Skip to content

Commit 96dc7c4

Browse files
benjaminjbbenjaminjb
authored
Merge branch 'main' into update-feature-gate-logging
2 parents 2f4d6c8 + 58351d3 commit 96dc7c4

File tree

97 files changed

+2065
-1601
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

97 files changed

+2065
-1601
lines changed

‎.github/actions/trivy/action.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Trivy
2+
description: Scan this project using Trivy
3+
4+
# The Trivy team maintains an action, but it has trouble caching its vulnerability data:
5+
# https://github.com/aquasecurity/trivy-action/issues/389
6+
#
7+
# The action below uses any recent cache matching `cache-prefix` and calculates a cache key
8+
# derived from the data Trivy downloads.
9+
10+
inputs:
11+
cache:
12+
default: restore,success,use
13+
description: >-
14+
What Trivy data to cache; one or more of restore, save, success, or use.
15+
16+
database:
17+
default: update
18+
description: >-
19+
How Trivy should handle its data; one of update or skip.
20+
21+
setup:
22+
default: v0.57.1,cache
23+
description: >-
24+
How to install Trivy; one or more of version, none, or cache.
25+
26+
cache-directory:
27+
default: ${{ github.workspace }}/.cache/trivy
28+
29+
cache-prefix:
30+
default: cache-trivy
31+
32+
scan-target:
33+
default: .
34+
35+
scan-type:
36+
default: filesystem
37+
38+
runs:
39+
using: composite
40+
steps:
41+
# Parse list inputs as separated by commas and spaces.
42+
# Select the maximum version-looking string from `inputs.setup`.
43+
- id: parsed
44+
shell: bash
45+
run: |
46+
# Validate inputs
47+
(
48+
<<< '${{ inputs.cache }}' jq -rRsS '"cache=\(split("[,\\s]+"; "") - [""])"'
49+
<<< '${{ inputs.setup }}' jq -rRsS '
50+
"setup=\(split("[,\\s]+"; "") - [""])",
51+
"version=\(split("[,\\s]+"; "") | max_by(split("[v.]"; "") | map(tonumber?)))"
52+
'
53+
) | tee --append $GITHUB_OUTPUT
54+
55+
# Install Trivy as requested.
56+
- if: ${{ ! contains(fromJSON(steps.parsed.outputs.setup), 'none') }}
57+
uses: aquasecurity/[email protected]
58+
with:
59+
cache: ${{ contains(fromJSON(steps.parsed.outputs.setup), 'cache') }}
60+
version: ${{ steps.parsed.outputs.version }}
61+
62+
# Restore a recent cache beginning with the prefix.
63+
- id: restore
64+
if: ${{ contains(fromJSON(steps.parsed.outputs.cache), 'restore') }}
65+
uses: actions/cache/restore@v4
66+
with:
67+
path: ${{ inputs.cache-directory }}
68+
key: ${{ inputs.cache-prefix }}-
69+
70+
- id: trivy
71+
shell: bash
72+
env:
73+
TRIVY_CACHE_DIR: >-
74+
${{ contains(fromJSON(steps.parsed.outputs.cache), 'use') && inputs.cache-directory || '' }}
75+
TRIVY_SKIP_CHECK_UPDATE: ${{ inputs.database == 'skip' }}
76+
TRIVY_SKIP_DB_UPDATE: ${{ inputs.database == 'skip' }}
77+
TRIVY_SKIP_JAVA_DB_UPDATE: ${{ inputs.database == 'skip' }}
78+
run: |
79+
# Run Trivy
80+
trivy '${{ inputs.scan-type }}' '${{ inputs.scan-target }}' || result=$?
81+
82+
checksum=$([[ -z "${TRIVY_CACHE_DIR}" ]] || cat "${TRIVY_CACHE_DIR}/"*/metadata.json | sha256sum)
83+
echo 'cache-key=${{ inputs.cache-prefix }}-'"${checksum%% *}" >> $GITHUB_OUTPUT
84+
85+
exit "${result-0}"
86+
87+
# Save updated data to the cache when requested.
88+
- if: >-
89+
${{
90+
steps.restore.outcome == 'success' &&
91+
steps.restore.outputs.cache-matched-key == steps.trivy.outputs.cache-key
92+
}}
93+
shell: bash
94+
run: |
95+
# Cache hit on ${{ steps.restore.outputs.cache-matched-key }}
96+
- if: >-
97+
${{
98+
steps.restore.outputs.cache-matched-key != steps.trivy.outputs.cache-key &&
99+
(
100+
(contains(fromJSON(steps.parsed.outputs.cache), 'save') && !cancelled()) ||
101+
(contains(fromJSON(steps.parsed.outputs.cache), 'success') && success())
102+
)
103+
}}
104+
uses: actions/cache/save@v4
105+
with:
106+
key: ${{ steps.trivy.outputs.cache-key }}
107+
path: ${{ inputs.cache-directory }}

‎.github/workflows/codeql-analysis.yaml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,28 @@
1+
# https://codeql.github.com
12
name: CodeQL
23

34
on:
45
pull_request:
56
push:
67
branches:
78
- main
8-
- master
99
schedule:
1010
- cron: '10 18 * * 2'
1111

12+
env:
13+
# Use the Go toolchain installed by setup-go
14+
# https://github.com/actions/setup-go/issues/457
15+
GOTOOLCHAIN: local
16+
1217
jobs:
1318
analyze:
14-
runs-on: ubuntu-latest
19+
if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
1520
permissions:
1621
actions: read
1722
contents: read
1823
security-events: write
1924

20-
if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
21-
25+
runs-on: ubuntu-latest
2226
steps:
2327
- uses: actions/checkout@v4
2428
- uses: actions/setup-go@v5

‎.github/workflows/govulncheck.yaml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# https://go.dev/security/vuln
2+
name: govulncheck
3+
4+
on:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
env:
11+
# Use the Go toolchain installed by setup-go
12+
# https://github.com/actions/setup-go/issues/457
13+
GOTOOLCHAIN: local
14+
15+
jobs:
16+
vulnerabilities:
17+
if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
18+
permissions:
19+
security-events: write
20+
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@v4
24+
25+
# Install Go and produce a SARIF report. This fails only when the tool is
26+
# unable to scan.
27+
- name: Prepare report
28+
uses: golang/govulncheck-action@v1
29+
with:
30+
output-file: 'govulncheck-results.sarif'
31+
output-format: 'sarif'
32+
repo-checkout: false
33+
34+
# Submit the SARIF report to GitHub code scanning. Pull request checks
35+
# succeed or fail according to branch protection rules.
36+
# - https://docs.github.com/en/code-security/code-scanning
37+
- name: Upload results to GitHub
38+
uses: github/codeql-action/upload-sarif@v3
39+
with:
40+
sarif_file: 'govulncheck-results.sarif'
41+
# TODO: https://go.dev/issue/70157
42+
if: ${{ false }}
43+
44+
# Print any detected vulnerabilities to the workflow log. This step fails
45+
# when the tool detects a vulnerability in code that is called.
46+
# - https://go.dev/blog/govulncheck
47+
- name: Log results
48+
run: govulncheck --format text --show verbose ./...

‎.github/workflows/lint.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ name: Linters
33
on:
44
pull_request:
55

6+
env:
7+
# Use the Go toolchain installed by setup-go
8+
# https://github.com/actions/setup-go/issues/457
9+
GOTOOLCHAIN: local
10+
611
jobs:
712
golangci-lint:
813
runs-on: ubuntu-latest

‎.github/workflows/test.yaml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,11 @@ on:
55
push:
66
branches:
77
- main
8-
- master
8+
9+
env:
10+
# Use the Go toolchain installed by setup-go
11+
# https://github.com/actions/setup-go/issues/457
12+
GOTOOLCHAIN: local
913

1014
jobs:
1115
go-test:
@@ -35,7 +39,6 @@ jobs:
3539
- run: ENVTEST_K8S_VERSION="${KUBERNETES#default}" make check-envtest
3640
env:
3741
KUBERNETES: "${{ matrix.kubernetes }}"
38-
GOEXPERIMENT: nocoverageredesign # https://go.dev/issue/65653
3942
GO_TEST: go test --coverprofile 'envtest.coverage' --coverpkg ./internal/...
4043

4144
# Upload coverage to GitHub
@@ -71,7 +74,6 @@ jobs:
7174
- run: make createnamespaces check-envtest-existing
7275
env:
7376
PGO_TEST_TIMEOUT_SCALE: 1.2
74-
GOEXPERIMENT: nocoverageredesign # https://go.dev/issue/65653
7577
GO_TEST: go test --coverprofile 'envtest-existing.coverage' --coverpkg ./internal/...
7678

7779
# Upload coverage to GitHub

‎.github/workflows/trivy.yaml‎

Lines changed: 62 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,41 @@
1+
# https://aquasecurity.github.io/trivy
12
name: Trivy
23

34
on:
45
pull_request:
56
push:
67
branches:
78
- main
8-
- master
9+
10+
env:
11+
# Use the Go toolchain installed by setup-go
12+
# https://github.com/actions/setup-go/issues/457
13+
GOTOOLCHAIN: local
914

1015
jobs:
16+
cache:
17+
# Run only one of these jobs at a time across the entire project.
18+
concurrency: { group: trivy-cache }
19+
# Do not fail this workflow when this job fails.
20+
continue-on-error: true
21+
22+
runs-on: ubuntu-latest
23+
steps:
24+
- uses: actions/checkout@v4
25+
- name: Download Trivy
26+
uses: ./.github/actions/trivy
27+
env:
28+
TRIVY_DEBUG: true
29+
TRIVY_DOWNLOAD_DB_ONLY: true
30+
TRIVY_NO_PROGRESS: true
31+
TRIVY_SCANNERS: license,secret,vuln
32+
1133
licenses:
34+
# Run this job after the cache job regardless of its success or failure.
35+
needs: [cache]
36+
if: >-
37+
${{ !cancelled() }}
38+
1239
runs-on: ubuntu-latest
1340
steps:
1441
- uses: actions/checkout@v4
@@ -20,52 +47,56 @@ jobs:
2047

2148
# Report success only when detected licenses are listed in [/trivy.yaml].
2249
- name: Scan licenses
23-
uses: aquasecurity/[email protected]
50+
uses: ./.github/actions/trivy
2451
env:
2552
TRIVY_DEBUG: true
53+
TRIVY_EXIT_CODE: 1
54+
TRIVY_SCANNERS: license
2655
with:
27-
scan-type: filesystem
28-
scanners: license
29-
exit-code: 1
56+
cache: restore,use
57+
database: skip
3058

3159
vulnerabilities:
32-
if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
33-
60+
# Run this job after the cache job regardless of its success or failure.
61+
needs: [cache]
62+
if: >-
63+
${{ github.repository == 'CrunchyData/postgres-operator' && !cancelled() }}
3464
permissions:
35-
# for github/codeql-action/upload-sarif to upload SARIF results
36-
security-events: write
65+
security-events: write
3766

3867
runs-on: ubuntu-latest
39-
4068
steps:
4169
- uses: actions/checkout@v4
4270

43-
# Run trivy and log detected and fixed vulnerabilities
44-
# This report should match the uploaded code scan report below
45-
# and is a convenience/redundant effort for those who prefer to
46-
# read logs and/or if anything goes wrong with the upload.
47-
- name: Log all detected vulnerabilities
48-
uses: aquasecurity/[email protected]
71+
# Print any detected secrets or vulnerabilities to the workflow log for
72+
# human consumption. This step fails only when Trivy is unable to scan.
73+
# A later step uploads results to GitHub as a pull request check.
74+
- name: Log detected vulnerabilities
75+
uses: ./.github/actions/trivy
76+
env:
77+
TRIVY_SCANNERS: secret,vuln
4978
with:
50-
scan-type: filesystem
51-
hide-progress: true
52-
ignore-unfixed: true
53-
scanners: secret,vuln
79+
cache: restore,use
80+
database: skip
5481

55-
# Upload actionable results to the GitHub Security tab.
56-
# Pull request checks fail according to repository settings.
57-
# - https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
58-
# - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning
82+
# Produce a SARIF report of actionable results. This step fails only when
83+
# Trivy is unable to scan.
5984
- name: Report actionable vulnerabilities
60-
uses: aquasecurity/[email protected]
85+
uses: ./.github/actions/trivy
86+
env:
87+
TRIVY_IGNORE_UNFIXED: true
88+
TRIVY_FORMAT: 'sarif'
89+
TRIVY_OUTPUT: 'trivy-results.sarif'
90+
TRIVY_SCANNERS: secret,vuln
6191
with:
62-
scan-type: filesystem
63-
ignore-unfixed: true
64-
format: 'sarif'
65-
output: 'trivy-results.sarif'
66-
scanners: secret,vuln
92+
cache: use
93+
database: skip
94+
setup: none
6795

68-
- name: Upload Trivy scan results to GitHub Security tab
96+
# Submit the SARIF report to GitHub code scanning. Pull requests checks
97+
# succeed or fail according to branch protection rules.
98+
# - https://docs.github.com/en/code-security/code-scanning
99+
- name: Upload results to GitHub
69100
uses: github/codeql-action/upload-sarif@v3
70101
with:
71102
sarif_file: 'trivy-results.sarif'

‎.golangci.next.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ linters:
1010
enable:
1111
- contextcheck
1212
- err113
13-
- errchkjson
1413
- gocritic
1514
- godot
1615
- godox
@@ -27,13 +26,16 @@ linters:
2726
- wastedassign
2827

2928
issues:
29+
exclude-rules:
30+
# We call external linters when they are installed: Flake8, ShellCheck, etc.
31+
- linters: [gosec]
32+
path: '_test[.]go$'
33+
text: 'G204: Subprocess launched with variable'
34+
3035
# https://github.com/golangci/golangci-lint/issues/2239
3136
exclude-use-default: false
3237

3338
linters-settings:
34-
errchkjson:
35-
check-error-free-encoding: true
36-
3739
thelper:
3840
# https://github.com/kulti/thelper/issues/27
3941
tb: { begin: true, first: true }

0 commit comments

Comments
 (0)