Skip to content

Commit f0fc4aa

Browse files
turkenfturkenf
authored
Merge pull request #51 from turkenf/security-up-0.2
[release-0.2] Update go.mod dependencies [SECURITY]
2 parents 74afd55 + caa08a6 commit f0fc4aa

7 files changed

Lines changed: 917 additions & 204 deletions

File tree

‎.github/renovate.json5‎

Lines changed: 130 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -1,139 +1,137 @@
11
{
2-
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3-
"extends": [
4-
"config:base"
2+
$schema: 'https://docs.renovatebot.com/renovate-schema.json',
3+
extends: [
4+
'config:recommended',
5+
'helpers:pinGitHubActionDigests',
6+
':semanticCommits',
57
],
6-
// The maximum number of PRs to be created in parallel
7-
"prConcurrentLimit": 5,
8-
// The branches renovate should target
9-
"baseBranches": ["main"],
10-
"ignorePaths": ["design/**"],
11-
"postUpdateOptions": ["gomodTidy"],
12-
// By default renovate will auto detect whether semantic commits have been used
13-
// in the recent history and comply with that, we explicitly disable it
14-
"semanticCommits": "disabled",
15-
// All PRs should have a label
16-
"labels": ["automated"],
17-
"regexManagers": [
8+
rebaseWhen: 'conflicted',
9+
prConcurrentLimit: 5,
10+
baseBranches: [
11+
'main',
12+
],
13+
ignorePaths: [
14+
'design/**',
15+
],
16+
postUpdateOptions: [
17+
'gomodTidy',
18+
],
19+
labels: [
20+
'automated',
21+
],
22+
customManagers: [
23+
{
24+
customType: 'regex',
25+
description: 'Bump Go version used in workflows',
26+
fileMatch: [
27+
'^\\.github\\/workflows\\/[^/]+\\.ya?ml$',
28+
],
29+
matchStrings: [
30+
"GO_VERSION: '(?<currentValue>.*?)'\\n",
31+
],
32+
datasourceTemplate: 'golang-version',
33+
depNameTemplate: 'golang',
34+
},
35+
{
36+
customType: 'regex',
37+
description: 'Bump golangci-lint version in workflows and the Makefile',
38+
fileMatch: [
39+
'^\\.github\\/workflows\\/[^/]+\\.ya?ml$',
40+
'^Makefile$',
41+
],
42+
matchStrings: [
43+
"GOLANGCI_VERSION: 'v(?<currentValue>.*?)'\\n",
44+
'GOLANGCILINT_VERSION = (?<currentValue>.*?)\\n',
45+
],
46+
datasourceTemplate: 'github-tags',
47+
depNameTemplate: 'golangci/golangci-lint',
48+
extractVersionTemplate: '^v(?<version>.*)$',
49+
},
1850
{
19-
// We want a PR to bump Go versions used through env variables in any Github
20-
// Actions, taking it from the official Github repository.
21-
"fileMatch": ["^\\.github\\/workflows\\/[^/]+\\.ya?ml$"],
22-
"matchStrings": [
23-
"GO_VERSION: '(?<currentValue>.*?)'\\n"
24-
],
25-
"datasourceTemplate": "golang-version",
26-
"depNameTemplate": "golang"
27-
}, {
28-
// We want a PR to bump golangci-lint versions used through env variables in
29-
// any Github Actions, taking it from the official Github repository tags.
30-
"fileMatch": ["^\\.github\\/workflows\\/[^/]+\\.ya?ml$"],
31-
"matchStrings": [
32-
"GOLANGCI_VERSION: '(?<currentValue>.*?)'\\n"
33-
],
34-
"datasourceTemplate": "github-tags",
35-
"depNameTemplate": "golangci/golangci-lint"
36-
}
51+
customType: 'regex',
52+
description: 'Bump helm version in the Makefile',
53+
fileMatch: [
54+
'^Makefile$',
55+
],
56+
matchStrings: [
57+
'HELM3_VERSION = (?<currentValue>.*?)\\n',
58+
],
59+
datasourceTemplate: 'github-tags',
60+
depNameTemplate: 'helm/helm',
61+
},
62+
{
63+
customType: 'regex',
64+
description: 'Bump kind version in the Makefile',
65+
fileMatch: [
66+
'^Makefile$',
67+
],
68+
matchStrings: [
69+
'KIND_VERSION = (?<currentValue>.*?)\\n',
70+
],
71+
datasourceTemplate: 'github-tags',
72+
depNameTemplate: 'kubernetes-sigs/kind',
73+
},
3774
],
38-
// PackageRules disabled below should be enabled in case of vulnerabilities
39-
"vulnerabilityAlerts": {
40-
"enabled": true
75+
vulnerabilityAlerts: {
76+
enabled: true,
4177
},
42-
"packageRules": [
78+
osvVulnerabilityAlerts: true,
79+
packageRules: [
80+
{
81+
description: 'Only get Docker image updates every 2 weeks to reduce noise',
82+
matchDatasources: [
83+
'docker',
84+
],
85+
schedule: [
86+
'every 2 week on monday',
87+
],
88+
enabled: true,
89+
},
90+
{
91+
description: 'Ignore k8s.io/client-go older versions, they switched to semantic version and old tags are still available in the repo',
92+
matchDatasources: [
93+
'go',
94+
],
95+
matchDepNames: [
96+
'k8s.io/client-go',
97+
],
98+
allowedVersions: '<1.0',
99+
},
43100
{
44-
// We need to ignore k8s.io/client-go older versions as they switched to
45-
// semantic version and old tags are still available in the repo.
46-
"matchDatasources": [
47-
"go"
48-
],
49-
"matchDepNames": [
50-
"k8s.io/client-go"
51-
],
52-
"allowedVersions": "<1.0"
53-
}, {
54-
// We want a single PR for all the patches bumps of kubernetes related
55-
// dependencies, as most of the times these are all strictly related.
56-
"matchDatasources": [
57-
"go"
58-
],
59-
"groupName": "kubernetes patches",
60-
"matchUpdateTypes": [
61-
"patch",
62-
"digest"
63-
],
64-
"matchPackagePrefixes": [
65-
"k8s.io",
66-
"sigs.k8s.io"
67-
]
68-
}, {
69-
// We want dedicated PRs for each minor and major bumps to kubernetes related
70-
// dependencies.
71-
"matchDatasources": [
72-
"go"
73-
],
74-
"matchUpdateTypes": [
75-
"major",
76-
"minor"
77-
],
78-
"matchPackagePrefixes": [
79-
"k8s.io",
80-
"sigs.k8s.io"
81-
]
82-
}, {
83-
// We want dedicated PRs for each bump to non-kubernetes Go dependencies, but
84-
// only if there are known vulnerabilities in the current version.
85-
"matchDatasources": [
86-
"go"
87-
],
88-
"matchPackagePatterns": [
89-
"*"
90-
],
91-
"enabled": false,
92-
"excludePackagePrefixes": [
93-
"k8s.io",
94-
"sigs.k8s.io"
95-
],
96-
"matchUpdateTypes": [
97-
"major",
98-
],
99-
}, {
100-
// We want a single PR for all minor and patch bumps to non-kubernetes Go
101-
// dependencies, but only if there are known vulnerabilities in the current
102-
// version.
103-
"matchDatasources": [
104-
"go"
105-
],
106-
"matchPackagePatterns": [
107-
"*"
108-
],
109-
"enabled": false,
110-
"excludePackagePrefixes": [
111-
"k8s.io",
112-
"sigs.k8s.io"
113-
],
114-
"matchUpdateTypes": [
115-
"minor",
116-
"patch",
117-
"digest"
118-
],
119-
"groupName": "all non-major go dependencies"
120-
}, {
121-
// We want a single PR for all minor and patch bumps of Github Actions
122-
"matchDepTypes": [
123-
"action"
124-
],
125-
"matchUpdateTypes": [
126-
"minor",
127-
"patch"
128-
],
129-
"groupName": "all non-major github action",
130-
"pinDigests": true
131-
},{
132-
// We want dedicated PRs for each major bump to Github Actions
133-
"matchDepTypes": [
134-
"action"
135-
],
136-
"pinDigests": true
137-
}
138-
]
101+
description: 'Ignore k8s dependencies, should be updated on crossplane-runtime',
102+
matchDatasources: [
103+
'go',
104+
],
105+
enabled: false,
106+
matchPackageNames: [
107+
'k8s.io{/,}**',
108+
'sigs.k8s.io{/,}**',
109+
],
110+
},
111+
{
112+
description: 'Only get dependency digest updates every month to reduce noise, except crossplane-runtime',
113+
matchDatasources: [
114+
'go',
115+
],
116+
matchUpdateTypes: [
117+
'digest',
118+
],
119+
extends: [
120+
'schedule:monthly',
121+
],
122+
matchPackageNames: [
123+
'!github.com/crossplane/crossplane-runtime',
124+
],
125+
},
126+
{
127+
description: "Ignore oss-fuzz, it's not using tags, we'll stick to master",
128+
matchDepTypes: [
129+
'action',
130+
],
131+
matchDepNames: [
132+
'google/oss-fuzz',
133+
],
134+
enabled: false,
135+
},
136+
],
139137
}

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ on:
1313
workflow_dispatch: {}
1414

1515
env:
16-
GO_VERSION: "1.22"
16+
GO_VERSION: "1.23.7"
1717

1818
jobs:
1919
detect-noop:
@@ -81,7 +81,7 @@ jobs:
8181
echo "analysis_cache_key_int=$(make go.lint.analysiskey-interval)" >> $GITHUB_OUTPUT
8282
8383
- name: Cache Linter Analysis
84-
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
84+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
8585
id: cache-analysis
8686
with:
8787
path: ${{ steps.analysis_cache.outputs.analysis_cache }}
@@ -94,7 +94,7 @@ jobs:
9494

9595
- name: Lint
9696
env:
97-
GOLANGCI_LINT_CACHE: ${{ steps.go_cache.outputs.analysis_cache }}
97+
GOLANGCI_LINT_CACHE: ${{ steps.analysis_cache.outputs.analysis_cache }}
9898
SKIP_LINTER_ANALYSIS: false
9999
RUN_BUILDTAGGER: true
100100
GOGC: "50"

‎.github/workflows/uptest-trigger.yaml‎

Lines changed: 27 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -9,22 +9,35 @@ on:
99
types: [created]
1010

1111
env:
12-
GO_VERSION: "1.22"
12+
GO_VERSION: "1.23.7"
1313

1414
jobs:
15-
debug:
15+
check-permissions:
1616
runs-on: ubuntu-latest
17+
outputs:
18+
permission: ${{ steps.check-permissions.outputs.permission }}
1719
steps:
18-
- name: Debug
20+
- name: Get Commenter Permissions
21+
id: check-permissions
1922
run: |
2023
echo "Trigger keyword: '/test-examples'"
2124
echo "Go version: ${{ env.GO_VERSION }}"
22-
echo "github.event.comment.author_association: ${{ github.event.comment.author_association }}"
25+
26+
REPO=${{ github.repository }}
27+
COMMENTER=${{ github.event.comment.user.login }}
28+
29+
# Fetch the commenter's repo-level permission grant
30+
GRANTED=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
31+
-H "Accept: application/vnd.github.v3+json" \
32+
"https://api.github.com/repos/$REPO/collaborators/$COMMENTER/permission" | jq -r .permission)
33+
34+
# Make it accessible in the workflow via a job output -- cannot use env
35+
echo "User $COMMENTER has $GRANTED permissions"
36+
echo "permission=$GRANTED" >> "$GITHUB_OUTPUT"
2337
2438
get-example-list:
25-
if: ${{ (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' ) &&
26-
github.event.issue.pull_request &&
27-
contains(github.event.comment.body, '/test-examples' ) }}
39+
needs: check-permissions
40+
if: ${{ (needs.check-permissions.outputs.permission == 'admin' || needs.check-permissions.outputs.permission == 'write') && github.event.issue.pull_request != null && contains(github.event.comment.body, '/test-examples')}}
2841
runs-on: ubuntu-latest
2942
outputs:
3043
example_list: ${{ steps.get-example-list-name.outputs.example-list }}
@@ -79,12 +92,11 @@ jobs:
7992
-f context="Uptest-${{ steps.get-example-list-name.outputs.example-hash }}"
8093
8194
uptest:
82-
if: ${{ (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' ) &&
83-
github.event.issue.pull_request &&
84-
contains(github.event.comment.body, '/test-examples' ) }}
95+
needs:
96+
- check-permissions
97+
- get-example-list
98+
if: ${{ (needs.check-permissions.outputs.permission == 'admin' || needs.check-permissions.outputs.permission == 'write') && github.event.issue.pull_request != null && contains(github.event.comment.body, '/test-examples')}}
8599
runs-on: ubuntu-latest
86-
needs: get-example-list
87-
88100
steps:
89101
- name: Cleanup Disk
90102
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
@@ -93,7 +105,7 @@ jobs:
93105
swap-storage: false
94106

95107
- name: Setup QEMU
96-
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
108+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
97109
with:
98110
platforms: all
99111

@@ -103,7 +115,7 @@ jobs:
103115
submodules: true
104116

105117
- name: Setup Go
106-
uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
118+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
107119
with:
108120
go-version: ${{ env.GO_VERSION }}
109121

@@ -153,7 +165,7 @@ jobs:
153165
154166
- name: Upload Cluster Dump
155167
if: always()
156-
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
168+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
157169
with:
158170
name: controlplane-dump
159171
path: ./_output/controlplane-dump

0 commit comments

Comments
 (0)