Bump golang.org/x/crypto to v0.56.0 to clear HIGH CVEs (#412) #526
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.6" | |
| cache: true | |
| - name: Download modules | |
| run: go mod download | |
| # The Go gates below mirror scripts/preflight.sh exactly so | |
| # developers can run the same checks pre-push via the | |
| # .githooks/pre-push hook. Tracked by Elevarq/Signals#141 | |
| # (sibling of Workbench#255). | |
| - name: gofmt | |
| run: bash scripts/preflight.sh gofmt | |
| - name: Vet | |
| run: bash scripts/preflight.sh vet | |
| - name: Test | |
| run: bash scripts/preflight.sh test | |
| - name: Docs drift guard | |
| run: bash scripts/preflight.sh docs | |
| - name: de-arq guard (#398) | |
| run: bash scripts/preflight.sh no-legacy-arq | |
| - name: AMI Image Builder component guard | |
| run: bash scripts/preflight.sh imagebuilder | |
| - name: Boundary tests | |
| run: > | |
| go test -v -run | |
| 'TestNoAnalyzerImports|TestNoLLMCode|TestNoScoringCode|TestNoProprietaryContent|TestLicenseFileExists' | |
| ./tests/ | |
| # #314: collector output-contract verification against a live | |
| # PostgreSQL, matrixed across every supported major so version-gated | |
| # column/type differences surface. The integration test seeds | |
| # representative schema (a parent+child table with an UNINDEXED foreign | |
| # key, plus a view, matview, partitioned table, trigger, function, | |
| # types, RLS policy, extended statistics and a rule), runs the full | |
| # collection, exports a snapshot ZIP via the production export path, | |
| # and asserts the per-collector output contract for EVERY registered | |
| # collector that emits rows (#316) — the spec-declared columns are | |
| # present, and most importantly the internal-"char" columns | |
| # (contype/relkind/relpersistence/provolatile/prokind) serialize as | |
| # single-char STRINGS, locking the #312 class | |
| # (an uncast contype serialized as 102 instead of "f", so the Analyzer | |
| # skipped every FK — Elevarq/Analyzer#1871). The test is `integration` | |
| # build-tag + SIGNALS_TEST_PG_DSN gated, so it never runs in the unit | |
| # `test` job above and skips locally when no PG is present. | |
| integration-pg: | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| pg: [14, 15, 16, 17, 18] | |
| services: | |
| postgres: | |
| image: postgres:${{ matrix.pg }} | |
| env: | |
| POSTGRES_PASSWORD: postgres | |
| ports: | |
| - 5432:5432 | |
| # Wait until the server accepts connections before the job runs. | |
| options: >- | |
| --health-cmd "pg_isready -U postgres" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| env: | |
| # Collection requires a NON-superuser role (ValidateRoleSafety | |
| # hard-fails on rolsuper), so the test connects as the dedicated | |
| # `signals` monitoring role created below — never as postgres. | |
| PGHOST: localhost | |
| PGPORT: "5432" | |
| SIGNALS_TEST_PG_DSN: "postgres://signals:signals@localhost:5432/postgres?sslmode=disable" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.6" | |
| cache: true | |
| - name: Download modules | |
| run: go mod download | |
| - name: Create non-superuser monitoring role | |
| env: | |
| PGPASSWORD: postgres | |
| run: | | |
| set -euo pipefail | |
| # Least-privilege monitoring role: LOGIN + pg_monitor, no | |
| # superuser/replication/bypassrls. CREATE on the database lets | |
| # the test seed its own dedicated schema; nothing else. | |
| # | |
| # #326: the postgres_fdw extension is created here (it needs | |
| # superuser) so the harness's FDW leg (OC-R007) is exercised | |
| # in the matrix — the test then provisions a foreign server + | |
| # grants USAGE via SIGNALS_TEST_PG_SUPERUSER_DSN and seeds a | |
| # foreign table as the `signals` role. Without this the FDW | |
| # assertion is a documented skip. | |
| psql -h localhost -U postgres -d postgres -v ON_ERROR_STOP=1 <<'SQL' | |
| CREATE ROLE signals WITH LOGIN PASSWORD 'signals'; | |
| GRANT pg_monitor TO signals; | |
| GRANT CREATE ON DATABASE postgres TO signals; | |
| CREATE EXTENSION IF NOT EXISTS postgres_fdw; | |
| SQL | |
| - name: Run collector output-contract + type-contract integration tests | |
| env: | |
| # #326: optional superuser DSN the harness uses ONLY to | |
| # provision the FDW capability (foreign server + USAGE grant) | |
| # that a pg_monitor role cannot create itself. Collection still | |
| # runs as the non-superuser `signals` role (SIGNALS_TEST_PG_DSN). | |
| SIGNALS_TEST_PG_SUPERUSER_DSN: "postgres://postgres:postgres@localhost:5432/postgres?sslmode=disable" | |
| # #320: the type-contract harness | |
| # (TestIntegration_CollectorTypeContractAgainstRealPG) locks the | |
| # PostgreSQL type classes beyond internal-"char" (numeric, jsonb, | |
| # arrays, timestamps, oid, bool) — it runs in the same PG 14-18 | |
| # matrix as the output-contract harness. The -run anchors on the | |
| # shared prefix so both TestIntegration_CollectorOutputContract... | |
| # and ...CollectorTypeContract... execute. | |
| run: > | |
| go test -tags integration -count=1 -v | |
| -run 'TestIntegration_Collector(Output|Type)ContractAgainstRealPG' | |
| ./tests/ | |
| # #329: production-path lock for budget exhaustion mid-query | |
| # (SIGNALS-R108). Forces a target's per-cycle budget to expire | |
| # during a collector query and asserts the partial cycle + complete | |
| # status inventory persist against live PG. Runs under -race — the | |
| # test uses a goroutine-blocking seam and asserts atomic persistence. | |
| - name: Run budget-exhaustion mid-query integration test | |
| run: > | |
| go test -tags integration -race -count=1 -v | |
| -run TestIntegration_BudgetExhaustionMidQuery | |
| ./internal/collector/ | |
| security-scan: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # #161: setup-go so the govulncheck install + preflight `vuln` | |
| # gate runs against the same toolchain as the test job above. | |
| # The secrets gate doesn't need Go, but co-locating both gates | |
| # in one job keeps the workflow surface flat. | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26.6" | |
| cache-dependency-path: go.sum | |
| - name: Trivy filesystem scan (vuln + secret) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "." | |
| scanners: "vuln,secret" | |
| severity: "CRITICAL,HIGH" | |
| exit-code: "1" | |
| - name: Trivy config scan (Dockerfile + Helm) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: "config" | |
| scan-ref: "." | |
| severity: "CRITICAL,HIGH" | |
| exit-code: "1" | |
| # #161: route the secret + vulnerability gates through | |
| # scripts/preflight.sh so the local pre-push hook (.githooks/ | |
| # pre-push → `preflight.sh all`) and the push/PR CI gate run | |
| # identical commands. The repo-side .gitleaks.toml is the | |
| # single source of truth for the secret-scan allowlist (#160). | |
| - name: Install gitleaks (checksum-verified) | |
| env: | |
| GITLEAKS_VERSION: "8.24.3" | |
| run: | | |
| set -euo pipefail | |
| BASE="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}" | |
| TARBALL="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| tmp="$(mktemp -d)" | |
| trap 'rm -rf "$tmp"' EXIT | |
| # Download the tarball and the official checksums file from | |
| # the same release. Verifying via the upstream-published | |
| # SHA256SUMS catches a tampered tarball even when the | |
| # checksum row is rewritten — gh-attestations + the release | |
| # asset signing on gitleaks' side cover the upstream channel. | |
| curl -sSfLo "$tmp/$TARBALL" "$BASE/$TARBALL" | |
| curl -sSfLo "$tmp/checksums.txt" "$BASE/gitleaks_${GITLEAKS_VERSION}_checksums.txt" | |
| (cd "$tmp" && grep " $TARBALL\$" checksums.txt | sha256sum -c -) | |
| tar -xzf "$tmp/$TARBALL" -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Install govulncheck | |
| # Pinned to the 40-char SHA of golang/vuln v1.3.0 so Scorecard's | |
| # PinnedDependenciesID `goCommand not pinned by hash` finding | |
| # actually clears (a version tag like @v1.3.0 still trips it — | |
| # the policy specifically requires a hash). Refresh via Dependabot | |
| # is not automatic for `go install` invocations; bump manually | |
| # when a new golang/vuln tag lands by replacing the SHA with the | |
| # new commit's SHA (the comment after `#` is the human-readable | |
| # version pointer). | |
| run: go install golang.org/x/vuln/cmd/govulncheck@0782b76014f15f24e22a438f30f308df42899ba1 # v1.3.0 | |
| # #163: Semgrep + OSV-Scanner round out the security bundle. | |
| # Semgrep ships from PyPI; OSV-Scanner installs via go install | |
| # against the same toolchain setup-go provisioned above. The | |
| # google/osv-scanner-action wrapper is not used directly | |
| # because its setup subpath doesn't ship an action.yml. | |
| - name: Install Semgrep | |
| run: pip3 install "semgrep==1.166.0" # pinned — resolves Scorecard PinnedDependenciesID (#45) | |
| - name: Install OSV-Scanner | |
| run: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.2.4 | |
| - name: Secrets gate (gitleaks via preflight.sh) | |
| run: bash scripts/preflight.sh secrets | |
| - name: Vulnerability gate (govulncheck via preflight.sh) | |
| run: bash scripts/preflight.sh vuln | |
| - name: SAST gate (semgrep via preflight.sh) | |
| run: bash scripts/preflight.sh semgrep | |
| - name: Dependency CVE gate (osv-scanner via preflight.sh) | |
| run: bash scripts/preflight.sh osv | |
| # #164: KubeLinter + Conftest against the rendered Helm | |
| # chart. Helm is preinstalled on the GitHub Ubuntu runner; | |
| # the linters are downloaded as release tarballs because the | |
| # upstream actions are out-of-date or require a license. | |
| - name: Install kube-linter | |
| env: | |
| KUBE_LINTER_VERSION: "0.8.3" | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/stackrox/kube-linter/releases/download/v${KUBE_LINTER_VERSION}/kube-linter-linux.tar.gz" \ | |
| | tar -xz -C /usr/local/bin kube-linter | |
| kube-linter version | |
| - name: Install conftest | |
| env: | |
| CONFTEST_VERSION: "0.62.0" | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_x86_64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin conftest | |
| conftest --version | |
| - name: Helm + Kubernetes gate (kube-linter + conftest via preflight.sh) | |
| run: bash scripts/preflight.sh kube-lint | |
| # #173: golangci-lint gate. The default-linter set | |
| # (errcheck/staticcheck/unused) ran 50 findings at the | |
| # baseline; #173 cleaned the tree, pinned `.golangci.yml`, | |
| # and promoted the gate from local-only to push/PR-enforced. | |
| # | |
| # Install via `go install` rather than the upstream action | |
| # because the action's v6/v7 implicit version selection | |
| # lags golangci-lint v2 releases; pinning here keeps CI and | |
| # local in lockstep on the v2 config schema this repo uses. | |
| - name: Install golangci-lint | |
| run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.5.0 | |
| - name: Lint gate (golangci-lint via preflight.sh) | |
| run: bash scripts/preflight.sh lint |