Skip to content

Commit 3790be2

Browse files
jimmidysonjimmidyson
committed
build: go1.25.1 to fix CVE
The majority of changes here are to ensure that the kube-api-linter tool is built with the same version as golangci-lint, which in turn is built with the same go language version of the project, otherwise linting will fail due to language incompatibilities.
1 parent 3a86dd6 commit 3790be2

File tree

8 files changed

+99
-96
lines changed

8 files changed

+99
-96
lines changed

‎api/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/ap
55

66
go 1.23.0
77

8-
toolchain go1.24.5
8+
toolchain go1.25.1
99

1010
replace github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/common => ../common
1111

‎common/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/co
55

66
go 1.23.0
77

8-
toolchain go1.24.5
8+
toolchain go1.25.1
99

1010
require (
1111
github.com/evanphx/json-patch/v5 v5.9.11

‎devbox.json‎

Lines changed: 45 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,49 @@
11
{
2-
"packages": [
3-
"actionlint@latest",
4-
"chart-testing@latest",
5-
"clusterctl@latest",
6-
"coreutils@latest",
7-
"crane@latest",
8-
"envsubst@latest",
9-
"findutils@latest",
10-
"gh@latest",
11-
"ginkgo@latest",
12-
"git@latest",
13-
"gnumake@latest",
14-
"gnused@latest",
15-
"go@latest",
16-
"gojq@latest",
17-
"golangci-lint@latest",
18-
"gomplate@latest",
19-
"goreleaser@latest",
20-
"gotestsum@latest",
21-
"govulncheck@latest",
22-
"helm-docs@latest",
23-
"[email protected]",
24-
"kind@latest",
25-
"ko@latest",
26-
"kubebuilder@latest",
27-
"kubectl@latest",
28-
"kubernetes-controller-tools@latest",
29-
"kustomize@latest",
30-
"pre-commit@latest",
31-
"reviewdog@latest",
32-
"rsync@latest",
33-
"setup-envtest@latest",
34-
"shfmt@latest",
35-
"yamale@latest",
36-
"yamllint@latest",
37-
"yq-go@latest",
38-
"path:./hack/flakes#clusterctl-aws",
39-
"path:./hack/flakes#goprintconst",
40-
"path:./hack/flakes#helm-with-plugins",
41-
"path:./hack/flakes#release-please"
42-
],
2+
"packages": {
3+
"actionlint": "latest",
4+
"chart-testing": "latest",
5+
"clusterctl": "latest",
6+
"coreutils": "latest",
7+
"crane": "latest",
8+
"envsubst": "latest",
9+
"findutils": "latest",
10+
"gh": "latest",
11+
"ginkgo": "latest",
12+
"git": "latest",
13+
"gnumake": "latest",
14+
"gnused": "latest",
15+
"go": "latest",
16+
"gojq": "latest",
17+
"gomplate": "latest",
18+
"goreleaser": "latest",
19+
"gotestsum": "latest",
20+
"govulncheck": "latest",
21+
"helm-docs": "latest",
22+
"hugo": "0.145.0",
23+
"kind": "latest",
24+
"ko": "latest",
25+
"kubebuilder": "latest",
26+
"kubectl": "latest",
27+
"kubernetes-controller-tools": "latest",
28+
"kustomize": "latest",
29+
"pre-commit": "latest",
30+
"reviewdog": "latest",
31+
"rsync": "latest",
32+
"setup-envtest": "latest",
33+
"shfmt": "latest",
34+
"yamale": "latest",
35+
"yamllint": "latest",
36+
"yq-go": "latest",
37+
"path:./hack/flakes#clusterctl-aws": "",
38+
"path:./hack/flakes#golangci-lint": "",
39+
"path:./hack/flakes#goprintconst": "",
40+
"path:./hack/flakes#helm-with-plugins": "",
41+
"path:./hack/flakes#release-please": "",
42+
"apple-sdk_12": {
43+
"version": "latest",
44+
"platforms": ["aarch64-darwin"]
45+
}
46+
},
4347
"shell": {
4448
"scripts": {
4549
"preview-docs": [

‎devbox.lock‎

Lines changed: 28 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,34 @@
4949
}
5050
}
5151
},
52+
"apple-sdk_12@latest": {
53+
"last_modified": "2025-07-28T17:09:23Z",
54+
"resolved": "github:NixOS/nixpkgs/648f70160c03151bc2121d179291337ad6bc564b#apple-sdk_12",
55+
"source": "devbox-search",
56+
"version": "12.3",
57+
"systems": {
58+
"aarch64-darwin": {
59+
"outputs": [
60+
{
61+
"name": "out",
62+
"path": "/nix/store/kvs20yk8vvs0201i1xczafjibvklcacc-apple-sdk-12.3",
63+
"default": true
64+
}
65+
],
66+
"store_path": "/nix/store/kvs20yk8vvs0201i1xczafjibvklcacc-apple-sdk-12.3"
67+
},
68+
"x86_64-darwin": {
69+
"outputs": [
70+
{
71+
"name": "out",
72+
"path": "/nix/store/0lwhprmdl5qfhca48jhg3r9zsyv2a7p2-apple-sdk-12.3",
73+
"default": true
74+
}
75+
],
76+
"store_path": "/nix/store/0lwhprmdl5qfhca48jhg3r9zsyv2a7p2-apple-sdk-12.3"
77+
}
78+
}
79+
},
5280
"chart-testing@latest": {
5381
"last_modified": "2025-07-13T22:45:35Z",
5482
"resolved": "github:NixOS/nixpkgs/a421ac6595024edcfbb1ef950a3712b89161c359#chart-testing",
@@ -853,54 +881,6 @@
853881
}
854882
}
855883
},
856-
"golangci-lint@latest": {
857-
"last_modified": "2025-07-18T03:30:42Z",
858-
"resolved": "github:NixOS/nixpkgs/e821e03193486359aa942372be2d9c1f377b7a18#golangci-lint",
859-
"source": "devbox-search",
860-
"version": "2.2.2",
861-
"systems": {
862-
"aarch64-darwin": {
863-
"outputs": [
864-
{
865-
"name": "out",
866-
"path": "/nix/store/00sy2bp921ax5cxphxz0ifgax6i97mx7-golangci-lint-2.2.2",
867-
"default": true
868-
}
869-
],
870-
"store_path": "/nix/store/00sy2bp921ax5cxphxz0ifgax6i97mx7-golangci-lint-2.2.2"
871-
},
872-
"aarch64-linux": {
873-
"outputs": [
874-
{
875-
"name": "out",
876-
"path": "/nix/store/gvay3vc5ll70dfryiy6qa16w3ybagiq7-golangci-lint-2.2.2",
877-
"default": true
878-
}
879-
],
880-
"store_path": "/nix/store/gvay3vc5ll70dfryiy6qa16w3ybagiq7-golangci-lint-2.2.2"
881-
},
882-
"x86_64-darwin": {
883-
"outputs": [
884-
{
885-
"name": "out",
886-
"path": "/nix/store/9pxfg0y3hiaf08vnzk2fs4qh76r2kd22-golangci-lint-2.2.2",
887-
"default": true
888-
}
889-
],
890-
"store_path": "/nix/store/9pxfg0y3hiaf08vnzk2fs4qh76r2kd22-golangci-lint-2.2.2"
891-
},
892-
"x86_64-linux": {
893-
"outputs": [
894-
{
895-
"name": "out",
896-
"path": "/nix/store/z0d7708yc7d0z6nj0mwalbi6hf79yj68-golangci-lint-2.2.2",
897-
"default": true
898-
}
899-
],
900-
"store_path": "/nix/store/z0d7708yc7d0z6nj0mwalbi6hf79yj68-golangci-lint-2.2.2"
901-
}
902-
}
903-
},
904884
"gomplate@latest": {
905885
"last_modified": "2025-07-13T22:45:35Z",
906886
"resolved": "github:NixOS/nixpkgs/a421ac6595024edcfbb1ef950a3712b89161c359#gomplate",

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix
55

66
go 1.24.0
77

8-
toolchain go1.24.5
8+
toolchain go1.25.1
99

1010
replace (
1111
github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/api => ./api

‎hack/flakes/flake.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎hack/flakes/flake.nix‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@
1010
flake-utils.lib.eachDefaultSystem (system:
1111
with nixpkgs.legacyPackages.${system}; rec {
1212
packages = rec {
13+
# Versions available via Devbox are currently behind due to nixhubi.io not being updated
14+
# correctly. Referencing the package in this flake directly from nixpkgs is the workaround.
15+
# This is required to support Go 1.25.
16+
# Once https://github.com/jetify-com/devbox/issues/2609 is fixed, this can be removed.
17+
golangci-lint = pkgs.golangci-lint;
18+
1319
goprintconst = buildGo124Module rec {
1420
name = "goprintconst";
1521
version = "0.0.1-dev";

‎make/go.mk‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -156,9 +156,19 @@ lint.%: ## Runs golangci-lint run for a specific module
156156
lint.%: hack/tools/golangci-lint-kube-api-linter fmt.% ; $(info $(M) linting $* module)
157157
$(if $(filter-out root,$*),cd $* && )$(PWD)/hack/tools/golangci-lint-kube-api-linter run --fix --config=$(GOLANGCI_CONFIG_FILE)
158158

159+
# Ensure that the golangci-lint-kube-api-linter tool is using the same version of Go as the golangci-lint tool, which
160+
# should in turn be the same language version as the project.
161+
GOLANGCI_LINT_VERSION := $(shell golangci-lint version --json 2>/dev/null | gojq --raw-output '.goVersion')
162+
GOLANGCI_LINT_KUBE_API_LINTER_VERSION := $(shell hack/tools/golangci-lint-kube-api-linter version --json 2>/dev/null | gojq --raw-output '.goVersion')
163+
ifneq ($(GOLANGCI_LINT_VERSION),$(GOLANGCI_LINT_KUBE_API_LINTER_VERSION))
164+
.PHONY: hack/tools/golangci-lint-kube-api-linter
165+
endif
166+
# Explicitly set the GOTOOLCHAIN environment variable to the same version of Go as the golangci-lint tool
167+
# to ensure that the go version is the same as the golangci-lint tool.
168+
hack/tools/golangci-lint-kube-api-linter: export GOTOOLCHAIN := $(GOLANGCI_LINT_VERSION)
159169
hack/tools/golangci-lint-kube-api-linter: hack/tools/.custom-gcl.yml
160170
hack/tools/golangci-lint-kube-api-linter: ; $(info $(M) installing golangci-lint-kube-api-linter tool)
161-
cd hack/tools && golangci-lint custom
171+
cd hack/tools && golangci-lint custom --verbose
162172

163173
.PHONY: mod-tidy
164174
mod-tidy: ## Run go mod tidy for all modules
@@ -259,6 +269,9 @@ endif
259269
ifneq ($(words $(GO_SUBMODULES_NO_DOCS)),0)
260270
go-mod-edit-toolchain: $(addprefix go-mod-edit-toolchain.,$(GO_SUBMODULES_NO_DOCS:/go.mod=))
261271
endif
272+
ifneq ($(wildcard $(REPO_ROOT)/hack/tools/go.mod),)
273+
cd hack/tools && go mod edit -toolchain=$(GO_TOOLCHAIN_VERSION)
274+
endif
262275

263276
.PHONY: go-mod-edit-toolchain.%
264277
go-mod-edit-toolchain.%: ## Edits the go.mod file of a specifc module in repository to use the toolchain version

0 commit comments

Comments
 (0)