env.REGISTRY }}/mikeappsec/lwauth-controlplane@${{ steps.push.outputs.digest }} | |
| e2e: | |
| runs-on: ubuntu-24.04 | |
| needs: build | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Compose up | |
| run: docker compose -f deploy/docker/compose.yaml up -d --build --wait | |
| - name: Smoke test | |
| run: | | |
| set -e | |
| curl -fsS http://localhost:8080/healthz | |
| curl -fsS -H 'X-Api-Key: dev-admin-key' http://localhost:8000/x | head | |
| - name: Compose logs (on failure) | |
| if: failure() | |
| run: docker compose -f deploy/docker/compose.yaml logs | |
| - name: Compose down | |
| if: always() | |
| run: docker compose -f deploy/docker/compose.yaml down -v |