Skip to content

Commit 87e27cb

Browse files
mahmut-Abimahmut-Abi
committed
fix(ci): unblock release validation
1 parent c58d58e commit 87e27cb

5 files changed

Lines changed: 101 additions & 21 deletions

File tree

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -193,8 +193,7 @@ jobs:
193193
194194
- name: Collect diagnostics on failure
195195
if: failure()
196-
working-directory: release-src
197-
run: ARTIFACT_DIR=tmp/conformance-diagnostics scripts/ci/collect-kind-diagnostics.sh
196+
run: ARTIFACT_DIR=release-src/tmp/conformance-diagnostics scripts/ci/collect-kind-diagnostics.sh
198197

199198
- name: Upload conformance artifacts
200199
if: always()

‎gen/go/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,8 @@ require (
88
)
99

1010
require (
11-
golang.org/x/net v0.49.0 // indirect
12-
golang.org/x/sys v0.40.0 // indirect
13-
golang.org/x/text v0.33.0 // indirect
11+
golang.org/x/net v0.55.0 // indirect
12+
golang.org/x/sys v0.45.0 // indirect
13+
golang.org/x/text v0.37.0 // indirect
1414
google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect
1515
)

‎gen/go/go.sum‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2W
2222
go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
2323
go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
2424
go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
25-
golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
26-
golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
27-
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
28-
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
29-
golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
30-
golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
25+
golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
26+
golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
27+
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
28+
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
29+
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
30+
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
3131
gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
3232
gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
3333
google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 h1:sNrWoksmOyF5bvJUcnmbeAmQi8baNhqg5IWaI3llQqU=

‎scripts/ci/ci_assets_test.go‎

Lines changed: 51 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,27 @@ func TestReleaseWorkflowUsesReleaseTaggedDependencyImages(t *testing.T) {
217217
}
218218
}
219219

220+
func TestReleaseWorkflowCollectsDiagnosticsWithCurrentHelper(t *testing.T) {
221+
contents := string(readFile(t, repoPath(".github", "workflows", "release.yml")))
222+
223+
for _, want := range []string{
224+
`run: ARTIFACT_DIR=release-src/tmp/conformance-diagnostics scripts/ci/collect-kind-diagnostics.sh`,
225+
} {
226+
if !strings.Contains(contents, want) {
227+
t.Fatalf("release workflow missing %q", want)
228+
}
229+
}
230+
231+
for _, unwanted := range []string{
232+
`working-directory: release-src
233+
run: ARTIFACT_DIR=tmp/conformance-diagnostics scripts/ci/collect-kind-diagnostics.sh`,
234+
} {
235+
if strings.Contains(contents, unwanted) {
236+
t.Fatalf("release workflow still contains stale diagnostics path %q", unwanted)
237+
}
238+
}
239+
}
240+
220241
func TestSecurityScanWorkflowUsesExistingHelper(t *testing.T) {
221242
contents := string(readFile(t, repoPath(".github", "workflows", "security-scans.yml")))
222243
helperPath := repoPath("scripts", "ci", "run-security-scans.sh")
@@ -252,18 +273,20 @@ func TestCollectKindDiagnosticsCapturesFrontendTopology(t *testing.T) {
252273
}
253274
}
254275

255-
func TestSmokeScriptProbesDerivedGatewayServiceFromInsideCluster(t *testing.T) {
276+
func TestSmokeScriptUsesCurlBasedInClusterProbe(t *testing.T) {
256277
contents := string(readFile(t, repoPath("test", "e2e", "smoke", "run.sh")))
257278

258279
for _, want := range []string{
259280
`GATEWAY_SERVICE="nantian-gw-$GATEWAY_NAME"`,
260281
`SMOKE_CLIENT_POD="smoke-client"`,
282+
`SMOKE_CLIENT_IMAGE="${SMOKE_CLIENT_IMAGE:-curlimages/curl:`,
261283
`SMOKE_URL="http://${GATEWAY_SERVICE}.${CONTROL_PLANE_NS}.svc.cluster.local/echo"`,
262284
`kubectl get service -n "$CONTROL_PLANE_NS" "$GATEWAY_SERVICE"`,
263285
`kubectl get endpointslice -n "$CONTROL_PLANE_NS"`,
264286
`kubernetes.io/service-name=$GATEWAY_SERVICE`,
265-
`wget -q -T "$request_timeout" -O - "$SMOKE_URL"`,
266-
`last_request_error`,
287+
`curl -sS`,
288+
`last_response_code`,
289+
`last_response_body`,
267290
`request_deadline=`,
268291
} {
269292
if !strings.Contains(contents, want) {
@@ -276,11 +299,33 @@ func TestSmokeScriptProbesDerivedGatewayServiceFromInsideCluster(t *testing.T) {
276299
`service/$DATA_PLANE_SVC`,
277300
`pod/$dataplane_pod`,
278301
`dataplane_pod=$(kubectl get pod`,
279-
`curl -s -o /dev/null -w "%{http_code}"`,
280-
`wget -q -O - "$SMOKE_URL" >/dev/null 2>&1`,
302+
`docker.io/busybox:1.36.1`,
303+
`wget -q -T "$request_timeout" -O - "$SMOKE_URL"`,
304+
} {
305+
if strings.Contains(contents, unwanted) {
306+
t.Fatalf("smoke script still contains stale probe pattern %q", unwanted)
307+
}
308+
}
309+
}
310+
311+
func TestEmbeddedProtoGoModuleAvoidsKnownVulnerableIndirectDeps(t *testing.T) {
312+
contents := string(readFile(t, repoPath("gen", "go", "go.mod")))
313+
314+
for _, want := range []string{
315+
`golang.org/x/net v0.55.0`,
316+
`golang.org/x/sys v0.45.0`,
317+
} {
318+
if !strings.Contains(contents, want) {
319+
t.Fatalf("embedded proto go.mod missing %q", want)
320+
}
321+
}
322+
323+
for _, unwanted := range []string{
324+
`golang.org/x/net v0.49.0`,
325+
`golang.org/x/sys v0.40.0`,
281326
} {
282327
if strings.Contains(contents, unwanted) {
283-
t.Fatalf("smoke script still contains stale host-probe pattern %q", unwanted)
328+
t.Fatalf("embedded proto go.mod still contains vulnerable dep %q", unwanted)
284329
}
285330
}
286331
}

‎test/e2e/smoke/run.sh‎

Lines changed: 40 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ GATEWAY_CLASS_NAME="${GATEWAY_CLASS_NAME:-nantian-gw}"
1515
GATEWAY_NAME="${GATEWAY_NAME:-nantian-gw}"
1616
GATEWAY_SERVICE="nantian-gw-$GATEWAY_NAME"
1717
SMOKE_CLIENT_POD="smoke-client"
18-
SMOKE_CLIENT_IMAGE="${SMOKE_CLIENT_IMAGE:-docker.io/busybox:1.36.1}"
18+
SMOKE_CLIENT_IMAGE="${SMOKE_CLIENT_IMAGE:-curlimages/curl:8.16.0}"
1919
SMOKE_URL="http://${GATEWAY_SERVICE}.${CONTROL_PLANE_NS}.svc.cluster.local/echo"
2020
ECHO_PORT=8080
2121
TIMEOUT="${TIMEOUT:-180}"
@@ -43,6 +43,13 @@ red() { echo -e "\033[31m$*\033[0m"; }
4343
green() { echo -e "\033[32m$*\033[0m"; }
4444
yellow(){ echo -e "\033[33m$*\033[0m"; }
4545

46+
trim_response_detail() {
47+
local value="$1"
48+
value="${value//$'\r'/}"
49+
value="$(printf '%s' "$value" | sed 's/[[:space:]]\+/ /g')"
50+
printf '%.240s' "$value"
51+
}
52+
4653
fail() {
4754
red "FAIL: $*"
4855
FAILED=true
@@ -272,7 +279,11 @@ send_request() {
272279
local request_deadline=$((SECONDS + TIMEOUT))
273280
local request_timeout="${SMOKE_REQUEST_TIMEOUT_SEC:-5}"
274281
local last_request_error=""
282+
local last_response_code=""
283+
local last_response_body=""
275284
local output=""
285+
local response_code=""
286+
local response_body=""
276287

277288
if ! wait_for_gateway_frontend_endpoints "$request_deadline"; then
278289
if ! gateway_service_exists; then
@@ -285,20 +296,45 @@ send_request() {
285296
fi
286297

287298
while (( SECONDS < request_deadline )); do
288-
if output="$(kubectl exec -n "$TEST_NS" "$SMOKE_CLIENT_POD" -- \
289-
wget -q -T "$request_timeout" -O - "$SMOKE_URL" 2>&1)"; then
299+
output="$(kubectl exec -n "$TEST_NS" "$SMOKE_CLIENT_POD" -- \
300+
sh -c '
301+
body_file=/tmp/smoke-response-body.txt
302+
rm -f "$body_file"
303+
status="$(curl -sS --connect-timeout "$1" --max-time "$1" \
304+
-o "$body_file" -w "%{http_code}" "$2")"
305+
printf "__STATUS__%s\n" "$status"
306+
cat "$body_file"
307+
' sh "$request_timeout" "$SMOKE_URL" 2>&1)" || {
308+
last_request_error="$output"
309+
sleep 2
310+
continue
311+
}
312+
313+
response_code="$(printf '%s\n' "$output" | awk 'NR == 1 {sub(/^__STATUS__/, "", $0); print; exit}')"
314+
response_body="$(printf '%s\n' "$output" | tail -n +2)"
315+
316+
last_response_code="$response_code"
317+
last_response_body="$response_body"
318+
319+
if [[ "$response_code" == "200" ]]; then
290320
green " PASS: GET /echo via $GATEWAY_SERVICE -> HTTP 200"
291321
return 0
292322
fi
293323

294-
last_request_error="$output"
324+
last_request_error="HTTP ${response_code}"
295325
sleep 2
296326
done
297327

298328
local detail=""
299329
if [[ -n "$last_request_error" ]]; then
300330
detail=$'\nlast request error: '"$last_request_error"
301331
fi
332+
if [[ -n "$last_response_code" ]]; then
333+
detail+=$'\nlast response code: '"$last_response_code"
334+
fi
335+
if [[ -n "$last_response_body" ]]; then
336+
detail+=$'\nlast response body: '"$(trim_response_detail "$last_response_body")"
337+
fi
302338

303339
fail "GET /echo via $GATEWAY_SERVICE did not succeed within ${TIMEOUT}s${detail}"
304340
return 1

0 commit comments

Comments
 (0)