This is a bit of a bag of a few smaller things:
* workflows/nightly: skip imported gqlparser package.json
It is not used anywhere.
* .trivyignore: remove docker CVE
This has been bumped away when updating ORAS.
* website/livescripts: bump minimatch
This also updated the lockfile version... I think that's OK.
* workflows/pull-request: don't setup opa for docker image smoke test
* address netlify ignore script failure on large output
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
It had slipped my mind that those need docker, too. Previously, I've disabled
docker for those tests to avoid having them rebuild their wasm artifacts.
The wasm/Makefile change is superficial, and just meant to ensure we run this
test while the PR is WIP. Changes to .github/workflow/* alone won't trigger the
wasm tests.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* ci: remove quick-fuzz, guard wasm tests on changed files
This is a first step into running less things all the time that don't need to
be run all the time.
It's a heuristic, and as such fallible: there could always be changes that
break something in the wasm code path, because I have forgotten that there's a
dependency of some sort.
Removing the quick-fuzz target, it's never brought any issues up; and still
runs in nightly tests.
* ci: cancel previous run for PRs
From https://stackoverflow.com/a/72408109/993018.
* ci: avoid rebuilding wasm
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
ubuntu-18.04 was causing our builds to break, in a scheduled brownout.
All references to either ubuntu-latest or ubuntu-18.04 are now ubuntu-22.04.
(I figured it's better to control the version in all places.)
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
With this, we'll build our container images and binaries using golang 1.19.
Also, the go.mod version stanza is increased, letting us use go1.17+ features.
I had to run
go mod tidy -go=1.16 && go mod tidy -go=1.17
to get rid of `go mod tidy` related messages, and ran `go mod vendor`
afterwards.
* prometheus: adjust tests for new go1.19 metrics
Note that the new metrics only appear when using the Go runtime of 1.19. So,
we do the same we've done before when 1.17 brought in new metrics: add them
to the tests, and use build flags to not run the tests in the previous versions.
When the bump of github.com/prometheus/go_client to 1.13.0 was merged, it was
properly tested with all of 1.17 and 1.18. So, the previously expected metrics
should be there when using OPA from 1.17 or 1.18.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
1. only check the edge-static image
There are a bunch of libc-related findings that are hard to address, and
likely not relevant for us: for example, Go will not use glibc's regexp
engine, even if linked against libc.
2. pull the image before checking it
I've noticed locally that `trivy image` will just use whatever image it
finds under the mentioned tag. So we pull first to ensure that we actually
scan the right 'edge' image.
3. split jobs
Before, the scan-repo step wouldn't ever happen if scan-image failed. Let's
do them both all the time instead.
4. for the repo scan, ignore go.mod files of the dependencies -- there's little
we can do about, say, grpc referencing a vulnerable yaml.v2 dep in its
go.mod. And there should also be little harm in it, since we're using a more
recent version in our go.mod.
5. Updated .trivyignore with recent, new, findings.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This is breaking contributions when there is something new in trivy's
databases. That's unfortunate, and will be turned off by this commit.
We're still running the checks nightly, and that's good enough for raising the
maintainers' attention.
* .trivyignore: add CVE-2022-1996
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This uses Trivy to scan both the Git repo, as well as the generated
container image for vulnerabilities. It leverages Trivy's GitHub action
[1]. Currently, it's set to alert on `CRITICAL` and `HIGH`
vulnerabilities only.
[1] https://github.com/aquasecurity/trivy-action
This adds a section in the developer docs, as well as comments on the GitHub workflows.
Signed-off-by: Juan Antonio Osorio <juan.osoriorobles@eu.equinix.com>
To be brought back eventually; for now, it is just randomly failing.
We haven't been touching the Wasm interface in a while, so this test
isn't urgently needed these days.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* builtin_metadata: add v0.41.0 manually
We'll figure out how to do this in the release process, but for now, this
is enough to not have the builtin_metadata.json change appear in each PR.
* ci: pin last release of npm-opa-wasm
This is temporary; I don't want to deal with this right now.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* topdown: fix TestRego: run for all go versions, excluding the x509 error
That error has a different message on go1.16.
The previous attempt to exclude them from running caused _all tests_
to not be run.
* topdown_test/TestTopDownQueryCancellationEvery: up wait time for macos flakey tests
We've often seen this fail with "0 notes". Waiting for 10x the time
we previous waited for still seems to do the trick but should
hopefully remove the amount of failures we see in CE because of
slow macos runners.
* ci: don't run wasm build again in compat builds
The build is docker-based, and doesn't differ at all if run from a
different version of golang. So instead of re-building it in the
separate matrix jobs, we'll use the artifacts downloaded from the
artifact build job.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* build/policies: format using 0.39.0
* workflow/pull-request: use edge opa for rego PR checks
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
No change to go.mod's `go` stanza, so no changes in code compatibility.
However, it's used for building our docker images and release
binaries, and for fuzz testing in our nightly workflow.
Some test-related changes with the dns lookup built-in function's
error handling; and the hardcoded signature. Running
go test ./topdown -run TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature -count 10000
makes me believe that for whatever reason the signature changed,
it's at least stable.
topdown/http_test: Test-only change to accomodate this change in Go (https://go.dev/doc/go1.18):
Certificate.Verify now uses platform APIs to verify certificate
validity on macOS and iOS when it is called with a nil
VerifyOpts.Roots or when using the root pool returned from
SystemCertPool.
We're keeping the old message for go <= 1.17; in a silly-simple way.
Also:
* ci: build and test two old golang version on macos|linux
We'll drop golang 1.15, keep one unsupported version (1.16).
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Fixes#4226.
Also
* adds a YAML test to ensure that this works fine end-to-end.
* ci(pull-request): show input on failure
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Stephan Renatus