diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8182f163..7f0b567e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,7 +6,7 @@ Thank you for your interest in contributing to the workflow engine. This guide c ### Prerequisites -- Go 1.26.5+ +- Go 1.27.2+ - Node.js 24+ (for UI development) - Git - `golangci-lint` (install: `go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest`) diff --git a/DOCUMENTATION.md b/DOCUMENTATION.md index a86cd077..5573b5ad 100644 --- a/DOCUMENTATION.md +++ b/DOCUMENTATION.md @@ -334,7 +334,7 @@ YAML from the pipeline context, such as an HTTP route's `request_body`. | `config_from` | string | exactly one of `config_file`/`config_from` | Pipeline context path resolving to workflow config YAML. | | `output` | string | no | Output binary path; defaults to `bin/app`. | | `module_path` | string | no | Generated Go module path; defaults to `app`. | -| `go_version` | string | no | Generated `go.mod` Go version; defaults to `1.22`. | +| `go_version` | string | no | Generated `go.mod` Go version; defaults to `1.27.2`. | | `embed_config` | boolean | no | Embed `app.yaml` in the generated binary; defaults to `true`. | | `dry_run` | boolean | no | Return generated files without compiling. | | `os` | string | no | Target OS (`GOOS`); defaults to the current OS. | diff --git a/Dockerfile.admin b/Dockerfile.admin index 08b5586f..e07f819f 100644 --- a/Dockerfile.admin +++ b/Dockerfile.admin @@ -9,7 +9,7 @@ # -t workflow-server-admin:local . # --- Stage 1: Build the Go server binary --- -FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS go-builder +FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine AS go-builder ARG TARGETOS TARGETARCH diff --git a/Dockerfile.legacy b/Dockerfile.legacy index 950f7fde..ca80426e 100644 --- a/Dockerfile.legacy +++ b/Dockerfile.legacy @@ -9,7 +9,7 @@ # --- Stage 1: Build the Go binary --- # Use BUILDPLATFORM so go mod download runs natively; cross-compile via TARGETOS/TARGETARCH. -FROM --platform=$BUILDPLATFORM golang:1.26-alpine AS go-builder +FROM --platform=$BUILDPLATFORM golang:1.27.2-alpine AS go-builder ARG TARGETOS TARGETARCH diff --git a/README.md b/README.md index f1e941d7..ecd2446c 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Workflow Engine -[![Go](https://img.shields.io/badge/Go-1.26+-00ADD8?logo=go&logoColor=white)](https://go.dev) +[![Go](https://img.shields.io/badge/Go-1.27.2+-00ADD8?logo=go&logoColor=white)](https://go.dev) [![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE) [![Built on Modular](https://img.shields.io/badge/Built%20on-GoCodeAlone%2Fmodular-green)](https://github.com/GoCodeAlone/modular) [![Go Reference](https://pkg.go.dev/badge/github.com/GoCodeAlone/workflow.svg)](https://pkg.go.dev/github.com/GoCodeAlone/workflow) @@ -133,7 +133,7 @@ scaffolds, see [Repository Layout](docs/REPO_LAYOUT.md). ### Requirements -- Go 1.26.5+ +- Go 1.27.2+ - Node.js 24+ (for UI development) ### Run the Server @@ -349,7 +349,7 @@ cd ui && npm run lint | Component | Technology | |-----------|-----------| -| Language | Go 1.26 | +| Language | Go 1.27 | | Framework | [GoCodeAlone/modular](https://github.com/GoCodeAlone/modular) v1.12.3 | | UI | React, ReactFlow, Zustand, Vite, TypeScript | | Hot-Reload | [Yaegi](https://github.com/traefik/yaegi) Go interpreter | diff --git a/cigen/render_circleci.go b/cigen/render_circleci.go index 5891ea48..23f9a8af 100644 --- a/cigen/render_circleci.go +++ b/cigen/render_circleci.go @@ -102,7 +102,7 @@ func circleJobName(prefix string, phase DeployPhase, p *CIPlan) string { func writeCirclePlanJob(b *strings.Builder, jobName string, phase DeployPhase, p *CIPlan, version string) { fmt.Fprintf(b, " %s:\n", jobName) - b.WriteString(" docker:\n - image: cimg/go:1.26\n") + b.WriteString(" docker:\n - image: cimg/go:1.27.2\n") b.WriteString(" steps:\n") b.WriteString(" - checkout\n") writeCircleSetup(b, p, phase, version) @@ -111,7 +111,7 @@ func writeCirclePlanJob(b *strings.Builder, jobName string, phase DeployPhase, p func writeCircleApplyJob(b *strings.Builder, jobName string, phase DeployPhase, p *CIPlan, version string, isLast bool) { fmt.Fprintf(b, " %s:\n", jobName) - b.WriteString(" docker:\n - image: cimg/go:1.26\n") + b.WriteString(" docker:\n - image: cimg/go:1.27.2\n") b.WriteString(" steps:\n") b.WriteString(" - checkout\n") writeCircleSetup(b, p, phase, version) diff --git a/cigen/render_circleci_test.go b/cigen/render_circleci_test.go index 1ea14108..b7af7691 100644 --- a/cigen/render_circleci_test.go +++ b/cigen/render_circleci_test.go @@ -66,6 +66,41 @@ func TestRenderCircleCI_NilPlan(t *testing.T) { } } +func TestRenderCircleCI_GoVersionImages(t *testing.T) { + files, err := cigen.RenderCircleCI(richCIPlan()) + if err != nil { + t.Fatalf("RenderCircleCI: %v", err) + } + var parsed struct { + Jobs map[string]struct { + Docker []struct { + Image string `yaml:"image"` + } `yaml:"docker"` + } `yaml:"jobs"` + } + if err := yaml.Unmarshal([]byte(files[".circleci/config.yml"]), &parsed); err != nil { + t.Fatalf("parse CircleCI config: %v", err) + } + for _, name := range []string{"plan-prereq", "plan-deploy", "apply-prereq", "apply-deploy", "smoke"} { + t.Run(name, func(t *testing.T) { + job, ok := parsed.Jobs[name] + if !ok { + t.Fatalf("missing job %s", name) + } + if len(job.Docker) != 1 { + t.Fatalf("job %s has %d Docker images, want 1", name, len(job.Docker)) + } + want := "cimg/go:1.27.2" + if name == "smoke" { + want = "cimg/base:current" + } + if got := job.Docker[0].Image; got != want { + t.Errorf("job %s image = %q, want %q", name, got, want) + } + }) + } +} + func TestRenderCircleCI_SinglePhase(t *testing.T) { p := richCIPlan() p.Phases = []cigen.DeployPhase{{Name: "deploy", ConfigPath: "deploy.yaml"}} diff --git a/cmd/wfctl/deploy.go b/cmd/wfctl/deploy.go index ff1bb326..29898d76 100644 --- a/cmd/wfctl/deploy.go +++ b/cmd/wfctl/deploy.go @@ -974,7 +974,7 @@ func writeDockerfile(path string) error { const content = `# Auto-generated by wfctl deploy docker # Multi-stage build for a workflow engine application. -FROM golang:1.26.5-alpine AS builder +FROM golang:1.27.2-alpine AS builder RUN apk add --no-cache git ca-certificates WORKDIR /build COPY go.mod go.sum ./ diff --git a/cmd/wfctl/deploy_test.go b/cmd/wfctl/deploy_test.go index b6a38b45..255e74ca 100644 --- a/cmd/wfctl/deploy_test.go +++ b/cmd/wfctl/deploy_test.go @@ -146,7 +146,7 @@ func TestWriteDockerfile(t *testing.T) { if err != nil { t.Fatalf("read Dockerfile: %v", err) } - for _, want := range []string{"FROM golang", "go build", "FROM alpine", "EXPOSE 8080"} { + for _, want := range []string{"FROM golang:1.27.2-alpine AS builder", "go build", "FROM alpine", "EXPOSE 8080"} { if !strings.Contains(data, want) { t.Errorf("Dockerfile missing %q", want) } diff --git a/cmd/wfctl/fixture_build_artifacts_contract_test.go b/cmd/wfctl/fixture_build_artifacts_contract_test.go index e18152b5..af23931d 100644 --- a/cmd/wfctl/fixture_build_artifacts_contract_test.go +++ b/cmd/wfctl/fixture_build_artifacts_contract_test.go @@ -51,7 +51,7 @@ func fixtureControlCommand(ctx context.Context, root, output string, extra ...st cmd.Env = append(cmd.Env, item) } } - cmd.Env = append(cmd.Env, "GOWORK=off", "GOENV=off", "GOFLAGS=", "GOTOOLCHAIN=go1.27.1") + cmd.Env = append(cmd.Env, "GOWORK=off", "GOENV=off", "GOFLAGS=", "GOTOOLCHAIN=go1.27.2") return cmd } @@ -410,7 +410,11 @@ func TestFixtureBuildArtifactsRealOverlayMutation(t *testing.T) { root := fixtureControlSource(t) external := t.TempDir() asset, overlay := filepath.Join(external, "asset.txt"), filepath.Join(external, "overlay.json") - fixtureControlWrite(t, overlay, fmt.Sprintf(`{"Replace":{%q:%q}}`, filepath.Join(root, "asset.txt"), asset)) + sourceAsset, err := filepath.EvalSymlinks(filepath.Join(root, "asset.txt")) + if err != nil { + t.Fatal(err) + } + fixtureControlWrite(t, overlay, fmt.Sprintf(`{"Replace":{%q:%q}}`, sourceAsset, asset)) for _, want := range []string{"first-overlay", "second-overlay"} { fixtureControlWrite(t, asset, want) output := filepath.Join(t.TempDir(), "executable") @@ -744,7 +748,7 @@ func TestFixtureBuildArtifactsObservation(t *testing.T) { if observation.goVersion != "" || observation.goRoot != "" || observation.goToolDir != "" || observation.toolchain != "" { t.Fatalf("unobserved selection invented: %s", observation) } - } else if observation.goVersion != "go1.27.1" || observation.toolchain != "go1.27.1" || observation.goRoot == "" || observation.goToolDir == "" || observation.goOS == "" || observation.goArch == "" { + } else if observation.goVersion != "go1.27.2" || observation.toolchain != "go1.27.2" || observation.goRoot == "" || observation.goToolDir == "" || observation.goOS == "" || observation.goArch == "" { t.Fatalf("actual selected child compiler missing: %s", observation) } if observation.probeElapsed < 0 || observation.keyElapsed < observation.probeElapsed || observation.buildElapsed < 0 || observation.totalElapsed < observation.keyElapsed+observation.buildElapsed { @@ -775,7 +779,7 @@ func TestFixtureBuildArtifactsObservation(t *testing.T) { t.Fatal(err) } fixtureControlCounts(t, &c, 1, 2, 0) - if hit.buildRuns != 0 || hit.buildElapsed != 0 || hit.goVersion != "go1.27.1" || hit.failed { + if hit.buildRuns != 0 || hit.buildElapsed != 0 || hit.goVersion != "go1.27.2" || hit.failed { t.Fatalf("cache reuse incorrectly reported an executed build: %s", hit) } }) @@ -799,13 +803,13 @@ func TestFixtureBuildArtifactsObservationReuse(t *testing.T) { if err := build(t.Context(), false); err != nil { t.Fatal(err) } - if observation.buildRuns != 1 || observation.goVersion != "go1.27.1" { + if observation.buildRuns != 1 || observation.goVersion != "go1.27.2" { t.Fatalf("initial observed build missing: %s", observation) } if err := build(t.Context(), false); err != nil { t.Fatal(err) } - if observation.buildRuns != 0 || observation.buildElapsed != 0 || observation.goVersion != "go1.27.1" { + if observation.buildRuns != 0 || observation.buildElapsed != 0 || observation.goVersion != "go1.27.2" { t.Fatalf("reused observation retained executed build: %s", observation) } if err := build(t.Context(), true); err != nil { diff --git a/cmd/wfctl/generate.go b/cmd/wfctl/generate.go index 0342c799..8895ecd4 100644 --- a/cmd/wfctl/generate.go +++ b/cmd/wfctl/generate.go @@ -177,7 +177,7 @@ func writeCIWorkflow(path string, features *projectFeatures) error { fmt.Fprintf(&b, " - uses: %s\n", githubActionsCheckoutRef) fmt.Fprintf(&b, " - uses: %s\n", githubActionsSetupGoRef) b.WriteString(" with:\n") - b.WriteString(" go-version: '1.26.5'\n") + b.WriteString(" go-version: '1.27.2'\n") b.WriteString(" - name: Install wfctl\n") b.WriteString(" run: go install github.com/GoCodeAlone/workflow/cmd/wfctl@latest\n") b.WriteString(" - name: Validate config\n") @@ -230,7 +230,7 @@ func writeCDWorkflow(path string, features *projectFeatures, registry, platforms fmt.Fprintf(&b, " - uses: %s\n", githubActionsCheckoutRef) fmt.Fprintf(&b, " - uses: %s\n", githubActionsSetupGoRef) b.WriteString(" with:\n") - b.WriteString(" go-version: '1.26.5'\n") + b.WriteString(" go-version: '1.27.2'\n") if features.hasUI { fmt.Fprintf(&b, " - uses: %s\n", githubActionsSetupNodeRef) @@ -280,7 +280,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - name: Build plugin binaries run: | mkdir -p dist diff --git a/cmd/wfctl/generate_test.go b/cmd/wfctl/generate_test.go index 676110a9..f4a3a145 100644 --- a/cmd/wfctl/generate_test.go +++ b/cmd/wfctl/generate_test.go @@ -1,10 +1,17 @@ package main import ( + "go/ast" + "go/parser" + "go/token" "os" "path/filepath" "strings" "testing" + + allplugins "github.com/GoCodeAlone/workflow/plugins/all" + "golang.org/x/mod/modfile" + "gopkg.in/yaml.v3" ) // generateMinimalConfig is a basic API service config without UI or auth. @@ -240,6 +247,15 @@ func TestRunGenerateGithubActionsWithPlugin(t *testing.T) { t.Fatalf("failed to read release.yml: %v", err) } content := string(data) + for _, name := range []string{"ci.yml", "cd.yml", "release.yml"} { + workflow, err := os.ReadFile(filepath.Join(outDir, name)) + if err != nil { + t.Fatalf("read generated %s: %v", name, err) + } + t.Run(name, func(t *testing.T) { + assertGeneratedWorkflowGoVersion(t, workflow) + }) + } if strings.Contains(content, "softprops/action-gh-release") { t.Error("release.yml should not use softprops/action-gh-release") } @@ -403,6 +419,7 @@ func TestCIWorkflowContent(t *testing.T) { t.Fatalf("failed to read ci.yml: %v", err) } content := string(data) + assertGeneratedWorkflowGoVersion(t, data) if !strings.Contains(content, "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3") { t.Error("ci.yml should use SHA-pinned actions/checkout v6.0.3") @@ -432,6 +449,7 @@ func TestCDWorkflowContent(t *testing.T) { t.Fatalf("failed to read cd.yml: %v", err) } content := string(data) + assertGeneratedWorkflowGoVersion(t, data) if !strings.Contains(content, "tags: ['v*']") { t.Error("cd.yml should trigger on version tags") @@ -460,6 +478,7 @@ func TestReleaseWorkflowContent(t *testing.T) { t.Fatalf("failed to read release.yml: %v", err) } content := string(data) + assertGeneratedWorkflowGoVersion(t, data) if strings.Contains(content, "softprops/action-gh-release") { t.Error("release.yml should not use softprops/action-gh-release") @@ -478,18 +497,18 @@ func TestReleaseWorkflowContent(t *testing.T) { // TestInitTemplatesIncludeGithubWorkflows checks that wfctl init now generates .github/workflows/. func TestInitTemplatesIncludeGithubWorkflows(t *testing.T) { cases := []struct { - template string - wfFile string + template string + wfFile string + goBuilder string }{ - {"api-service", ".github/workflows/ci.yml"}, - {"event-processor", ".github/workflows/ci.yml"}, - {"full-stack", ".github/workflows/ci.yml"}, - {"plugin", ".github/workflows/release.yml"}, - {"ui-plugin", ".github/workflows/release.yml"}, + {"api-service", ".github/workflows/ci.yml", "builder"}, + {"event-processor", ".github/workflows/ci.yml", "builder"}, + {"full-stack", ".github/workflows/ci.yml", "go-builder"}, + {"plugin", ".github/workflows/release.yml", ""}, + {"ui-plugin", ".github/workflows/release.yml", ""}, } for _, tc := range cases { - tc := tc t.Run(tc.template, func(t *testing.T) { dir := t.TempDir() outDir := filepath.Join(dir, "project") @@ -498,9 +517,194 @@ func TestInitTemplatesIncludeGithubWorkflows(t *testing.T) { t.Fatalf("init %s failed: %v", tc.template, err) } wfPath := filepath.Join(outDir, tc.wfFile) - if _, err := os.Stat(wfPath); os.IsNotExist(err) { - t.Errorf("expected %s to be created for %s template", tc.wfFile, tc.template) + workflow, err := os.ReadFile(wfPath) + if err != nil { + t.Fatalf("read generated %s: %v", tc.wfFile, err) + } + assertGeneratedWorkflowGoVersion(t, workflow) + + modPath := filepath.Join(outDir, "go.mod") + modData, err := os.ReadFile(modPath) + if err != nil { + t.Fatalf("read generated go.mod: %v", err) + } + mod, err := modfile.Parse(modPath, modData, nil) + if err != nil { + t.Fatalf("parse generated go.mod: %v", err) + } + if mod.Go == nil { + t.Fatal("generated go.mod has no Go directive") + } + if mod.Go.Version != "1.27.2" { + t.Errorf("generated go.mod Go version = %q, want 1.27.2", mod.Go.Version) + } + + if tc.goBuilder != "" { + assertGeneratedMainDefaultPlugins(t, filepath.Join(outDir, "main.go")) + configData, err := os.ReadFile(filepath.Join(outDir, "workflow.yaml")) + if err != nil { + t.Fatalf("read generated Workflow config: %v", err) + } + var appConfig struct { + Modules []struct { + Type string `yaml:"type"` + Config struct { + HealthPath string `yaml:"healthPath"` + } `yaml:"config"` + } `yaml:"modules"` + Workflows struct { + HTTP struct { + Routes []struct { + Path string `yaml:"path"` + } `yaml:"routes"` + } `yaml:"http"` + } `yaml:"workflows"` + Triggers map[string]any `yaml:"triggers"` + } + if err := yaml.Unmarshal(configData, &appConfig); err != nil { + t.Fatalf("parse generated Workflow config: %v", err) + } + if len(appConfig.Modules) == 0 { + t.Fatal("generated application has no modules") + } + knownTypes := make(map[string]bool) + knownTriggers := make(map[string]bool) + for _, p := range allplugins.DefaultPlugins() { + for moduleType := range p.ModuleFactories() { + knownTypes[moduleType] = true + } + for triggerType := range p.TriggerFactories() { + knownTriggers[triggerType] = true + } + } + for triggerType := range appConfig.Triggers { + if !knownTriggers[triggerType] { + t.Errorf("default generated app references unavailable trigger %q", triggerType) + } + } + healthCheckers := 0 + for _, m := range appConfig.Modules { + if !knownTypes[m.Type] { + t.Errorf("default generated app references unavailable module %q", m.Type) + } + if m.Type == "health.checker" { + healthCheckers++ + if m.Config.HealthPath != "/health" { + t.Errorf("generated health checker path = %q, want /health", m.Config.HealthPath) + } + } + } + if healthCheckers != 1 { + t.Errorf("generated health checkers = %d, want 1", healthCheckers) + } + for _, route := range appConfig.Workflows.HTTP.Routes { + if route.Path == "/health" { + t.Error("generated /health must use the health-checker wiring, not a manual HTTP route") + } + } + dockerfile, err := readFileContents(filepath.Join(outDir, "Dockerfile")) + if err != nil { + t.Fatalf("read generated Dockerfile: %v", err) + } + want := "FROM golang:1.27.2-alpine AS " + tc.goBuilder + if !strings.Contains(dockerfile, want) { + t.Errorf("generated Dockerfile missing %q", want) + } + readme, err := readFileContents(filepath.Join(outDir, "README.md")) + if err != nil { + t.Fatalf("read generated README.md: %v", err) + } + if !strings.Contains(readme, "- Go 1.27.2+") { + t.Error("generated README.md missing Go 1.27.2+ prerequisite") + } } }) } } + +func assertGeneratedMainDefaultPlugins(t *testing.T, path string) { + t.Helper() + file, err := parser.ParseFile(token.NewFileSet(), path, nil, 0) + if err != nil { + t.Fatalf("parse generated main.go: %v", err) + } + imported := false + for _, spec := range file.Imports { + if spec.Path.Value == `"github.com/GoCodeAlone/workflow/plugins/all"` && spec.Name != nil && spec.Name.Name == "allplugins" { + imported = true + } + } + if !imported { + t.Error("generated main.go must import plugins/all as allplugins") + } + registered := false + ast.Inspect(file, func(node ast.Node) bool { + build, ok := node.(*ast.CallExpr) + if !ok { + return true + } + buildMethod, ok := build.Fun.(*ast.SelectorExpr) + if !ok || buildMethod.Sel.Name != "BuildFromConfig" { + return true + } + plugins, ok := buildMethod.X.(*ast.CallExpr) + if !ok || len(plugins.Args) != 1 || !plugins.Ellipsis.IsValid() { + return true + } + pluginsMethod, ok := plugins.Fun.(*ast.SelectorExpr) + if !ok || pluginsMethod.Sel.Name != "WithPlugins" { + return true + } + defaults, ok := pluginsMethod.X.(*ast.CallExpr) + if !ok || len(defaults.Args) != 0 { + return true + } + defaultsMethod, ok := defaults.Fun.(*ast.SelectorExpr) + if !ok || defaultsMethod.Sel.Name != "WithAllDefaults" { + return true + } + defaultPlugins, ok := plugins.Args[0].(*ast.CallExpr) + if !ok || len(defaultPlugins.Args) != 0 { + return true + } + defaultPluginsMethod, ok := defaultPlugins.Fun.(*ast.SelectorExpr) + if !ok || defaultPluginsMethod.Sel.Name != "DefaultPlugins" { + return true + } + alias, ok := defaultPluginsMethod.X.(*ast.Ident) + registered = ok && alias.Name == "allplugins" + return true + }) + if !registered { + t.Error("generated main.go must call WithAllDefaults().WithPlugins(allplugins.DefaultPlugins()...).BuildFromConfig") + } +} + +func assertGeneratedWorkflowGoVersion(t *testing.T, data []byte) { + t.Helper() + var workflow struct { + Jobs map[string]struct { + Steps []struct { + Uses string `yaml:"uses"` + With map[string]string `yaml:"with"` + } `yaml:"steps"` + } `yaml:"jobs"` + } + if err := yaml.Unmarshal(data, &workflow); err != nil { + t.Fatalf("parse generated workflow: %v", err) + } + found := false + for name, job := range workflow.Jobs { + for _, step := range job.Steps { + if strings.HasPrefix(step.Uses, "actions/setup-go@") { + found = true + if got := step.With["go-version"]; got != "1.27.2" { + t.Errorf("job %s setup-go version = %q, want 1.27.2", name, got) + } + } + } + } + if !found { + t.Error("generated workflow has no setup-go step") + } +} diff --git a/cmd/wfctl/init_test.go b/cmd/wfctl/init_test.go index 8e30abbd..1716a4b6 100644 --- a/cmd/wfctl/init_test.go +++ b/cmd/wfctl/init_test.go @@ -54,11 +54,11 @@ func TestRunInitAPIServiceTemplate(t *testing.T) { if !strings.Contains(string(yml), "my-service-server") { t.Errorf("workflow.yaml missing expected module name, got: %s", string(yml)) } - if !strings.Contains(string(yml), "type: observability.telemetry") { - t.Errorf("workflow.yaml missing observability.telemetry, got: %s", string(yml)) + if strings.Contains(string(yml), "type: observability.telemetry") { + t.Errorf("default workflow.yaml requires optional observability.telemetry plugin, got: %s", string(yml)) } - if !strings.Contains(string(yml), "type: observability.collector") { - t.Errorf("workflow.yaml missing observability.collector, got: %s", string(yml)) + if strings.Contains(string(yml), "type: observability.collector") { + t.Errorf("default workflow.yaml requires optional observability.collector plugin, got: %s", string(yml)) } if strings.Contains(string(yml), "type: metrics.collector") { t.Errorf("workflow.yaml should not create metrics.collector, got: %s", string(yml)) @@ -109,8 +109,11 @@ func TestRunInitFullStackTemplate(t *testing.T) { if err != nil { t.Fatalf("failed to read workflow.yaml: %v", err) } - if !strings.Contains(string(yml), "type: observability.telemetry") { - t.Errorf("workflow.yaml missing observability.telemetry, got: %s", string(yml)) + if strings.Contains(string(yml), "type: observability.telemetry") { + t.Errorf("default workflow.yaml requires optional observability.telemetry plugin, got: %s", string(yml)) + } + if strings.Contains(string(yml), "type: observability.collector") { + t.Errorf("default workflow.yaml requires optional observability.collector plugin, got: %s", string(yml)) } if strings.Contains(string(yml), "type: metrics.collector") { t.Errorf("workflow.yaml should not create metrics.collector, got: %s", string(yml)) diff --git a/cmd/wfctl/main_test.go b/cmd/wfctl/main_test.go index 347bcab6..e09b6977 100644 --- a/cmd/wfctl/main_test.go +++ b/cmd/wfctl/main_test.go @@ -36,12 +36,16 @@ func TestMain(m *testing.M) { if err := os.Setenv("WFCTL_DIFFCACHE", "disabled"); err != nil { panic("setenv WFCTL_DIFFCACHE: " + err.Error()) } - code := m.Run() + status := m.Run() + if err := pipelineRecordHostSourceCache.close(); err != nil { + fmt.Fprintln(os.Stderr, "clean up record host build cache:", err) + status = 1 + } if err := closeInvocationFixtureBuilds(); err != nil { fmt.Fprintf(os.Stderr, "fixture artifact teardown: %v\n", err) - code = 1 + status = 1 } - os.Exit(code) + os.Exit(status) } func TestHelpFlagDoesNotLeakEngineError(t *testing.T) { diff --git a/cmd/wfctl/pipeline_record_host_cache_test.go b/cmd/wfctl/pipeline_record_host_cache_test.go new file mode 100644 index 00000000..dad242a2 --- /dev/null +++ b/cmd/wfctl/pipeline_record_host_cache_test.go @@ -0,0 +1,508 @@ +package main + +import ( + "bytes" + "context" + "crypto/sha256" + "errors" + "io" + "os" + "os/exec" + "path/filepath" + "runtime" + "slices" + "sync" + "sync/atomic" + "testing" + "time" +) + +var pipelineRecordHostSourceCache pipelineRecordHostCache + +type pipelineRecordHostCacheKey struct { + fingerprint string + directory string + compiler string + compilerInfo os.FileInfo + digest [sha256.Size]byte + environment []string +} + +func pipelineRecordHostCacheKeyForCommand(cmd *exec.Cmd) (pipelineRecordHostCacheKey, error) { + var key pipelineRecordHostCacheKey + directory := cmd.Dir + if directory == "" { + var err error + directory, err = os.Getwd() + if err != nil { + return key, err + } + } + var err error + key.directory, err = filepath.Abs(directory) + if err != nil { + return key, err + } + key.compiler, err = filepath.Abs(cmd.Path) + if err != nil { + return key, err + } + key.compiler, err = filepath.EvalSymlinks(key.compiler) + if err != nil { + return key, err + } + compiler, err := os.Open(key.compiler) + if err != nil { + return key, err + } + defer compiler.Close() + key.compilerInfo, err = compiler.Stat() + if err != nil { + return key, err + } + if !key.compilerInfo.Mode().IsRegular() { + return key, errors.New("compiler must be a regular file") + } + digest := sha256.New() + if _, err := io.Copy(digest, compiler); err != nil { + return key, err + } + copy(key.digest[:], digest.Sum(nil)) + key.environment = cmd.Environ() + slices.Sort(key.environment) + return key, nil +} + +func (key pipelineRecordHostCacheKey) matches(other pipelineRecordHostCacheKey) bool { + return key.fingerprint == other.fingerprint && key.directory == other.directory && key.compiler == other.compiler && key.digest == other.digest && + os.SameFile(key.compilerInfo, other.compilerInfo) && key.compilerInfo.Mode() == other.compilerInfo.Mode() && + key.compilerInfo.ModTime().Equal(other.compilerInfo.ModTime()) && slices.Equal(key.environment, other.environment) +} + +type pipelineRecordHostCache struct { + mu sync.Mutex + key pipelineRecordHostCacheKey + directory string + load func() (string, error) + closed bool +} + +// Actual source requests retain the accepted fixture input guard. Unclosed +// inputs use the original command directly, without entering either cache. +func (cache *pipelineRecordHostCache) buildCommand(ctx context.Context, cmd *exec.Cmd, sourceRoot, output string, run func(*exec.Cmd) ([]byte, error)) ([]byte, error) { + if err := ctx.Err(); err != nil { + return nil, err + } + fingerprint, outputIndex, err := fixtureBuildKey(ctx, cmd, sourceRoot) + if err != nil { + if err := ctx.Err(); err != nil { + return nil, err + } + return run(cmd) + } + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + if err := ctx.Err(); err != nil { + return nil, err + } + return run(cmd) + } + key.fingerprint = fingerprint + var data []byte + err = cache.build(ctx, key, output, func(destination string) error { + args := cmd.Args + cmd.Args = slices.Clone(args) + cmd.Args[outputIndex] = destination + defer func() { cmd.Args = args }() + var err error + data, err = run(cmd) + return err + }) + return data, err +} + +func (cache *pipelineRecordHostCache) build(ctx context.Context, key pipelineRecordHostCacheKey, output string, build func(string) error) error { + if err := ctx.Err(); err != nil { + return err + } + cache.mu.Lock() + defer cache.mu.Unlock() + if err := ctx.Err(); err != nil { + return err + } + if cache.closed { + return os.ErrClosed + } + if cache.load == nil { + cache.key = key + cache.key.environment = slices.Clone(key.environment) + cache.load = sync.OnceValues(func() (string, error) { + var err error + cache.directory, err = os.MkdirTemp("", "wfctl-record-host-cache-") + if err != nil { + return "", err + } + binary := filepath.Join(cache.directory, "wfctl") + if err := build(binary); err != nil { + return "", err + } + if err := ctx.Err(); err != nil { + return "", err + } + return binary, nil + }) + } + if !cache.key.matches(key) { + return build(output) + } + binary, err := cache.load() + if err != nil { + return err + } + if err := ctx.Err(); err != nil { + return err + } + return copyFixtureBuildBinary(ctx, binary, output) +} + +func (cache *pipelineRecordHostCache) close() error { + cache.mu.Lock() + defer cache.mu.Unlock() + cache.closed = true + if cache.directory == "" { + return nil + } + return os.RemoveAll(cache.directory) +} + +func pipelineRecordHostCacheFixture(t *testing.T) (*exec.Cmd, string) { + t.Helper() + root := t.TempDir() + compiler := filepath.Join(root, "compiler") + if err := os.WriteFile(compiler, []byte("compiler identity fixture, not an executable\n"), 0700); err != nil { + t.Fatal(err) + } + cmd := &exec.Cmd{Path: compiler, Dir: root, Env: []string{ + "GOWORK=on", "GORACE=halt_on_error=1", "HOST_CACHE_CUSTOM=original", "GOWORK=off", + }} + return cmd, root +} + +func TestPipelineRecordHostCacheLazyReuseAndCleanup(t *testing.T) { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + var cache pipelineRecordHostCache + t.Cleanup(func() { + if err := cache.close(); err != nil { + t.Error(err) + } + }) + if cache.directory != "" { + t.Fatal("unused cache eagerly created a directory") + } + builds := 0 + want := []byte("cache helper sentinel: not runtime host proof\n") + build := func(output string) error { + builds++ + return os.WriteFile(output, want, 0600) + } + first, second := filepath.Join(root, "first"), filepath.Join(root, "second") + for _, output := range []string{first, second} { + if err := cache.build(t.Context(), key, output, build); err != nil { + t.Fatal(err) + } + got, err := os.ReadFile(output) + if err != nil || !bytes.Equal(got, want) { + t.Fatalf("copied host bytes = %q, %v", got, err) + } + info, err := os.Stat(output) + if err != nil { + t.Fatal(err) + } + if runtime.GOOS != "windows" && info.Mode().Perm() != 0700 { + t.Fatalf("copied host mode = %o, want 0700", info.Mode().Perm()) + } + } + if builds != 1 { + t.Fatalf("identical source host requests built %d times, want 1", builds) + } + firstInfo, err := os.Stat(first) + if err != nil { + t.Fatal(err) + } + secondInfo, err := os.Stat(second) + if err != nil { + t.Fatal(err) + } + if os.SameFile(firstInfo, secondInfo) { + t.Fatal("per-test host destinations share one inode") + } + owned := cache.directory + if owned == "" { + t.Fatal("used cache has no owned directory") + } + if err := cache.close(); err != nil { + t.Fatal(err) + } + if _, err := os.Stat(owned); !errors.Is(err, os.ErrNotExist) { + t.Fatalf("owned cache directory survived cleanup: %v", err) + } + for _, retained := range []string{cmd.Path, first, second} { + if _, err := os.Stat(retained); err != nil { + t.Fatalf("cache cleanup removed unrelated path %s: %v", retained, err) + } + } + if err := cache.build(t.Context(), key, filepath.Join(root, "after-close"), build); err == nil { + t.Fatal("closed cache supplied a binary") + } +} + +func TestPipelineRecordHostCacheChangedInputsBuildIndependently(t *testing.T) { + for _, change := range []string{ + "cwd", "compiler-path", "compiler-bytes", "environment", "environment-unset", + "GOFLAGS", "GOTOOLCHAIN", "GORACE", "PATH", "HOME", + } { + t.Run(change, func(t *testing.T) { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + var cache pipelineRecordHostCache + t.Cleanup(func() { + if err := cache.close(); err != nil { + t.Error(err) + } + }) + builds := 0 + build := func(output string) error { + builds++ + return os.WriteFile(output, []byte{byte(builds)}, 0600) + } + if err := cache.build(t.Context(), key, filepath.Join(root, "baseline"), build); err != nil { + t.Fatal(err) + } + switch change { + case "cwd": + cmd.Dir = t.TempDir() + case "compiler-path": + cmd.Path = filepath.Join(root, "different-compiler") + if err := os.WriteFile(cmd.Path, []byte("compiler identity fixture, not an executable\n"), 0700); err != nil { + t.Fatal(err) + } + case "compiler-bytes": + info, err := os.Stat(cmd.Path) + if err != nil { + t.Fatal(err) + } + if err := os.WriteFile(cmd.Path, []byte("modified identity fixture, not an executable\n"), 0700); err != nil { + t.Fatal(err) + } + if err := os.Chtimes(cmd.Path, info.ModTime(), info.ModTime()); err != nil { + t.Fatal(err) + } + case "environment": + cmd.Env = append(cmd.Env, "HOST_CACHE_CUSTOM=changed") + case "environment-unset": + cmd.Env = slices.DeleteFunc(cmd.Env, func(value string) bool { return value == "HOST_CACHE_CUSTOM=original" }) + case "GOFLAGS", "GOTOOLCHAIN", "GORACE", "PATH", "HOME": + cmd.Env = append(cmd.Env, change+"=override") + } + changed, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + for _, output := range []string{"changed-first", "changed-second"} { + if err := cache.build(t.Context(), changed, filepath.Join(root, output), build); err != nil { + t.Fatal(err) + } + } + if builds != 3 { + t.Fatalf("changed %s reused or replaced the baseline cache: builds = %d, want 3", change, builds) + } + if err := cache.build(t.Context(), key, filepath.Join(root, "baseline-again"), build); err != nil || builds != 3 { + t.Fatalf("changed input displaced cached baseline: builds = %d, error = %v", builds, err) + } + }) + } +} + +func TestPipelineRecordHostCacheEffectiveEnvironment(t *testing.T) { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + before := slices.Clone(cmd.Env) + cmd.Env = []string{"HOST_CACHE_CUSTOM=original", "GOWORK=off", "GORACE=halt_on_error=1"} + reordered, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + var cache pipelineRecordHostCache + t.Cleanup(func() { + if err := cache.close(); err != nil { + t.Error(err) + } + }) + builds := 0 + build := func(output string) error { + builds++ + return os.WriteFile(output, []byte("unit sentinel"), 0600) + } + if err := cache.build(t.Context(), key, filepath.Join(root, "first"), build); err != nil { + t.Fatal(err) + } + if err := cache.build(t.Context(), reordered, filepath.Join(root, "second"), build); err != nil || builds != 1 { + t.Fatalf("equivalent effective environment did not reuse: builds = %d, error = %v", builds, err) + } + cmd.Env = before + if _, err := pipelineRecordHostCacheKeyForCommand(cmd); err != nil || !slices.Equal(cmd.Env, before) { + t.Fatalf("key resolution mutated compiler environment: %v", err) + } +} + +func TestPipelineRecordHostCacheFailureAndCancellation(t *testing.T) { + for _, canceled := range []bool{false, true} { + t.Run(map[bool]string{false: "build-error", true: "build-canceled"}[canceled], func(t *testing.T) { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + var cache pipelineRecordHostCache + t.Cleanup(func() { + if err := cache.close(); err != nil { + t.Error(err) + } + }) + ctx, cancel := context.WithCancel(t.Context()) + defer cancel() + wantErr := errors.New("compiler failed") + builds := 0 + build := func(output string) error { + builds++ + if err := os.WriteFile(output, []byte("partial compiler output"), 0600); err != nil { + return err + } + if canceled { + cancel() + return nil + } + return wantErr + } + if canceled { + wantErr = context.Canceled + } + for index, requestCtx := range []context.Context{ctx, t.Context()} { + output := filepath.Join(root, []string{"first", "second"}[index]) + if err := cache.build(requestCtx, key, output, build); !errors.Is(err, wantErr) { + t.Fatalf("failed build error = %v, want %v", err, wantErr) + } + if _, err := os.Stat(output); !errors.Is(err, os.ErrNotExist) { + t.Fatalf("failed build supplied partial host bytes: %v", err) + } + } + if builds != 1 { + t.Fatalf("failed identical cache build retried %d times", builds) + } + }) + } +} + +func TestPipelineRecordHostCacheConcurrentRequests(t *testing.T) { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + var cache pipelineRecordHostCache + t.Cleanup(func() { + if err := cache.close(); err != nil { + t.Error(err) + } + }) + var builds atomic.Int32 + build := func(output string) error { + builds.Add(1) + return os.WriteFile(output, []byte("concurrent unit sentinel"), 0600) + } + var group sync.WaitGroup + errorsOut := make(chan error, 4) + for _, name := range []string{"one", "two", "three", "four"} { + group.Go(func() { + errorsOut <- cache.build(t.Context(), key, filepath.Join(root, name), build) + }) + } + group.Wait() + close(errorsOut) + for err := range errorsOut { + if err != nil { + t.Error(err) + } + } + if builds.Load() != 1 { + t.Fatalf("concurrent identical requests built %d times", builds.Load()) + } +} + +func TestPipelineRecordHostCacheCanceledRequestStaysLazy(t *testing.T) { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + ctx, cancel := context.WithCancel(t.Context()) + cancel() + var cache pipelineRecordHostCache + builds := 0 + err = cache.build(ctx, key, filepath.Join(root, "canceled"), func(string) error { + builds++ + return nil + }) + if !errors.Is(err, context.Canceled) || builds != 0 || cache.directory != "" { + t.Fatalf("canceled request initialized cache: error=%v, builds=%d, directory=%q", err, builds, cache.directory) + } +} + +func TestPipelineRecordHostCacheProcessCleanup(t *testing.T) { + if record := os.Getenv("WFCTL_RECORD_HOST_CACHE_CLEANUP_PROBE"); record != "" { + cmd, root := pipelineRecordHostCacheFixture(t) + key, err := pipelineRecordHostCacheKeyForCommand(cmd) + if err != nil { + t.Fatal(err) + } + if err := pipelineRecordHostSourceCache.build(t.Context(), key, filepath.Join(root, "copy"), func(output string) error { + return os.WriteFile(output, []byte("process cleanup helper sentinel"), 0600) + }); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(record, []byte(pipelineRecordHostSourceCache.directory), 0600); err != nil { + t.Fatal(err) + } + return + } + root := t.TempDir() + record := filepath.Join(root, "owned-directory") + self, err := os.Executable() + if err != nil { + t.Fatal(err) + } + ctx, cancel := context.WithTimeout(t.Context(), 10*time.Second) + defer cancel() + cmd := exec.CommandContext(ctx, self, "-test.run=^TestPipelineRecordHostCacheProcessCleanup$", "-test.count=1") + cmd.Env = append(os.Environ(), "WFCTL_RECORD_HOST_CACHE_CLEANUP_PROBE="+record) + if data, err := cmd.CombinedOutput(); err != nil { + t.Fatalf("cache cleanup subprocess failed: %v\n%s", err, data) + } + owned, err := os.ReadFile(record) + if err != nil || len(owned) == 0 { + t.Fatalf("cleanup subprocess did not identify owned cache: %v", err) + } + if _, err := os.Stat(string(owned)); !errors.Is(err, os.ErrNotExist) { + t.Fatalf("TestMain did not remove its process cache before exit: %v", err) + } +} diff --git a/cmd/wfctl/pipeline_record_host_test.go b/cmd/wfctl/pipeline_record_host_test.go index ade4b4b2..312f3b33 100644 --- a/cmd/wfctl/pipeline_record_host_test.go +++ b/cmd/wfctl/pipeline_record_host_test.go @@ -58,17 +58,139 @@ func buildPipelineRecordHostGo(t *testing.T, output, target string, race bool) { cmd.Env = append(os.Environ(), "GOWORK=off") var data []byte var err error - switch target { - case ".", "./testdata/pipeline-record/plugin", "./testdata/pipeline-record/docker": - data, err = buildFixtureArtifact(t, ctx, cmd, "../..", output) - default: - data, err = cmd.CombinedOutput() + if target == "." && race { + data, err = pipelineRecordHostSourceCache.buildCommand(ctx, cmd, "../..", output, (*exec.Cmd).CombinedOutput) + } else { + switch target { + case ".", "./testdata/pipeline-record/plugin", "./testdata/pipeline-record/docker": + data, err = buildFixtureArtifact(t, ctx, cmd, "../..", output) + default: + data, err = cmd.CombinedOutput() + } } if err != nil { t.Fatalf("build actual host/SDK fixture %s: %v\n%s", target, err, data) } } +// These sentinels exercise the actual source-cache dispatch and input guard; +// they do not replace real source-host/runtime acceptance. +func TestPipelineRecordHostCacheCommandInputGuard(t *testing.T) { + for _, change := range []string{"source", "effective-config"} { + t.Run(change, func(t *testing.T) { + var cache pipelineRecordHostCache + t.Cleanup(func() { _ = cache.close() }) + root := fixtureControlSource(t) + config := filepath.Join(t.TempDir(), "goenv") + fixtureControlWrite(t, config, "GOPRIVATE=original.control\n") + builds := 0 + request := func() { + t.Helper() + output := filepath.Join(t.TempDir(), "host") + cmd := fixtureControlCommand(t.Context(), root, output, "-race") + cmd.Env = append(cmd.Env, "GOENV="+config) + args, env := slices.Clone(cmd.Args), slices.Clone(cmd.Env) + data, err := cache.buildCommand(t.Context(), cmd, root, output, func(got *exec.Cmd) ([]byte, error) { + builds++ + return fixtureControlSentinel(got) + }) + if err != nil { + t.Fatalf("guarded source dispatch: %v\n%s", err, data) + } + if !slices.Equal(cmd.Args, args) || !slices.Equal(cmd.Env, env) { + t.Fatal("source dispatch changed caller arguments or environment") + } + if got, err := os.ReadFile(output); err != nil || string(got) != "unit-artifact-sentinel" { + t.Fatalf("private source output = %q, %v", got, err) + } + } + request() + request() + if builds != 1 || cache.key.fingerprint == "" { + t.Fatalf("identical closed source requests: builds=%d, fingerprint=%q", builds, cache.key.fingerprint) + } + path, original, changed := filepath.Join(root, "asset.txt"), "one", "two" + if change == "effective-config" { + path, original, changed = config, "GOPRIVATE=original.control\n", "GOPRIVATE=changed.control\n" + } + fixtureControlWrite(t, path, changed) + request() + request() + if builds != 3 { + t.Fatalf("changed %s reused source bytes or replaced baseline: builds=%d, want 3", change, builds) + } + fixtureControlWrite(t, path, original) + request() + if builds != 3 { + t.Fatalf("changed %s displaced cached baseline: builds=%d, want 3", change, builds) + } + }) + } +} + +func TestPipelineRecordHostCacheCommandUnclosedInputsBypass(t *testing.T) { + for _, variant := range []string{"native", "goenv-native", "goenv-overlay"} { + t.Run(variant, func(t *testing.T) { + var cache pipelineRecordHostCache + t.Cleanup(func() { _ = cache.close() }) + root := fixtureControlSource(t) + config := filepath.Join(t.TempDir(), "goenv") + builds := 0 + for range 2 { + output := filepath.Join(t.TempDir(), "host") + cmd := fixtureControlCommand(t.Context(), root, output, "-race") + if variant == "native" { + cmd.Env = append(cmd.Env, "CGO_CFLAGS=-DFIXTURE_EXTERNAL") + } else { + setting := "CGO_CFLAGS=-DFIXTURE_EXTERNAL\n" + if variant == "goenv-overlay" { + setting = "GOFLAGS=-overlay=" + filepath.Join(t.TempDir(), "external.json") + "\n" + } + fixtureControlWrite(t, config, setting) + cmd.Env = slices.DeleteFunc(cmd.Env, func(item string) bool { + return strings.HasPrefix(item, "GOFLAGS=") || strings.HasPrefix(item, "CGO_CFLAGS=") + }) + cmd.Env = append(cmd.Env, "GOENV="+config) + } + args, env := slices.Clone(cmd.Args), slices.Clone(cmd.Env) + data, err := cache.buildCommand(t.Context(), cmd, root, output, func(got *exec.Cmd) ([]byte, error) { + if got != cmd || !slices.Equal(got.Args, args) || !slices.Equal(got.Env, env) { + return nil, errors.New("source bypass rewrote the original command") + } + builds++ + return fixtureControlSentinel(got) + }) + if err != nil { + t.Fatalf("unclosed source bypass: %v\n%s", err, data) + } + } + if builds != 2 || cache.directory != "" || cache.load != nil { + t.Fatalf("unclosed %s entered source cache: builds=%d, directory=%q", variant, builds, cache.directory) + } + }) + } +} + +func TestPipelineRecordHostCacheCommandCancellation(t *testing.T) { + var cache pipelineRecordHostCache + ctx, cancel := context.WithCancel(t.Context()) + cancel() + root := fixtureControlSource(t) + output := filepath.Join(t.TempDir(), "host") + cmd := fixtureControlCommand(ctx, root, output, "-race") + builds := 0 + _, err := cache.buildCommand(ctx, cmd, root, output, func(got *exec.Cmd) ([]byte, error) { + builds++ + return fixtureControlSentinel(got) + }) + if !errors.Is(err, context.Canceled) || builds != 0 || cache.directory != "" { + t.Fatalf("canceled source dispatch: error=%v, builds=%d, directory=%q", err, builds, cache.directory) + } + if _, err := os.Stat(output); !errors.Is(err, os.ErrNotExist) { + t.Fatalf("canceled source dispatch supplied output: %v", err) + } +} + func TestPipelineRecordHostPrebuiltBinary(t *testing.T) { if output := os.Getenv("WFCTL_RECORD_HOST_COPY_PROBE_OUTPUT"); output != "" { buildPipelineRecordHostGo(t, output, ".", true) diff --git a/cmd/wfctl/templates/api-service/.github/workflows/ci.yml.tmpl b/cmd/wfctl/templates/api-service/.github/workflows/ci.yml.tmpl index e48deec2..a4bc62c4 100644 --- a/cmd/wfctl/templates/api-service/.github/workflows/ci.yml.tmpl +++ b/cmd/wfctl/templates/api-service/.github/workflows/ci.yml.tmpl @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - name: Install wfctl run: go install github.com/GoCodeAlone/workflow/cmd/wfctl@latest - name: Validate config diff --git a/cmd/wfctl/templates/api-service/Dockerfile.tmpl b/cmd/wfctl/templates/api-service/Dockerfile.tmpl index c997d4e7..2913e2b9 100644 --- a/cmd/wfctl/templates/api-service/Dockerfile.tmpl +++ b/cmd/wfctl/templates/api-service/Dockerfile.tmpl @@ -1,4 +1,4 @@ -FROM golang:1.26.5-alpine AS builder +FROM golang:1.27.2-alpine AS builder WORKDIR /app diff --git a/cmd/wfctl/templates/api-service/README.md.tmpl b/cmd/wfctl/templates/api-service/README.md.tmpl index d01675d4..4b1f118a 100644 --- a/cmd/wfctl/templates/api-service/README.md.tmpl +++ b/cmd/wfctl/templates/api-service/README.md.tmpl @@ -6,7 +6,7 @@ A workflow-based API service built with the [GoCodeAlone/workflow](https://githu ### Prerequisites -- Go 1.26.5+ +- Go 1.27.2+ ### Run @@ -32,6 +32,10 @@ The server starts on port 8080. Edit `workflow.yaml` to add modules, routes, and workflows. See the [workflow documentation](https://github.com/GoCodeAlone/workflow) for available module types. +The default configuration uses built-in modules. External telemetry and collector +modules require explicit installation and host loading of +[workflow-plugin-observability](https://github.com/GoCodeAlone/workflow-plugin-observability). + ### Build ```bash diff --git a/cmd/wfctl/templates/api-service/go.mod.tmpl b/cmd/wfctl/templates/api-service/go.mod.tmpl index 65226a4b..4c7e8dba 100644 --- a/cmd/wfctl/templates/api-service/go.mod.tmpl +++ b/cmd/wfctl/templates/api-service/go.mod.tmpl @@ -1,6 +1,6 @@ module github.com/{{.Author}}/{{.Name}} -go 1.26.5 +go 1.27.2 require ( github.com/CrisisTextLine/modular v1.11.11 diff --git a/cmd/wfctl/templates/api-service/main.go.tmpl b/cmd/wfctl/templates/api-service/main.go.tmpl index 2d02de37..7285eb5e 100644 --- a/cmd/wfctl/templates/api-service/main.go.tmpl +++ b/cmd/wfctl/templates/api-service/main.go.tmpl @@ -11,6 +11,7 @@ import ( "github.com/GoCodeAlone/workflow" "github.com/GoCodeAlone/workflow/config" + allplugins "github.com/GoCodeAlone/workflow/plugins/all" _ "github.com/GoCodeAlone/workflow/setup" ) @@ -42,6 +43,7 @@ func main() { engine, err := workflow.NewEngineBuilder(). WithLogger(logger). WithAllDefaults(). + WithPlugins(allplugins.DefaultPlugins()...). BuildFromConfig(cfg) if err != nil { fmt.Fprintf(os.Stderr, "failed to build workflow: %v\n", err) diff --git a/cmd/wfctl/templates/api-service/workflow.yaml.tmpl b/cmd/wfctl/templates/api-service/workflow.yaml.tmpl index bb82b87c..29b68208 100644 --- a/cmd/wfctl/templates/api-service/workflow.yaml.tmpl +++ b/cmd/wfctl/templates/api-service/workflow.yaml.tmpl @@ -19,29 +19,14 @@ modules: - name: {{.Name}}-health type: health.checker config: + healthPath: /health description: "Health check endpoint for {{.Name}}" - - name: {{.Name}}-telemetry - type: observability.telemetry - config: - serviceName: "{{.Name}}" - environment: "local" - - - name: {{.Name}}-collector - type: observability.collector - config: - distribution: external - topology: external - signals: [traces, metrics, logs] - workflows: http: router: {{.Name}}-router server: {{.Name}}-server routes: - - method: GET - path: /health - handler: {{.Name}}-health - method: GET path: /api/items handler: {{.Name}}-api @@ -57,9 +42,3 @@ workflows: - method: DELETE path: /api/items/{id} handler: {{.Name}}-api - -triggers: - http-trigger: - type: http - config: - server: {{.Name}}-server diff --git a/cmd/wfctl/templates/event-processor/.github/workflows/ci.yml.tmpl b/cmd/wfctl/templates/event-processor/.github/workflows/ci.yml.tmpl index e48deec2..a4bc62c4 100644 --- a/cmd/wfctl/templates/event-processor/.github/workflows/ci.yml.tmpl +++ b/cmd/wfctl/templates/event-processor/.github/workflows/ci.yml.tmpl @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - name: Install wfctl run: go install github.com/GoCodeAlone/workflow/cmd/wfctl@latest - name: Validate config diff --git a/cmd/wfctl/templates/event-processor/Dockerfile.tmpl b/cmd/wfctl/templates/event-processor/Dockerfile.tmpl index c997d4e7..2913e2b9 100644 --- a/cmd/wfctl/templates/event-processor/Dockerfile.tmpl +++ b/cmd/wfctl/templates/event-processor/Dockerfile.tmpl @@ -1,4 +1,4 @@ -FROM golang:1.26.5-alpine AS builder +FROM golang:1.27.2-alpine AS builder WORKDIR /app diff --git a/cmd/wfctl/templates/event-processor/README.md.tmpl b/cmd/wfctl/templates/event-processor/README.md.tmpl index 0d4cf2e0..4834fbf2 100644 --- a/cmd/wfctl/templates/event-processor/README.md.tmpl +++ b/cmd/wfctl/templates/event-processor/README.md.tmpl @@ -6,7 +6,7 @@ An event-driven workflow processor built with the [GoCodeAlone/workflow](https:/ ### Prerequisites -- Go 1.26.5+ +- Go 1.27.2+ ### Run diff --git a/cmd/wfctl/templates/event-processor/go.mod.tmpl b/cmd/wfctl/templates/event-processor/go.mod.tmpl index 65226a4b..4c7e8dba 100644 --- a/cmd/wfctl/templates/event-processor/go.mod.tmpl +++ b/cmd/wfctl/templates/event-processor/go.mod.tmpl @@ -1,6 +1,6 @@ module github.com/{{.Author}}/{{.Name}} -go 1.26.5 +go 1.27.2 require ( github.com/CrisisTextLine/modular v1.11.11 diff --git a/cmd/wfctl/templates/event-processor/main.go.tmpl b/cmd/wfctl/templates/event-processor/main.go.tmpl index 5eb5175b..75157c19 100644 --- a/cmd/wfctl/templates/event-processor/main.go.tmpl +++ b/cmd/wfctl/templates/event-processor/main.go.tmpl @@ -11,6 +11,7 @@ import ( "github.com/GoCodeAlone/workflow" "github.com/GoCodeAlone/workflow/config" + allplugins "github.com/GoCodeAlone/workflow/plugins/all" _ "github.com/GoCodeAlone/workflow/setup" ) @@ -42,6 +43,7 @@ func main() { engine, err := workflow.NewEngineBuilder(). WithLogger(logger). WithAllDefaults(). + WithPlugins(allplugins.DefaultPlugins()...). BuildFromConfig(cfg) if err != nil { fmt.Fprintf(os.Stderr, "failed to build workflow: %v\n", err) diff --git a/cmd/wfctl/templates/event-processor/workflow.yaml.tmpl b/cmd/wfctl/templates/event-processor/workflow.yaml.tmpl index d2c1abca..9184d72a 100644 --- a/cmd/wfctl/templates/event-processor/workflow.yaml.tmpl +++ b/cmd/wfctl/templates/event-processor/workflow.yaml.tmpl @@ -61,6 +61,7 @@ modules: - name: {{.Name}}-health type: health.checker config: + healthPath: /health description: "Health check endpoint" workflows: @@ -125,17 +126,3 @@ workflows: http: router: {{.Name}}-router server: {{.Name}}-server - routes: - - method: GET - path: /health - handler: {{.Name}}-health - -triggers: - event-trigger: - type: event - config: - topic: "{{.Name}}.incoming" - http-trigger: - type: http - config: - server: {{.Name}}-server diff --git a/cmd/wfctl/templates/full-stack/.github/workflows/ci.yml.tmpl b/cmd/wfctl/templates/full-stack/.github/workflows/ci.yml.tmpl index a5157162..192ee99a 100644 --- a/cmd/wfctl/templates/full-stack/.github/workflows/ci.yml.tmpl +++ b/cmd/wfctl/templates/full-stack/.github/workflows/ci.yml.tmpl @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24' diff --git a/cmd/wfctl/templates/full-stack/Dockerfile.tmpl b/cmd/wfctl/templates/full-stack/Dockerfile.tmpl index 5adea38b..5d550ca3 100644 --- a/cmd/wfctl/templates/full-stack/Dockerfile.tmpl +++ b/cmd/wfctl/templates/full-stack/Dockerfile.tmpl @@ -6,7 +6,7 @@ RUN npm ci COPY ui/ . RUN npm run build -FROM golang:1.26.5-alpine AS go-builder +FROM golang:1.27.2-alpine AS go-builder WORKDIR /app COPY go.mod ./ diff --git a/cmd/wfctl/templates/full-stack/README.md.tmpl b/cmd/wfctl/templates/full-stack/README.md.tmpl index 9cf2c782..4ce13852 100644 --- a/cmd/wfctl/templates/full-stack/README.md.tmpl +++ b/cmd/wfctl/templates/full-stack/README.md.tmpl @@ -6,7 +6,7 @@ A full-stack workflow application with React UI and Go backend, built with the [ ### Prerequisites -- Go 1.26.5+ +- Go 1.27.2+ - Node.js 24+ ### Development @@ -56,6 +56,10 @@ Visit http://localhost:8080. | PUT | /api/items/{id} | Update item | | DELETE | /api/items/{id} | Delete item | +The default configuration uses built-in modules. External telemetry and collector +modules require explicit installation and host loading of +[workflow-plugin-observability](https://github.com/GoCodeAlone/workflow-plugin-observability). + ## Project Structure ``` diff --git a/cmd/wfctl/templates/full-stack/go.mod.tmpl b/cmd/wfctl/templates/full-stack/go.mod.tmpl index 65226a4b..4c7e8dba 100644 --- a/cmd/wfctl/templates/full-stack/go.mod.tmpl +++ b/cmd/wfctl/templates/full-stack/go.mod.tmpl @@ -1,6 +1,6 @@ module github.com/{{.Author}}/{{.Name}} -go 1.26.5 +go 1.27.2 require ( github.com/CrisisTextLine/modular v1.11.11 diff --git a/cmd/wfctl/templates/full-stack/main.go.tmpl b/cmd/wfctl/templates/full-stack/main.go.tmpl index bea44a92..adff5943 100644 --- a/cmd/wfctl/templates/full-stack/main.go.tmpl +++ b/cmd/wfctl/templates/full-stack/main.go.tmpl @@ -11,6 +11,7 @@ import ( "github.com/GoCodeAlone/workflow" "github.com/GoCodeAlone/workflow/config" + allplugins "github.com/GoCodeAlone/workflow/plugins/all" _ "github.com/GoCodeAlone/workflow/setup" ) @@ -42,6 +43,7 @@ func main() { engine, err := workflow.NewEngineBuilder(). WithLogger(logger). WithAllDefaults(). + WithPlugins(allplugins.DefaultPlugins()...). BuildFromConfig(cfg) if err != nil { fmt.Fprintf(os.Stderr, "failed to build workflow: %v\n", err) diff --git a/cmd/wfctl/templates/full-stack/workflow.yaml.tmpl b/cmd/wfctl/templates/full-stack/workflow.yaml.tmpl index d0702358..19e3cb4f 100644 --- a/cmd/wfctl/templates/full-stack/workflow.yaml.tmpl +++ b/cmd/wfctl/templates/full-stack/workflow.yaml.tmpl @@ -28,29 +28,14 @@ modules: - name: {{.Name}}-health type: health.checker config: + healthPath: /health description: "Health check endpoint" - - name: {{.Name}}-telemetry - type: observability.telemetry - config: - serviceName: "{{.Name}}" - environment: "local" - - - name: {{.Name}}-collector - type: observability.collector - config: - distribution: external - topology: external - signals: [traces, metrics, logs] - workflows: http: router: {{.Name}}-router server: {{.Name}}-server routes: - - method: GET - path: /health - handler: {{.Name}}-health - method: GET path: /api/items handler: {{.Name}}-api @@ -72,9 +57,3 @@ workflows: - method: GET path: /assets/* handler: {{.Name}}-ui - -triggers: - http-trigger: - type: http - config: - server: {{.Name}}-server diff --git a/cmd/wfctl/templates/plugin/.github/workflows/release.yml.tmpl b/cmd/wfctl/templates/plugin/.github/workflows/release.yml.tmpl index d256c5ce..2a5e53e4 100644 --- a/cmd/wfctl/templates/plugin/.github/workflows/release.yml.tmpl +++ b/cmd/wfctl/templates/plugin/.github/workflows/release.yml.tmpl @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - name: Setup wfctl uses: GoCodeAlone/setup-wfctl@526e23ee7d3cae9ba8ba09d87090879e04c7aab2 # v1 - name: Validate release contract before packaging diff --git a/cmd/wfctl/templates/plugin/go.mod.tmpl b/cmd/wfctl/templates/plugin/go.mod.tmpl index c74e4dce..7685ccbf 100644 --- a/cmd/wfctl/templates/plugin/go.mod.tmpl +++ b/cmd/wfctl/templates/plugin/go.mod.tmpl @@ -1,6 +1,6 @@ module github.com/{{.Author}}/{{.Name}} -go 1.26.5 +go 1.27.2 require ( github.com/GoCodeAlone/workflow v0.1.0 diff --git a/cmd/wfctl/templates/ui-plugin/.github/workflows/release.yml.tmpl b/cmd/wfctl/templates/ui-plugin/.github/workflows/release.yml.tmpl index 03704cbb..b932c1a8 100644 --- a/cmd/wfctl/templates/ui-plugin/.github/workflows/release.yml.tmpl +++ b/cmd/wfctl/templates/ui-plugin/.github/workflows/release.yml.tmpl @@ -12,7 +12,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: '24' diff --git a/cmd/wfctl/templates/ui-plugin/go.mod.tmpl b/cmd/wfctl/templates/ui-plugin/go.mod.tmpl index c74e4dce..7685ccbf 100644 --- a/cmd/wfctl/templates/ui-plugin/go.mod.tmpl +++ b/cmd/wfctl/templates/ui-plugin/go.mod.tmpl @@ -1,6 +1,6 @@ module github.com/{{.Author}}/{{.Name}} -go 1.26.5 +go 1.27.2 require ( github.com/GoCodeAlone/workflow v0.1.0 diff --git a/cmd/wfctl/testdata/conformance/iac-hang/go.mod b/cmd/wfctl/testdata/conformance/iac-hang/go.mod index 9fabc04a..6e3d1395 100644 --- a/cmd/wfctl/testdata/conformance/iac-hang/go.mod +++ b/cmd/wfctl/testdata/conformance/iac-hang/go.mod @@ -1,3 +1,3 @@ module example.com/iac-hang -go 1.26.5 +go 1.27.2 diff --git a/cmd/wfctl/testdata/conformance/iac-pass/go.mod b/cmd/wfctl/testdata/conformance/iac-pass/go.mod index eb16b83b..57ea6939 100644 --- a/cmd/wfctl/testdata/conformance/iac-pass/go.mod +++ b/cmd/wfctl/testdata/conformance/iac-pass/go.mod @@ -1,13 +1,13 @@ module example.com/iac-pass -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.0.0 require ( github.com/BurntSushi/toml v1.6.0 // indirect github.com/GoCodeAlone/go-plugin v1.7.0 // indirect - github.com/GoCodeAlone/modular v1.13.5 // indirect + github.com/GoCodeAlone/modular v1.13.6 // indirect github.com/GoCodeAlone/yaegi v0.17.2 // indirect github.com/cloudevents/sdk-go/v2 v2.16.2 // indirect github.com/dustin/go-humanize v1.0.1 // indirect @@ -27,15 +27,14 @@ require ( github.com/oklog/run v1.2.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect - go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.56.0 // indirect - golang.org/x/sys v0.46.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect - google.golang.org/grpc v1.81.1 // indirect - google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect + google.golang.org/grpc v1.83.2 // indirect + google.golang.org/protobuf v1.36.12 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect modernc.org/libc v1.73.4 // indirect modernc.org/mathutil v1.7.1 // indirect diff --git a/cmd/wfctl/testdata/conformance/iac-pass/go.sum b/cmd/wfctl/testdata/conformance/iac-pass/go.sum index 648e856c..5f1b10de 100644 --- a/cmd/wfctl/testdata/conformance/iac-pass/go.sum +++ b/cmd/wfctl/testdata/conformance/iac-pass/go.sum @@ -4,12 +4,12 @@ github.com/DataDog/datadog-go/v5 v5.8.3 h1:s58CUJ9s8lezjhTNJO/SxkPBv2qZjS3ktpRSq github.com/DataDog/datadog-go/v5 v5.8.3/go.mod h1:K9kcYBlxkcPP8tvvjZZKs/m1edNAUFzBbdpTUKfCsuw= github.com/GoCodeAlone/go-plugin v1.7.0 h1:EwnhqPlXiNmp85S+MXnKKvm3YlfA6O4NzBb4+GSlEVY= github.com/GoCodeAlone/go-plugin v1.7.0/go.mod h1:HbGQRZUIa+jbDfjsaZIMJYvrz+LnxL0mJpggfynSTMk= -github.com/GoCodeAlone/modular v1.13.5 h1:Q+AR3MMAQJctvPJzlRSmTywArbrsXiMM3gzyJN8reBs= -github.com/GoCodeAlone/modular v1.13.5/go.mod h1:+JEPUYOxGaD332EMZ5PbJCz5rxwvFu4Tm6MrnZT0vxM= -github.com/GoCodeAlone/modular/modules/auth v1.17.0 h1:GbKG6s/2qe6N9YZ8vtvYsNon56MLWECncPxWvAsazSc= -github.com/GoCodeAlone/modular/modules/auth v1.17.0/go.mod h1:E9dDIxiAxIrXK8gn/rEhaqI5OYe6Aw/uGpRyI7iyxj8= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkqdh/7Q= +github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= +github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= +github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -171,8 +173,8 @@ github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+ github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8= github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU= github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ= +github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -237,6 +237,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -248,8 +250,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,41 +294,41 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk= -golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d h1:xr2lwHI91bn3UiXcnyzRMQjp2LRiM8wEHzwUaE0YhTs= -google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d/go.mod h1:O0ZOWSrfWfJ+Z5HbwZ+wNtHsg/vk1k2C/w67eww8PfQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d h1:mpAgMyM9vQHxycBlDq50y1VHpfSfVwzXvrQKtYbXuUY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= diff --git a/cmd/wfctl/testdata/conformance/no-iac/go.mod b/cmd/wfctl/testdata/conformance/no-iac/go.mod index f7f3538d..51f441af 100644 --- a/cmd/wfctl/testdata/conformance/no-iac/go.mod +++ b/cmd/wfctl/testdata/conformance/no-iac/go.mod @@ -1,13 +1,13 @@ module example.com/no-iac -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.0.0 require ( github.com/BurntSushi/toml v1.6.0 // indirect github.com/GoCodeAlone/go-plugin v1.7.0 // indirect - github.com/GoCodeAlone/modular v1.13.5 // indirect + github.com/GoCodeAlone/modular v1.13.6 // indirect github.com/GoCodeAlone/yaegi v0.17.2 // indirect github.com/cloudevents/sdk-go/v2 v2.16.2 // indirect github.com/dustin/go-humanize v1.0.1 // indirect @@ -27,15 +27,14 @@ require ( github.com/oklog/run v1.2.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect - go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.56.0 // indirect - golang.org/x/sys v0.46.0 // indirect + golang.org/x/net v0.60.0 // indirect + golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect - google.golang.org/grpc v1.81.1 // indirect - google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect + google.golang.org/grpc v1.83.2 // indirect + google.golang.org/protobuf v1.36.12 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect modernc.org/libc v1.73.4 // indirect modernc.org/mathutil v1.7.1 // indirect diff --git a/cmd/wfctl/testdata/conformance/no-iac/go.sum b/cmd/wfctl/testdata/conformance/no-iac/go.sum index 648e856c..5f1b10de 100644 --- a/cmd/wfctl/testdata/conformance/no-iac/go.sum +++ b/cmd/wfctl/testdata/conformance/no-iac/go.sum @@ -4,12 +4,12 @@ github.com/DataDog/datadog-go/v5 v5.8.3 h1:s58CUJ9s8lezjhTNJO/SxkPBv2qZjS3ktpRSq github.com/DataDog/datadog-go/v5 v5.8.3/go.mod h1:K9kcYBlxkcPP8tvvjZZKs/m1edNAUFzBbdpTUKfCsuw= github.com/GoCodeAlone/go-plugin v1.7.0 h1:EwnhqPlXiNmp85S+MXnKKvm3YlfA6O4NzBb4+GSlEVY= github.com/GoCodeAlone/go-plugin v1.7.0/go.mod h1:HbGQRZUIa+jbDfjsaZIMJYvrz+LnxL0mJpggfynSTMk= -github.com/GoCodeAlone/modular v1.13.5 h1:Q+AR3MMAQJctvPJzlRSmTywArbrsXiMM3gzyJN8reBs= -github.com/GoCodeAlone/modular v1.13.5/go.mod h1:+JEPUYOxGaD332EMZ5PbJCz5rxwvFu4Tm6MrnZT0vxM= -github.com/GoCodeAlone/modular/modules/auth v1.17.0 h1:GbKG6s/2qe6N9YZ8vtvYsNon56MLWECncPxWvAsazSc= -github.com/GoCodeAlone/modular/modules/auth v1.17.0/go.mod h1:E9dDIxiAxIrXK8gn/rEhaqI5OYe6Aw/uGpRyI7iyxj8= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkqdh/7Q= +github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= +github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= +github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -171,8 +173,8 @@ github.com/jhump/protoreflect v1.16.0 h1:54fZg+49widqXYQ0b+usAFHbMkBGR4PpXrsHc8+ github.com/jhump/protoreflect v1.16.0/go.mod h1:oYPd7nPvcBw/5wlDfm/AVmU9zH9BgqGCI469pGxfj/8= github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12 h1:9Nu54bhS/H/Kgo2/7xNSUuC5G28VR8ljfrLKU2G4IjU= github.com/json-iterator/go v1.1.13-0.20220915233716-71ac16282d12/go.mod h1:TBzl5BIHNXfS9+C35ZyJaklL7mLDbgUkcgXzSLa8Tk0= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ= +github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -237,6 +237,8 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -248,8 +250,8 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,41 +294,41 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= +golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk= -golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys= +golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= +golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d h1:xr2lwHI91bn3UiXcnyzRMQjp2LRiM8wEHzwUaE0YhTs= -google.golang.org/genproto/googleapis/api v0.0.0-20260622175928-b703f567277d/go.mod h1:O0ZOWSrfWfJ+Z5HbwZ+wNtHsg/vk1k2C/w67eww8PfQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d h1:mpAgMyM9vQHxycBlDq50y1VHpfSfVwzXvrQKtYbXuUY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= diff --git a/cmd/wfctl/testdata/pipeline-record/README.md b/cmd/wfctl/testdata/pipeline-record/README.md index 1f81cff4..0755812e 100644 --- a/cmd/wfctl/testdata/pipeline-record/README.md +++ b/cmd/wfctl/testdata/pipeline-record/README.md @@ -32,7 +32,7 @@ child isolation, real SDK RPC, framing, canonical encoding, and public CLI stdout are not substituted. These tests do not prove live Docker health or container execution. All temporary paths are canonicalized before journal use. -Run from the repository root with `GOWORK=off GOTOOLCHAIN=go1.26.5`: +Run from the repository root with `GOWORK=off GOTOOLCHAIN=go1.27.2`: ```sh go test ./cmd/wfctl -run '^TestPipelineRecordHost' -count=1 @@ -42,7 +42,7 @@ For Task 35 step 10, first verify the selected release archive/checksum and check out its exact source tag for the SDK fixture and tests. Then opt in: ```sh -GOWORK=off GOTOOLCHAIN=go1.26.5 \ +GOWORK=off GOTOOLCHAIN=go1.27.2 \ WFCTL_RECORD_HOST_BINARY=/absolute/path/to/verified/wfctl \ go test ./cmd/wfctl -run '^TestPipelineRecordHost' -count=1 ``` diff --git a/cmd/wfctl/testdata/registry-sync/README.md b/cmd/wfctl/testdata/registry-sync/README.md index 2f4d6473..fa19ec91 100644 --- a/cmd/wfctl/testdata/registry-sync/README.md +++ b/cmd/wfctl/testdata/registry-sync/README.md @@ -23,7 +23,7 @@ For Task 35 step 10, verify the downloaded release archive and checksum first, then check out that release's exact source tag for the tests. Run on Linux: ```sh -GOWORK=off GOTOOLCHAIN=go1.26.5 \ +GOWORK=off GOTOOLCHAIN=go1.27.2 \ WFCTL_REGISTRY_SYNC_HOST_BINARY=/absolute/path/to/verified/wfctl \ go test -p=2 ./cmd/wfctl \ -run '^TestPluginRegistrySync(Target_ActualCLI|HostNegatives)$' -count=1 -v @@ -54,12 +54,12 @@ overrides once per host-test group (not per negative case) and runs this same default-endpoint proxy path. Both host groups reuse the same transport fixture and credential-free environment. On Darwin the baseline still builds with the existing loopback API linker override. Requested -downloaded-binary proof on Darwin fails explicitly: Go 1.26.5 does not use +downloaded-binary proof on Darwin fails explicitly: Go does not use `SSL_CERT_FILE` there. Darwin's custom-client proxy tests prove only the dependency fixture, not downloaded-binary conformance: ```sh -GOWORK=off GOTOOLCHAIN=go1.26.5 \ +GOWORK=off GOTOOLCHAIN=go1.27.2 \ go test -p=2 ./cmd/wfctl \ -run '^TestPluginRegistrySync(HostBinary|ReleaseProxy)_' -count=1 -v ``` diff --git a/cmd/wfctl/testdata/verify_capabilities/good/go.mod b/cmd/wfctl/testdata/verify_capabilities/good/go.mod index 70507317..a7b0c1a5 100644 --- a/cmd/wfctl/testdata/verify_capabilities/good/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/good/go.mod @@ -1,6 +1,6 @@ module github.com/test/good -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.62.0 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/good/go.sum b/cmd/wfctl/testdata/verify_capabilities/good/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/good/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/good/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.mod b/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.mod index 14991363..7c2ea3ab 100644 --- a/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.mod @@ -1,6 +1,6 @@ module github.com/test/iac-extra-service -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.63.2 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.sum b/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/iac-extra-service/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/iac-good/go.mod b/cmd/wfctl/testdata/verify_capabilities/iac-good/go.mod index 4423f7d9..dc57b219 100644 --- a/cmd/wfctl/testdata/verify_capabilities/iac-good/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/iac-good/go.mod @@ -1,6 +1,6 @@ module github.com/test/iac-good -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.63.2 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/iac-good/go.sum b/cmd/wfctl/testdata/verify_capabilities/iac-good/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/iac-good/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/iac-good/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.mod b/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.mod index afba67b8..4581f4ec 100644 --- a/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.mod @@ -1,6 +1,6 @@ module github.com/test/iac-missing-service -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.63.2 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.sum b/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/iac-missing-service/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.mod b/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.mod index f16debc9..ba706abb 100644 --- a/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.mod @@ -1,6 +1,6 @@ module github.com/test/missing-ldflag -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.62.0 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.sum b/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/missing-ldflag/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/name-drift/go.mod b/cmd/wfctl/testdata/verify_capabilities/name-drift/go.mod index 7c87b897..c7d19911 100644 --- a/cmd/wfctl/testdata/verify_capabilities/name-drift/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/name-drift/go.mod @@ -1,6 +1,6 @@ module github.com/test/name-drift -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.62.0 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/name-drift/go.sum b/cmd/wfctl/testdata/verify_capabilities/name-drift/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/name-drift/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/name-drift/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/release-good/go.mod b/cmd/wfctl/testdata/verify_capabilities/release-good/go.mod index 10f0d698..b90c9644 100644 --- a/cmd/wfctl/testdata/verify_capabilities/release-good/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/release-good/go.mod @@ -1,6 +1,6 @@ module github.com/test/release-good -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.62.0 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/release-good/go.sum b/cmd/wfctl/testdata/verify_capabilities/release-good/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/release-good/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/release-good/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/cmd/wfctl/testdata/verify_capabilities/version-drift/go.mod b/cmd/wfctl/testdata/verify_capabilities/version-drift/go.mod index 49ec561d..b195adfd 100644 --- a/cmd/wfctl/testdata/verify_capabilities/version-drift/go.mod +++ b/cmd/wfctl/testdata/verify_capabilities/version-drift/go.mod @@ -1,6 +1,6 @@ module github.com/test/version-drift -go 1.26.5 +go 1.27.2 require github.com/GoCodeAlone/workflow v0.62.0 @@ -29,7 +29,7 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.28.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/sys v0.48.0 // indirect golang.org/x/text v0.42.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/cmd/wfctl/testdata/verify_capabilities/version-drift/go.sum b/cmd/wfctl/testdata/verify_capabilities/version-drift/go.sum index c69720c3..5f1b10de 100644 --- a/cmd/wfctl/testdata/verify_capabilities/version-drift/go.sum +++ b/cmd/wfctl/testdata/verify_capabilities/version-drift/go.sum @@ -8,8 +8,8 @@ github.com/GoCodeAlone/modular v1.13.6 h1:AIdfdR/KTPHX8T5KJBXUHMokliutUHjl6jRfkq github.com/GoCodeAlone/modular v1.13.6/go.mod h1:Vs92YltRNqA/v3peoHdqHTCjD10ww7rY3iURf1Ju450= github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5KzEpq9gIS/6jY4nkeGtA= github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/yaegi v0.17.2 h1:WK6Y6e0t1a6U7r+S2dN3CGWW1PizYD3zO0zneToZPxM= github.com/GoCodeAlone/yaegi v0.17.2/go.mod h1:z5Pr6Wse6QJcQvpgxTxzMAevFarH0N37TG88Y9dprx0= github.com/IBM/sarama v1.50.3 h1:zpY2iZYmt+z+0Bo3aYF+cD48OBt2hIgiDPZUuZKTXcc= @@ -88,10 +88,12 @@ github.com/fsnotify/fsnotify v1.10.1 h1:b0/UzAf9yR5rhf3RPm9gf3ehBPpf0oZKIjtpKrx5 github.com/fsnotify/fsnotify v1.10.1/go.mod h1:TLheqan6HD6GBK6PrDWyDPBaEV8LspOxvPSjC+bVfgo= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s= +github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y= github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA= @@ -109,8 +111,8 @@ github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17k github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ= @@ -180,10 +182,10 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4= github.com/mattn/go-colorable v0.1.15 h1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY= github.com/mattn/go-colorable v0.1.15/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -216,8 +218,6 @@ github.com/pierrec/lz4/v4 v4.1.27 h1:+PhzhWDrjRj89TH2sw43nE3+4+W8lSxIuQadEHZyjUk github.com/pierrec/lz4/v4 v4.1.27/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -232,11 +232,13 @@ github.com/redis/go-redis/v9 v9.21.0 h1:FPBE4hhbAke+TLmcY3WkpbDffJEomdqPn3HYiqAt github.com/redis/go-redis/v9 v9.21.0/go.mod h1:v/M13XI1PVCDcm01VtPFOADfZtHf8YW3baQf57KlIkA= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= +github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk= github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= @@ -244,12 +246,12 @@ github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSS github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo= github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw= github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= @@ -262,24 +264,26 @@ github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPc github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 h1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0/go.mod h1:z9+yiacE0IHRqM4qFfkbt/JYlmYXgss8GY/jXoNuPJI= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04= +go.opentelemetry.io/otel v1.47.0 h1:j7ALJ/zgkS7Z6aeJW09p8VC9804bC+PpeTfCD4XPnOM= +go.opentelemetry.io/otel v1.47.0/go.mod h1:8wS9O2qfXrYrzp6hIF/HOYJJf/wIhFPhR2xLuP+iXQU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 h1:julhjPeUH/q/7hinbSdDdqt5h7Zw9YWmRlWRhI0jd54= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0/go.mod h1:Ao2mz688LH/tFf0yMAenidq6k2YNSx6SIY2q6jDACck= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 h1:aXZXsZ012wOgVkqaiQv+Z/d8V0xKjmg70F6m4CE94lc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0/go.mod h1:ziu1gUIJhAaxM3EV1e3Ralk5AAyL1UOYz3lJJ4VSI38= +go.opentelemetry.io/otel/log v1.47.0 h1:cOTS1CcLbSQeZKanGJ+0JpF/+t4PELi3O3bbl2lqCcI= +go.opentelemetry.io/otel/log v1.47.0/go.mod h1:9byitSQ5pLC6PpqwGXjqdMKya6ZTswHRZh2vvXT33nw= +go.opentelemetry.io/otel/metric v1.47.0 h1:4PptaldXx3Eat1XjMZ68pPJEs5wrhlemctZE9a3UdWY= +go.opentelemetry.io/otel/metric v1.47.0/go.mod h1:ADGSXxRrXM6bjbvLo535EstVFlPpPYZm4LBKixjDHwU= +go.opentelemetry.io/otel/sdk v1.47.0 h1:zWXEr4j2lFefG87TU6Yg8a7ngfohIKFZHKp0Hf5hC6I= +go.opentelemetry.io/otel/sdk v1.47.0/go.mod h1:VUc24kiOeoGsxG8G9ULx3fWKvB7jMhnGE8Oi607lgR0= go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.opentelemetry.io/otel/trace v1.47.0 h1:JOjX/Oci8K94QHddo+bbfya/Ai/nf6/dt9ZfrFNWSrM= +go.opentelemetry.io/otel/trace v1.47.0/go.mod h1:jNaSLa2PZEYFG6fRjJABAu+bw4FS08uDmPg28lTghu0= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -290,16 +294,14 @@ go.uber.org/zap v1.28.0 h1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo= go.uber.org/zap v1.28.0/go.mod h1:rDLpOi171uODNm/mxFcuYWxDsqWSAVkFdX4XojSKg/Q= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= -golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= -golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= @@ -319,17 +321,13 @@ golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI= golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= -google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc h1:rZHRz0ogq4Pid1IKtA/ivHi8XONVF5tqUQXA2TtgpkE= +google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:K/n0XLazCJHjD73YuMyNJsN38BPPy1kfFnKxUXaThFU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc h1:4bNTbnb44EqGVy9HaQxSY2jnafSUdgV3qHtedvNpDKg= google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc/go.mod h1:OaIUM3+LpYcK2GXM4FTmhWoIq371Owdr+Cc7/BsYHHc= google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= -google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= diff --git a/decisions/0055-bound-release-security-maintenance.md b/decisions/0055-bound-release-security-maintenance.md new file mode 100644 index 00000000..dcebac98 --- /dev/null +++ b/decisions/0055-bound-release-security-maintenance.md @@ -0,0 +1,34 @@ +# 0055. Bound release security maintenance + +**Status:** Superseded by 0056; six-PR scanner schedule disproved before implementation +**Date:** 2026-10-03 +**Decision-makers:** Jon Langevin (standing autonomous follow-up approval) +**Related:** `docs/plans/2026-10-03-release-security-design.md`; `docs/public-workflow-policy.md` + +## Context + +Existing main contains fixable runtime/UI vulnerabilities and an OSV image +whose compiler cannot load current modules. Full CLI coverage/race runs can +exhaust 600s after repeatedly compiling the same host. Public workflow authority +requires staged transitions; Go environment overrides are categorically denied. + +## Decision + +Patch shipped/library dependencies within Go 1.26 and npm-compatible ranges. +Reuse only identical test-host builds, preserving all runtime proofs and limits. +Use supported, digest-pinned upstream OSV tooling with working native analysis; +retain both raw classification and SARIF. Stage/adopt/promote the scanner workflow +and mutation-harness authority, six PRs in an independent maintenance scope. + +Do not weaken environment policy, hide findings, change the policytool wrapper, +replace unrelated staged CI contexts, or undertake a fleet upgrade. Existing +drivers select the module's supported compiler floor; verify actual artifact +metadata. Policytool's old stdlib-floor finding needs exact-compiler no-call proof. + +## Consequences + +Publication waits for successful runtime and analysis gates, not unchanged +scanner counts. The existing Signal manifest is unchanged. Already-created +v0.86.1 remains immutable; a verified subsequent patch supplies patched consumers. +Any failure of the 600s or native-analysis assumptions requires a design backport, +not another blind retry or an unrecorded scope expansion. diff --git a/decisions/0056-isolate-source-security-remediation.md b/decisions/0056-isolate-source-security-remediation.md new file mode 100644 index 00000000..f7115278 --- /dev/null +++ b/decisions/0056-isolate-source-security-remediation.md @@ -0,0 +1,30 @@ +# 0056. Isolate source security remediation + +**Status:** Accepted +**Date:** 2026-10-03 +**Decision-makers:** Jon Langevin (standing autonomous follow-up approval) +**Related:** supersedes 0055; `docs/plans/2026-10-03-release-security-source-design.md` + +## Context + +The attempted six-PR scanner schedule missed independently pinned mutation +harness bytes in active and unadopted staged CI. Updating the authority bundle +does not replace those executable pins. Rewriting that staged context would +cross another rollout's ownership; operator reconciliation was requested. + +## Decision + +Proceed with independently executable Go/UI security and test-host build-reuse +changes in one reviewed source-only PR. Run actual host and supported upstream +analysis locally; preserve CI authority and disclose the existing scanner gap. +Do not claim scanner CI fixed or Signal/release scope complete. + +Retain the unfinished scanner design for owner reconciliation, not execution. +Rejected: holding production source fixes unnecessarily, weakening the policy, +fake old-image references, or silently expanding the approved Signal manifest. + +## Consequences + +This patch changes no CI permission, workflow or staged bytes and creates no +release tag. Runtime/analysis failures remain blocking gates. A later verified +release and scanner rollout are separate remaining work, not source-only proof. diff --git a/decisions/0057-upgrade-source-and-generated-go.md b/decisions/0057-upgrade-source-and-generated-go.md new file mode 100644 index 00000000..3738a82d --- /dev/null +++ b/decisions/0057-upgrade-source-and-generated-go.md @@ -0,0 +1,40 @@ +# 0057. Upgrade source and generated Go together + +**Status:** Superseded by 0063 (patch floor; generated/default scope retained) +**Date:** 2026-10-04 +**Decision-makers:** Jon Langevin +**Related:** ADR0056; source PR1022. + +## Context + +Operator: "Increase to latest go (1.27.1 I believe), update the ci process to +align, admin merge as necessary once all checks passing". Official stable +downloads confirm1.27.1. The source plan was Locked2026-10-03T18:25:28Z, +manifest SHA prefix90173f5ef1fc, three tasks/one PR. It excluded Go-minor, +Docker and generator defaults. Leaving those defaults old generates apps +that cannot build against the upgraded Workflow floor. + +## Decision + +Amend Task2 to upgrade source/example/eleven fixtures and maintained generated +module, CI, container and SDK/build defaults to1.27.1. Include admin/legacy +Docker builders and verified CircleCI cimg/go:1.27.1 output. Preserve explicit +user build-version overrides. Keep three tasks and existing sole PR1022, +cache/UI fixes and dependency versions. CI authority remains a separate +stage/adopt/promote rollout; no protected files enter this source PR. + +Retest native1.27.1 with compatible golangci-lint2.14.0, real generated output, +actual runtime and full cold Linux suite before source merge. Older compiler +auto-selection is a compatibility probe, not hosted local-toolchain readiness. +Use the approved ordinary-review admin exception only after independent agent +review and all actual checks pass. No failed-check/policy bypass or settings edit. + +## Alternatives And Consequences + +Root-only bump rejected: scaffold/SDK/deploy/build defaults would still drift. +Fleet migration rejected: the request is addressed in Workflow, not every repo. +A second source PR rejected: the existing open remediation owns the compiler +and receives fresh exact-head evidence. Source and generated defaults align; +isolated policytool keeps its language minimum outside this boundary. Rollback +restores known older limitations, so hold release rather than silently downgrade. +No tag, release, deployment, completed Signal or release-governance claim. diff --git a/decisions/0058-repair-generated-runtime-boundaries.md b/decisions/0058-repair-generated-runtime-boundaries.md new file mode 100644 index 00000000..8a91c4ae --- /dev/null +++ b/decisions/0058-repair-generated-runtime-boundaries.md @@ -0,0 +1,38 @@ +# 0058. Repair generated runtime boundaries + +**Status:** Accepted +**Date:** 2026-10-04 +**Decision-makers:** Jon Langevin +**Related:** ADR0057; source PR1022; source security design/plan. + +## Context + +Approved Go/defaults maintenance requires actual generated-app/plugin launch. +The source lock was 2026-10-04T04:47:52Z, SHA prefix cb44d785a8dd, three tasks +and one PR. Real emitted binary compilation succeeds but HTTP configuration +fails: WithAllDefaults supplies handlers/triggers, not module plugins. All +three application templates have the same bootstrap omission. Real SDK plugin +loading succeeds after correcting the probe's internal.Version ldflag, but +configuration fails: StringValue uses scalar protobuf JSON while the host +always marshals/unmarshals an object map. + +## Decision + +Under the standing explicit autonomous-change approval, extend Task2 owning +files to the three application main templates and external convert.go/tests. +Reuse plugins/all.DefaultPlugins in generated bootstraps. Preserve the SDK's +existing strict StringValue wire contract: adapt only its value map to/from +canonical scalar protobuf JSON, with empty-map defaults and strict rejection +of unknown fields/invalid types. Ordinary messages and legacy boundaries are +unchanged. Add RED/GREEN regressions and rerun both real generated boundaries. +Recheck alignment and restamp the same three-task/one-PR manifest before edits. + +## Alternatives And Consequences + +Accepting compilation as runtime proof is rejected. New bespoke module +registration and a replacement scaffold ABI are unnecessary; existing registry +and published wrapper schema suffice. Broad well-known-type conversion is out +of scope. Changes repair defects observed through required real boundaries, +not speculative features. Strict negatives, independent review, complete new +compiler verification and all actual checks remain mandatory. No protected CI +write, release, deployment, or Signal completion is authorized by this repair. diff --git a/decisions/0059-use-self-contained-app-scaffolds.md b/decisions/0059-use-self-contained-app-scaffolds.md new file mode 100644 index 00000000..0c3f4706 --- /dev/null +++ b/decisions/0059-use-self-contained-app-scaffolds.md @@ -0,0 +1,36 @@ +# 0059. Keep default application scaffolds self-contained + +**Status:** Accepted +**Date:** 2026-10-04 +**Decision-makers:** Jon Langevin +**Related:** ADR0057/0058; source Task2C; PR1022. + +## Context + +Actual Go1.27.1 wfctl-generated API application compiles with the disclosed +local source replacement, then exits1: unknown observability.telemetry and +observability.collector module types. Both belong to the external observability +plugin, not plugins/all. API/full-stack default YAML includes them without +plugin installation/discovery; event-processor does not. The source lock is +2026-10-04T05:30:50Z, SHA prefix cf1acc282b28, three tasks/one PR. + +## Decision + +Under standing explicit autonomous-change approval, Task2 additionally owns +API/full-stack workflow.yaml templates. Remove only their optional external +observability modules from default YAML; retain HTTP/UI/health/application +behavior. State the opt-in external-plugin boundary in existing template +READMEs. Add a real generated-config assertion that every default application +module is provided by the same existing default-plugin registry used in main. +Keep three tasks/one PR; recheck alignment/relock before edits and rerun the +actual generated API config without removing modules only in the proof. + +## Alternatives And Consequences + +Installing a plugin only in the test would hide a broken default app. Embedding +a new external-plugin installation/loading system in Go maintenance is broader +than this repair. Substituting different telemetry types would change semantics. +Core scaffolds start without an undocumented plugin prerequisite; advanced +telemetry remains available through its owning plugin and explicit application +composition. No observability-plugin feature change, protected CI write, +production deployment, or broader scaffold dependency modernization. diff --git a/decisions/0060-use-existing-scaffold-health-wiring.md b/decisions/0060-use-existing-scaffold-health-wiring.md new file mode 100644 index 00000000..10012086 --- /dev/null +++ b/decisions/0060-use-existing-scaffold-health-wiring.md @@ -0,0 +1,32 @@ +# 0060. Use existing health wiring in app defaults + +**Status:** Accepted +**Date:** 2026-10-04 +**Decision-makers:** Jon Langevin +**Related:** ADR0058/0059; source Task2C; PR1022. + +## Context + +Fresh real API startup now passes module initialization but rejects the default +GET /health route: health.checker registers a health service, not an HTTP +handler under the module name. All three application templates use that invalid +route. The existing observability hook already mounts health/readiness/liveness +handlers from HealthChecker paths. Current source lock is +2026-10-04T05:51:09Z, SHA prefix698e28dd8c0e, three tasks/one PR. + +## Decision + +Preserve the intended /health endpoint by configuring healthPath: /health on +the existing health.checker and removing only its invalid manual route. Use the +already loaded observability wiring, not a fake generic handler or new core API. +Under standing autonomous-change approval, add the event-processor YAML owner +to Task2 alongside its two existing YAML owners. Assert all generated health +paths/routes first, then rerun actual API/health/shutdown. Three tasks/one PR and +protected exclusions remain; no application feature is removed. + +## Consequences + +Generated defaults use the same real health behavior as the existing plugin; +their documented endpoint remains /health. Test-only route deletion is rejected. +No new health framework, direct module service alias, external-plugin loader, +or native Windows graceful-lifecycle claim is introduced. diff --git a/decisions/0061-align-remaining-go-defaults.md b/decisions/0061-align-remaining-go-defaults.md new file mode 100644 index 00000000..03ce1dfd --- /dev/null +++ b/decisions/0061-align-remaining-go-defaults.md @@ -0,0 +1,32 @@ +# 0061. Align remaining maintained Go defaults + +**Status:** Accepted +**Date:** 2026-10-04 +**Decision-makers:** Jon Langevin +**Related:** ADR0057; source Task2/S6, PR1022. + +## Context + +The frozen-source audit found old Go drivers in the MCP legacy CD/release +emitters and the maintained e-commerce Docker builder, plus five active +default/prerequisite claims. The existing source lock is2026-10-04T06:00:42Z, +SHA prefixe037b6274335, three tasks/one PR. The operator's approved Go/default +upgrade covers these boundaries, but their owning files were omitted. + +## Decision + +Add mcp/wfctl_tools.go and its existing test, the e-commerce Dockerfile, +DOCUMENTATION.md and CONTRIBUTING.md to Task2 ownership. Keep existing +README/build/deploy guide owners. Assert parsed emitted MCP Go versions before +changing the two literals, including the real handler's returned CD YAML. +Verify the DHI builder tag/actual compiler rather than guessing a replacement +or silently changing vendors. Only owning version claims change; preserve +historical receipts, explicit overrides and all protected CI exclusions. + +## Consequences + +Root-only/CLI-only defaults remain rejected. No new MCP API, plugin detection, +Docker runtime hardening change, authority bypass or fleet migration. Three +tasks/one existing PR remain; rerun the affected tests and final frozen-source +gates. The running33b4 cold check remains a prior checkpoint, not acceptance +of these later changes. diff --git a/decisions/0062-align-scaffold-and-version-test-boundaries.md b/decisions/0062-align-scaffold-and-version-test-boundaries.md new file mode 100644 index 00000000..1f69d807 --- /dev/null +++ b/decisions/0062-align-scaffold-and-version-test-boundaries.md @@ -0,0 +1,32 @@ +# 0062. Align scaffold and version test boundaries + +**Status:** Accepted +**Date:** 2026-10-04 +**Decision-makers:** Jon Langevin +**Related:** ADR0059; source Tasks1/2/S4/S6, PR1022. + +## Context + +The Go1.27.1 cold Linux run rejected old init assertions that still require +optional observability plugins. Its linked-version test also combined a +dependency's stderr compatibility warning with the correct final version line. +The focused channel probe confirms the existing CLI handler sends both to +stderr, not stdout. +Neither failure justifies changing the approved self-contained defaults or +suppressing diagnostics. The source manifest remains three tasks/one PR. + +## Decision + +Name cmd/wfctl/init_test.go as a Task2 owner. Check that default generated +configs omit optional external module types; retain file/module/UI assertions. +In the already-owned main_test.go, assert the exact final linked-version line +on its existing stderr writer and empty stdout, retaining earlier stderr in +failure diagnostics and successful test logs. Reproduce +both failures before correction. No CLI output or dependency change. + +## Consequences + +Tests follow the actual product boundaries instead of conflating an optional +plugin with bootstrap support or diagnostics with the final version line. Keep the warning +visible. Rerun focused and final cold gates; the failed cold checkpoint is not +acceptance. No task, PR, timeout, protected-file or production behavior change. diff --git a/decisions/0063-source-go1272-http2-security.md b/decisions/0063-source-go1272-http2-security.md new file mode 100644 index 00000000..442e5d50 --- /dev/null +++ b/decisions/0063-source-go1272-http2-security.md @@ -0,0 +1,56 @@ +# 0063. Patch source and generated HTTP/2 toolchains + +**Status:** Accepted +**Date:** 2026-10-10 +**Decision-makers:** Jon Langevin; coordinating parent assigns Compute +**Related:** ADR0056-0062; source PR1022; separate Workflow CI rollout. + +## Context + +The parent verified that the managed Signal successor is paused and explicitly +assigned this source security repair to Compute: Go1.27.2/x/net0.60, retaining +OTel1.45, independent review, exact-head tests and normal merge/release gates. +This does not resume Signal features or transfer Signal acceptance. + +Source PR1022 at3e62f5fa has Go1.27.1/x/net0.58.0/OTel1.45.0. The consumed +wfctl0.86.1 binary has Go1.26.5/x/net0.58.0. GO-2026-6611 fixes the HTTP/2 +SETTINGS CPU issue in Go1.27.2 and x/net0.60.0. Official Go downloads confirm +stable1.27.2; the Go proxy/checksum database confirms x/net0.60.0 and unchanged +required companion versions. The original source manifest was +Locked2026-10-04T06:44:30Z, SHA256 +`a77fbe3cc3696c048e0b4ff53aa6840c0b484d04e4bc6ce0318dce6738b2dab0`. + +## Decision + +Amend existing Task2, keeping three tasks/one existing PR1022: source/example/ +eleven fixture Go floors, existing generated/default/compiler-host pins and +literal version tests move1.27.1→1.27.2; owning x/net requirements move0.58→0.60. +Retain OTel1.45 and explicit user version overrides. Authenticate sums and run +native targeted tidy; no unrelated module refresh or checksum text replacement. +Official Docker, CircleCI and DHI catalogs define the corresponding builder +tags; catalog existence is not actual image/compiler/runtime acceptance. +Integrate accepted main without a force-push; preserve its source-map-js1.2.2 +fix. Source-only protected-byte comparison uses the recorded integration base; +historical49e18034 proof is retained rather than misapplied to newer main. +Retain Task1's source race-host cache and all cases, composing its actual +requests with accepted main's effective compiler/config/source fingerprint +and context-aware exclusive copy. Unclosed inputs bypass directly to the +unchanged command. Accepted SDK/Docker cache callers are inherited baseline, +not new source-PR reuse. Preserve both process-cache cleanups and the relocated +linked-version regression; no nested cache or weakened deadline. + +Protected CI/scripts/policytool remain outside this source PR. Their separate +governed rollout must supply compatible accepted CI/release wiring. Existing +source/runtime/SDK/UI/scanner gates remain mandatory on the new exact head. +Normal merge/release authorization does not permit failed checks, new settings +exceptions, unchecked tags or a clean-all-dependencies claim. + +## Consequences + +Root-only patch rejected: generated consumers and real fixture hosts would +retain an older compiler than the source floor. Blanket upgrades rejected: +x/net0.60 uses the already selected companions. A second source PR rejected: +the existing open source3/1 lane owns this bounded repair. Source-only review +does not close Compute staging identities, Signal, Docker or release gates. +Rollback uses a reviewed revert/rebuild and reinstates the security release +hold; older vulnerable binaries cannot become an accepted fallback. diff --git a/docs/APPLICATION_UI_CONTRACT.md b/docs/APPLICATION_UI_CONTRACT.md index 18bbf48a..64f09ad3 100644 --- a/docs/APPLICATION_UI_CONTRACT.md +++ b/docs/APPLICATION_UI_CONTRACT.md @@ -227,7 +227,7 @@ COPY ui/ ./ RUN npm run build # Stage 2: Build Go binary -FROM golang:1.26.5-alpine AS go-builder +FROM golang:1.27.2-alpine AS go-builder WORKDIR /app COPY --from=ui-builder /app/ui/dist ./module/ui_dist COPY . . diff --git a/docs/BUILDING_APPS_GUIDE.md b/docs/BUILDING_APPS_GUIDE.md index 9bc6e60b..fe12e2ec 100644 --- a/docs/BUILDING_APPS_GUIDE.md +++ b/docs/BUILDING_APPS_GUIDE.md @@ -136,7 +136,7 @@ event-broker --> notification-handler ### Prerequisites -- **Go 1.25+** installed +- **Go 1.27.2+** installed - The workflow repository cloned and built: ```bash @@ -1210,7 +1210,7 @@ export JWT_SECRET="dev-secret-change-in-production" Create a `Dockerfile` in your project: ```dockerfile -FROM golang:1.26-alpine AS builder +FROM golang:1.27.2-alpine AS builder WORKDIR /build COPY go.mod go.sum ./ RUN go mod download diff --git a/docs/DEPLOYMENT_GUIDE.md b/docs/DEPLOYMENT_GUIDE.md index 7f3dc5d7..3da836a3 100644 --- a/docs/DEPLOYMENT_GUIDE.md +++ b/docs/DEPLOYMENT_GUIDE.md @@ -30,7 +30,7 @@ The workflow engine is a Go binary with an embedded React UI. Building requires | Tool | Version | Purpose | |------|---------|---------| -| Go | 1.25+ | Server binary | +| Go | 1.27.2+ | Server binary | | Node.js | 18+ | UI build | | Docker | 24+ | Container builds (optional) | | golangci-lint | latest | Go linting (development) | @@ -70,7 +70,7 @@ docker build -t workflow . The three stages are: 1. **node:22-alpine** -- `npm ci` and `npx vite build` for the UI -2. **golang:1.26-alpine** -- `go mod download`, copy UI assets, `go build` +2. **golang:1.27.2-alpine** -- `go mod download`, copy UI assets, `go build` 3. **alpine:3.21** -- copies only the binary, adds CA certs and tzdata, runs as non-root (UID 65532) Final image size is approximately 30MB. diff --git a/docs/plans/2026-10-03-release-security-design.md b/docs/plans/2026-10-03-release-security-design.md new file mode 100644 index 00000000..afc5c8f3 --- /dev/null +++ b/docs/plans/2026-10-03-release-security-design.md @@ -0,0 +1,173 @@ +# Workflow Release Security Maintenance + +**Status:** Unfinished; scanner rollout blocked by D6. Source-only slice has its own design/lock; no six-PR execution is authorized by this draft. +**Baseline:** main `49e1803424f303f6f98cef51cc9ea2dee96c7d38`. +**Boundary:** independent Workflow maintenance, not a Signal feature or fleet migration. + +## Goal + +Remediate fixable shipped/library and npm findings and restore trustworthy verification +before publishing the next stable Workflow patch. Keep the current Go minor, +existing runtime/API contracts, scanner fail-on-vulnerability behavior, and +credential-free public CI. + +## Evidence + +- PR #1020 passed all 25 checks; merged source `6d3cf77` adds no dependency or + CI changes. Main OSV run `37138999915` and previous-main `37101607116` have + byte-equal normalized advisory/package/version/source rows: 159 findings, + 157 fixable. Unchanged findings are not a security exception. +- Every Go analysis attempt in run `37138999915` failed: the digest-pinned + scanner's Go 1.26.2 and `GOTOOLCHAIN=local` cannot load Go 1.26.5 modules. +- Main CI `37138999955` timed out at the default 10m package ceiling near the + end of wfctl; runtime matrices passed. One identical-source rerun is in + progress at design drafting; it subsequently reproduced the timeout at a + later capability fixture. Newer main `49e18034` passed on its second attempt. + Repeated real-host compilation consumes aggregate budget, not a stuck case. +- [Official Go downloads](https://go.dev/dl/?mode=json) lists supported stable + Go 1.26.8 and 1.27.1. Stay on 1.26.8; a 1.27/fleet migration is unrelated. +- [OSV Go analysis](https://github.com/google/osv-scanner/blob/main/docs/scan-source.md) + uses govulncheck and requires a working compiler. Restore analysis rather + than adding vulnerability ignores. `GO-2026-5932` is OpenPGP-only and has no + fixed version; prove package absence and native analysis classification. + +## Approach + +| Option | Trade-off | Decision | +|---|---|---| +| Publish unchanged baseline | Fast; knowingly retains fixable runtime/UI findings and incomplete analysis | Reject | +| Workflow-only supported patch maintenance | Targeted pins/locks, real runtime proof, independent review | Choose | +| Workspace-wide Go 1.27 migration | Much larger consumer/runner blast radius | Defer | + +Requirements: +- R1: Raise root, example, and plugin-fixture Go floors to 1.26.8; update + active source-fixture compiler overrides and runnable documentation. Existing + CI setup-go drivers remain unchanged: Go's authenticated default toolchain + selection must choose 1.26.8 for these modules, verified in CI and actual + artifact build metadata. Explicit workflow driver/fleet migration is deferred. + Do not change the independently hash-bound policytool module/wrapper in this + boundary. Its old stdlib-floor findings require an exact Go 1.26.5 + govulncheck/package-import proof of no affected calls, not an ignore. + Update affected OpenTelemetry packages to at least + fixed 1.45.0; repair vulnerable gRPC/x-text fixture pins using the already + established root versions. Preserve module boundaries and negative fixtures. +- R2: Refresh only affected npm dependency resolutions, preserving compatible + declared ranges where possible. Cover UI runtime `js-yaml` and affected + development packages. No blanket `npm update`, major migration, or new app. +- R3: Use official OSV action v2.6.0, index digest + `sha256:71ad04ab2f8798be47870f9b18817ad317c2f8f2f97aa6726ba10d5578bc174a` + (Linux/amd64 `sha256:13cef841c7b8de79248e572de0c278d64eaf0a4006e2973fa690b777be30eee4`). + Its verified config supplies Go 1.27.1 with `GOTOOLCHAIN=local`, sufficient + to load the 1.26.8 modules. This is scanner tooling, not a runtime/fleet minor + migration. Keep reporter and fail-on-vulnerability behavior; verify real analysis + succeeds, retains raw package findings, classifies uncalled packages, and + still rejects called vulnerabilities. No ignore/config suppression or + `--fail-on-vuln` relaxation. Retain analyzed JSON as well as SARIF. +- R4: Reuse only one immutable source-built record host (`target=".", race=true`) + per test process, lazily, with exact compiler/build-environment and cwd + matching; changed inputs use the uncached builder. Explicit prebuilt + selection/denial happens first. Copy to distinct mode-0700 test paths and + clean the process-owned build directory before exit. Keep SDK/fake-Docker/ + registry/mutant/capability builds independent. Preserve every case, race + check, build/child/fault deadline, GORACE option, and the existing default + package ceiling. Prove the whole cold race/coverage suite completes within + 600s; otherwise stop and backport that failed assumption before changing scope. +- R6: Follow `docs/public-workflow-policy.md`: source-only remediation PR, + OSV context staging PR, policy authority staging PR for the mutation harness + hash only, combined already-authorized adoption PR, OSV promotion PR, and + authority promotion PR. Six independent PRs; no same-PR trust/adoption, + wrapper/module change, old staged-CI replacement, runner or token change. +- R5: Source and CI checks, real Workflow HTTP/YAML startup, SDK plugin record + matrices, live strict sandbox, registry CLI fixtures, UI tests/build, nested + module tidy checks, and local/CI scanner proof must pass before merge. + This boundary does not create a stable release tag; the existing release + task subsequently verifies downloaded artifacts at fetched green main. + Concurrent v0.86.1 at `49e18034` is not retagged; maintenance completion does + not claim it is patched. A later verified patch supersedes it for promotion. + +## Global Design Guidance + +Use repository `AGENTS.md`, `CLAUDE.md`, `docs/AGENT_GUIDE.md`, +`docs/REPO_LAYOUT.md`; existing dependency-update automation and public workflow +policy in `docs/public-workflow-policy.md` remain authoritative. Reuse OSV/govulncheck, module parsers, npm's lock +resolver, and policytool. No new plugin, CLI, provider, or scenario capability. + +## Security Review + +- Fix upstream vulnerabilities, including development/build dependencies; + do not dismiss a finding solely because it is marked dev. +- OpenPGP is not Signal encryption. Do not remove all `x/crypto`, blanket-ignore + the advisory, or call an unsuccessful reachability scan clean. +- Runtime compiler selection uses Go's authenticated module-floor mechanism + with the unchanged older CI driver; exact build metadata must show 1.26.8. + Scanner/compiler assets remain digest/authentication bound; no unverified + executable or host trust modification. No new GOTOOLCHAIN policy exception. +- Existing automatic repository token only; no cloud mutation, new secret, + broader permission, self-hosted runner, or public/private boundary change. + +## Infrastructure Impact + +Public GitHub-hosted Linux runners unchanged. Compiler/dependency analysis can +increase duration; test jobs remain bounded. No deploy, external service API, +database migration, runtime infrastructure, or production resource mutation. + +## Multi-Component Validation + +| Integration | Class | Proof | +|---|---|---| +| Go compiler/runtime + server | runtime-integrated | built server starts real YAML HTTP app; representative request returns expected JSON | +| wfctl + SDK/native plugin + Docker | runtime-integrated | existing real-host record/composite/custody matrices and live strict sandbox | +| wfctl + registry + Git | runtime-integrated | real CLI forward/no-op/rollback and negative snapshot matrix | +| UI + YAML parser | runtime-integrated | UI suite/build; real parser rejects hostile merge input with fixed release | +| OSV + Go package loader + reporter | runtime-integrated | native analysis succeeds; clean graph accepted and intentionally called vulnerable fixture rejected | +| policy allowlists + workflows | config-only | trusted-base stage/adopt/promote validation and existing mutation suite; wrapper bytes unchanged | +| fleet/toolchain minor migration, Signal releases | deferred | existing owners/plans; not this PR | + +## Assumptions + +| ID | Claim | Failure handling | +|---|---|---| +| A1 | Supported Go patch preserves plugin/API behavior | Real host matrix; hold release on regression | +| A2 | Updated pinned analyzer can load the declared module floor | Execute actual container analysis; no success claim on error | +| A3 | Affected npm fixes fit current major ranges | Inspect resolver diff; isolate required range changes and explain | +| A4 | OpenPGP absent from shipped imports | Check Linux/Darwin amd64/arm64 and Windows amd64 release package graphs/tags; native OSV classification separately scoped | +| A5 | Removing four duplicate host builds leaves cold suite below 600s | Retain case deadlines and complete full race/coverage suite; otherwise hold, not silently extend timeout | +| A6 | Policytool's affected stdlib calls are absent | Run govulncheck with its exact 1.26.5 compiler and verify imports; any called finding blocks publication | + +## Self-Challenge + +- A passing differential scan does not prove a clean baseline: require full scan. +- Native analysis may silently fail: require successful analysis evidence plus + a called-vulnerability positive control, not only reporter exit zero. +- Reusing a host can hide changed build inputs: require exact environment/cwd + matching, independent mutant builds, no prebuilt fallback, and real matrices. +- Vulnerable control fixtures must be materialized outside the recursively + scanned checkout and cleaned afterward, with no scanner exclusions/ignores. + +## Rollback + +Revert source dependency changes through reviewed commits and hold promotion; +scanner/workflow authority rollback uses the same stage/adopt/promote lifecycle, +never a direct hash rewrite. Rerun source, policy, UI, scanner, and runtime checks. +No tag moves, registry rollback, deployment, or data migration is involved. + +## Review Backport 2026-10-03 + +D1-D3 (Minor): enumerate release platforms; retain analyzed JSON; keep vulnerable +positive controls outside the scan root. Implemented in R3/A4/self-challenge. + +D4-D5 (Important, discovered after the first pass): the initial one-PR hash +refresh violates existing staged authority; explicit GOTOOLCHAIN is categorically +forbidden. Use six already-authorized transitions and a current upstream image, +without changing the policy implementation or wrapper. The policytool module is +not silently patched because that would change executable pins in unrelated +current/staged CI contexts. All Signal manifest/task boundaries remain unchanged. + +D6 (Important, unresolved): the mutation harness itself is executable-pinned by +active and staged CI. Its digest constant cannot change through authority-bundle +adoption alone. Existing active CI `532f...` and unadopted staged CI `37b...` +must be reconciled by the owner before a replacement context can authorize new +harness bytes. No hash rewrite, fake old-image comment, harness skip, or trust +exception is permissible. Operator clarification requested; do not execute the +six-PR schedule above. Independently executable source remediation is designed +in `2026-10-03-release-security-source-design.md`. diff --git a/docs/plans/2026-10-03-release-security-source-amendment-review.md b/docs/plans/2026-10-03-release-security-source-amendment-review.md new file mode 100644 index 00000000..162dae58 --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source-amendment-review.md @@ -0,0 +1,58 @@ +# Source Go Amendment Review + +**Phase:** plan amendment +**Status:** PASS after bounded concrete P1/P2 corrections +**Reviewer:** independent Bohr, read-only; lead authored amendment. +**Authority:** ADR0057, same three tasks/one existing PR1022. + +## Findings And Resolutions + +- P1 Important: record-fixture does not prove generated plugin output. Task2C + now runs actual built-wfctl generation, normalizes local Workflow replacement + with structured go mod edit, native builds generated binary, places both + generated sidecars in valid loader layout and asserts typed uppercase host + call/discovery/lifecycle. Reviewer confirmed loader/name; final requested + relative-to-absolute integration-only normalization applied literally. +- P2 Important: existing build-binary compile test accepts failure. Task2C now + exercises actual default factory/Execute emitted output, independently checks + module1.27.1, resolves unreleased source explicitly, builds/runs HTTP identity + and shutdown. Reviewer PASS; no published v0.0.0 resolution claim. +- P3 Minor: historical1.26.8 commands retained. Explicit amendment states new + A-E supersede final commands; old evidence remains historical, not Go27 proof. + +## Scan Transcript + +| Required class | Result / inspected boundary | +|---|---| +| Project guidance | Clean: existing tooling/ownership | +| Assumptions | P1/P2 resolved: generated consumers not adjacent tests | +| Repo precedent | Clean: generator owner/separate CI | +| Artifact class | Clean: external temporary output/package-local tests | +| YAGNI | Clean: no new API/fleet migration | +| Failure modes | P2 resolved: no accepted build-error proof | +| Security/privacy | Clean: protected bytes/no policy bypass | +| Infrastructure | Clean: local resources, no deploy | +| Multi-component | P1/P2 resolved: real generated consumer gates | +| Declared integration | P1/P2 resolved: generated runtime proof | +| UI contribution | Clean: none new | +| Rollback | Clean: reviewed revert/rebuild/release hold | +| Simpler alternative | Clean: root-only rejected | +| User intent | Clean: latestGo/default alignment | +| Existence/runtime | P1/P2 resolved: actual commands/runtime layout | +| Decomposition | Clean: three tasks/one PR | +| Verification class | P1/P2 resolved | +| Auth chain | Clean: admin ordinary review only, all checks first | +| Serial dependencies | Clean: stabilize then frozen-head proof | +| Rollback wiring | Clean: Task2E | +| Integration proof/matrix | P1/P2 resolved, Task2C/D and existing matrix | +| UI route proof | Clean: no new route | +| Infrastructure verification | Clean: maintained-image build/launch | +| Plugin loader | P1 resolved: matching runtime name/layout/sidecars | +| Config schema | Clean: existing API modules/routes/trigger | +| Identifiers | Clean: registered commands/override keys | +| Embedded code compile | Clean: no new compiled snippets | + +Alignment: S1/S6→Task2; S2→Task3; S3→Task1; S4→all three; S5→Task2/3. +Reverse: Task1 S3/S4, Task2 S1/S4/S5/S6, Task3 S2/S4/S5. All task IDs occur +once in sole existing PR row. Programmatic strict manifest check PASS before +restamp. No source code/test success or CI completion claimed by this report. diff --git a/docs/plans/2026-10-03-release-security-source-code-review.md b/docs/plans/2026-10-03-release-security-source-code-review.md new file mode 100644 index 00000000..06799af0 --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source-code-review.md @@ -0,0 +1,71 @@ +# Source Security Code Review + +## Go27 Delta Review 2026-10-04 + +Independent Ramanujan reviewed33b4 Go27/source-generated repairs, then only +the new ADR0061/0062 MCP/default-doc/DHI/test delta at bca10b34 plus owned +working changes: SHIP-IT, no Important/Critical findings. Parsed actual MCP +CD output and config-only release helper require literal1.27.1; default init +checks preserve existing coverage; version test retains real stderr/final-line +behavior and diagnostics. DHI builder changes only the official declared +tag/builder Alpine minor, not vendor/dev/CGO0/nonroot runtime hardening. + +A new native-cold failure warranted one separate root-test-only review: +6000RPM refills during real50ms HTTP burst, so200 was legitimate. Corrected +60RPM/derived1100ms wait and25ms client pause retain all three stages and +exact denial/recovery/JSON/configured-handler assertions. Review SHIP-IT, +no Important/Critical findings; no production limiter/clock/deadline change. +Old-rate control fails the429 assertion; corrected focused race/lint/vet pass. +Scheduling stalls >=1s remain visible failures, not skipped or retried. + +CI B2/bootstrap and DHI401 publication/compiler/build are still HOLD; +final corrected frozen whole-cold/runtime gates are lead verification, not +cleared by this review. Subsequent452cff8f cold whole exit0/wfctl428.833s and +actual runtime/UI/scanner/harness receipts are in the verification checkpoint; +they do not clear actual PR checks or DHI. Three tasks/one source PR and +protected bytes retained. No further broad review cycle is warranted. + +2026-10-03; independent bounded review of550c0f7a against49e18034. +Tasks1/2 independent spec/quality PASS retained; final reviewer did not author +Task3. Read-only review inspected code, lock graph and retained real evidence; +lead reran UI verification after the only finding's resolution. + +## Scope And Finding + +| Check | Result | +|---|---| +| 73 protected paths/direct UI manifest | Byte-identical to base | +| Go code/modules vs cold40d5d6e6 | Unchanged | +| Ten targets/editor consumer | Patched duplicates; real RED/reversal RED/released0.2.1 GREEN | +| Critical/Important defects | None | +| Minor M1 unnecessary chai/tinyrainbow refresh | Restored6.2.2/3.1.0 through isolated npm resolver; only two package entries differ from reviewed head | +| M1 validation | Clean npmci0; full141 tests; tsc/Vite0; focused lint0; ten-family installed audit0; manifest/root-lock unchanged | + +Disposition: SHIP-IT for source review, not release authorization. Final +cf28e5a4 artifacts/native production scan subsequently pass; exact-head +PR checks/merge remain mandatory. +No new design or broad review cycle warranted for M1. + +## Bug Classes + +| Class | Evidence/result | +|---|---| +| Symmetry | Both real parser paths receive same valid/syntax/budget cases | +| Error swallowing | Build/copy errors propagate; independent fallback retained | +| Comment/code drift | M1 closure description corrected | +| Test-name/body mismatch | Actual syntax and budget paths exercised | +| Missing edges | Exact budget/+1, malformed syntax, two resource/participant pairs | +| Concurrency | Mutex covers initialization/copy/cleanup; concurrent coverage | +| Silent coercion | Complete parsed structure asserted | +| Dead code | Initialization/reuse/fallback/cancellation/close exercised | +| Scope drift | M1 fixed; protected bytes/direct manifest preserved | +| Band-aid | Real RED/GREEN; no weakened assertion/deadline | +| One-sided wiring | Actual public editor export/SDK/Docker/registry consumers | +| Unconsumed integration | Runtime evidence retained; OSV pending separately | +| Hermeticity | Local bounded inputs; process-owned temporary custody | +| Portability | Portable cache; Windows compile evidence | +| Vacuity | Old-dependency reversal reproduces rejection failure | + +Runtime evidence inspected: cold152 packages, wfctl519.387s under600s; live +strict Docker36.661s; Linux registry control and30 denials30.169s; UI141 +tests/build. Unfinished scanner/CI gates are not counted as fulfilled. diff --git a/docs/plans/2026-10-03-release-security-source-design-review.md b/docs/plans/2026-10-03-release-security-source-design-review.md new file mode 100644 index 00000000..3ec67dcc --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source-design-review.md @@ -0,0 +1,30 @@ +### Adversarial Review Report + +**Phase:** design +**Artifact:** `docs/plans/2026-10-03-release-security-source-design.md` +**Status:** PASS + +Independent bounded review; no Critical or Important findings. + +- `D1` Minor, evidence identity: bind native OSV proof to verified image digest and retain tool identity. Resolution: incorporated in S5. +- `D2` Minor, consumer proof: test actual editor `parseYaml` alongside direct js-yaml. Resolution: incorporated in S2. + +| Bug Class | Result | Note | +|---|---|---| +| Project guidance | Clean | Repo layout, credential-free policy and unchanged Signal scope retained | +| Assumptions | Clean | Cache margin, compiler selection and reachability have blocking evidence gates | +| Repo precedent | Clean | Existing owning resolvers and runtime fixtures reused | +| Artifact class | Clean | Adjacent test helper/UI regression; no substitute scenario | +| YAGNI | Clean | No new framework, scanner or plugin | +| Failure modes | Clean | Build errors/changed inputs uncached; promotion held on failed gates | +| Security/privacy | Clean | No token/trust exception, suppression or production state | +| Infrastructure | Clean | Temporary local test resources only | +| Multi-component validation | D2 | Actual parser consumer added | +| Declared integration | D1/D2 | Explicit matrix strengthened with identity/consumer evidence | +| Contributed UI rendering | Clean | No new UI contribution or route | +| Rollback | Clean | Source revert/rebuild and vulnerability hold | +| Simpler alternative | Clean | Source-only boundary avoids blocked governance coupling | +| User-intent drift | Clean | Material security follow-up; Signal work not rescoped | +| Existence/runtime validity | Clean | Owning modules and existing runtime contracts inspected | + +Verdict: PASS with two incorporated Minor proof refinements. CI reconciliation is separately approved, not a reason to rerun settled source architecture. diff --git a/docs/plans/2026-10-03-release-security-source-design.md b/docs/plans/2026-10-03-release-security-source-design.md new file mode 100644 index 00000000..e726672a --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source-design.md @@ -0,0 +1,487 @@ +# Workflow Source Security Remediation + +**Status:** Approved; design review PASS with two proof refinements incorporated. +**Baseline:** main `49e1803424f303f6f98cef51cc9ea2dee96c7d38`. +**Authority:** independent source-only maintenance. Existing Signal scope unchanged. +**Decision:** `decisions/0056-isolate-source-security-remediation.md`. + +### Backport 2026-10-04: Existing Test Boundary Corrections + +Evidence: cold Linux checkpoint33b4 failed the two init default-module +expectations and linked-version combined-output assertion. Defaults correctly +omit optional external observability plugins per ADR0059; the final version +line is v9.9.9 and stderr also includes a dependency compatibility warning. +The focused channel probe disproves a stdout assumption: the existing handler +uses stderr for version output, with empty stdout. +See decisions/0062-align-scaffold-and-version-test-boundaries.md. + +Correction: Task2 additionally names init_test.go; assert absent optional +types without dropping existing file/module/UI checks. Already-owned +main_test.go checks empty stdout and the exact final stderr version line, +retaining preceding stderr diagnostics/logs. +No warning suppression, dependency change or production-version change. +The existing default-registry/health/runtime tests cover the product invariant; +this is a stale expectation/channel correction, not a new product feature. +Manifest scope stays three tasks/one existing PR, protected exclusions intact. + +## Goal And Requirements + +Ship reviewed, patched Workflow source and reliable real-host tests without +modifying protected CI authority, unrelated staged work, or release tags. + +### Backport 2026-10-04: Native Linux Proof Custody And DHI Builder + +Cold33b4 used an unregistered UID501 and host VirtioFS source/temp/cache paths. +The resulting home-resolution, inode, lock, permission and LRU failures are +environmental: unchanged33b4 with registered UID1000, container-native source/ +temp/cache and Docker --init passes every matched case (wfctl173s, LRU2s), with +unchanged tracked source. Final cold proof uses that corrected custody; retain +the exact CI test command/default600s limit and move coverage output outside +source before clean-status readback. No filesystem/test-runtime product changes. + +The immutable official DHI catalog615555cd declares Go1.27.1 dev only on +Alpine3.23, not3.22. Use exact dhi.io/golang:1.27.1-alpine3.23-dev while retaining +DHI/dev/musl, CGO_ENABLED=0 and the existing nonroot static3.22 runtime. This is +a builder-OS-minor change, not a vendor/runtime/hardening change. Official +metadata declares amd64/arm64 and compiler1.27.1; both old/new registry probes +return401, so published digests/native compiler/image build remain unverified +until host authentication. No guessed3.22 tag or substitute image proof. +Both corrections stay Task2/S4/S6; three tasks/one PR and CI exclusions unchanged. + +### Backport 2026-10-04: Rate-Recovery Fixture Scheduling + +Corrected native cold ee6eb078 exits1 solely on root rate-recovery test: the +6000RPM fixture refills a token every10ms, but its two HTTP burst requests take +50ms; the subsequent200 is valid refill, not a middleware/compiler defect. +wfctl passes460.576s under unchanged600s; native filesystem/home failures do not +recur. The isolated fast-host probe passes, confirming a scheduling assumption. + +Task2/S4 additionally names e2e_middleware_negative_test.go. First demonstrate +the invalid10ms assumption with a25ms client pause through the actual engine/ +HTTP test. Then use60RPM and derive a one-token refill wait plus100ms from that +configuration, matching the existing module-test precedent. Preserve all three +subtests, exact success/429/handler-body assertions, HTTP5s/default-package +deadlines and production middleware bytes. No clock mock, skip or timeout +increase; the changed wait represents the configured rate. Rerun focused +RED/GREEN/reversal and the whole cold command on frozen corrected source. +This test-only proof backport adds no product invariant/feature; manifest +three tasks/one existing PR and protected exclusions remain unchanged. + +The approved2026-10-04 backport below supersedes earlier1.26.8/generator/Docker +exclusions; earlier evidence remains historical, not finalGo1.27.1 proof. + +- S1: Root, example, and external-plugin fixture Go floors become 1.26.8; + affected OTel modules become 1.45.0; vulnerable gRPC/x-text fixture pins use + established root 1.83.2/0.42.0. Tidy each owning module. Source fixture + compiler overrides and runnable minimum-version docs match 1.26.8. +- S2: Patch the ten affected npm package families within existing compatible + ranges, preserving unrelated lock resolutions and direct dependencies. + Add a real js-yaml merge-budget regression and exercise the actual imported + `@gocodealone/workflow-editor/utils` `parseYaml`; run the UI suite/build. +- S3: Lazily reuse only the immutable source-built record host (`.`, race), + matching cwd, compiler and complete build environment. Changed inputs use + the original uncached path. Explicit downloaded-binary selection/denial runs + first. Copy to distinct mode-0700 paths; remove the owned cache before exit. + SDK, Docker, registry, mutant, and capability builders remain independent. + Preserve GORACE, all deadlines/cases and the default 600s package limit. +- S4: Prove original-source failures, new cache semantics, full cold + race/coverage completion, Go package/build metadata, actual Workflow HTTP + startup, SDK/composite/custody matrices, strict Docker and registry matrices, + UI build/test and version-skew audit. New source must be lint-clean. +- S5: Preserve CI/workflow/policytool bytes and staged contexts. Exact Go + 1.26.5 policytool reachability proof is required. Independently run supported + OSV v2.6.0 against source plus an isolated called-vulnerability control, + using verified image index digest + `sha256:71ad04ab2f8798be47870f9b18817ad317c2f8f2f97aa6726ba10d5578bc174a`; + retain tool identity and analyzed JSON. No scan suppression, ignores or clean-CI claim for the + old pinned main scanner. Source PR merge needs all required PR checks green. + +## Alternatives + +| Option | Decision | +|---|---| +| Hold all source fixes until unrelated trust rollout settles | Reject: independent production remediation can proceed | +| Source-only patch with real runtime/native analysis proof | Choose | +| Rewrite staged CI/harness authority or weaken environment policy | Reject: owner reconciliation required | + +## Global Design Guidance + +Repository `AGENTS.md`, `CLAUDE.md`, `docs/AGENT_GUIDE.md`, `docs/REPO_LAYOUT.md` +and `docs/public-workflow-policy.md` apply. Reuse Go/npm resolvers, existing +runtime fixtures and upstream scanner. No new plugin, CLI, app, framework, +scenario, provider, Go minor migration or CI-policy exception. + +## Security Review + +- Main/base full scans have identical 159 findings, 157 fixable. Code-based + triage found plausible shipped TLS/relative-URL DoS and UI YAML CPU DoS; + unchanged baseline is not risk acceptance. Patch owning dependencies. +- Go drivers in existing CI stay pinned 1.26.5; their authenticated default + selection must compile the new module floor with 1.26.8. Check actual binary + build metadata, not the job label. No production tag is created here. +- Policytool Go 1.26.5 and scanner CI rollout stay outside this source boundary; + prove no affected policytool calls using that exact compiler. Called findings + or analysis errors block progress. Old main OSV remains a disclosed issue. +- Source cache contains only a test executable in an owned private directory; + no credentials/input/result data, persistent custody store, or runtime cache. + +## Infrastructure Impact + +No workflow, runner, IAM/token, deployment, resource or data change. Temporary +local compiler/scanner containers and test services only. Preserve automatic +repository-token policy and concurrent v0.86.1 tag/run. + +## Multi-Component Validation + +| Integration | Class | Proof | +|---|---|---| +| compiler + Workflow server | runtime-integrated | actual built server/YAML/HTTP request plus compiler metadata | +| wfctl + real SDK/plugin/Docker | runtime-integrated | complete existing host, late-output, composite and crash matrices; live strict sandbox | +| wfctl + registry + Git | runtime-integrated | default-API Linux CLI accepted/rejected snapshot matrix | +| UI + js-yaml | runtime-integrated | actual installed parser regression, UI tests/build | +| upstream OSV + Go loader + reporter | runtime-integrated | successful native analysis, preserved classification, outside-tree called-vulnerability control rejected | +| existing CI policy | config-only | no byte changes; existing positive/mutation suite | +| scanner CI rollout/fleet upgrade/Signal promotion | separate | user approved CI reconciliation; this source-only PR does not perform it; existing Signal tasks remain open | + +## Assumptions And Self-Challenge + +| ID | Claim | Verification/Failure | +|---|---|---| +| A1 | Four avoided duplicate host builds provide sufficient margin | Whole cold Linux race/coverage suite must finish under 600s; otherwise backport, do not silently extend limits | +| A2 | Cache cannot hide a compiler/environment override | Changed-input and error regressions; explicit prebuilt selection still first | +| A3 | Dependency patches preserve typed SDK/runtime contracts | Real host/HTTP/registry/Docker matrices and all required CI | +| A4 | Module floor drives actual compiler 1.26.8 | Older-driver probe and `go version -m` on built artifacts | +| A5 | Remaining module-only findings are uncalled | Successful analyzed JSON, per-release-platform OpenPGP absence, exact policytool compiler proof; no suppression | + +## Rollback + +Reviewed revert of the single source-remediation PR, rerun build/runtime tests, +and hold promotion because known vulnerabilities return. No workflow trust, +tag, registry, deployment or data rollback occurs. + +### Backport 2026-10-04: Approved Go And Generated Toolchains + +Authority: explicit operator Go1.27.1/CI/admin instruction; ADR0057 records +original locked timestamp/hash and owning-file expansion. S1 now targets +Go1.27.1 in root/example/eleven fixtures and source-host expectations. S6 adds +existing wfctl app/plugin scaffold modules, workflow/release/Docker templates, +legacy generate-CI emitters, deploy Docker generator, SDK minimum/default Go +constants, binary-build default (explicit overrides preserved), maintained +admin/legacy Docker builders, and cigen CircleCI cimg/go:1.27.1. Official +CircleCI sources/registry confirm Linuxamd64/arm64 image availability. + +S4 requires literal independent version regressions (RED/GREEN), actual built +wfctl-generated app/plugin output and build/launch, exact-head four-command +metadata/server smoke, new nativeGo1.27.1 host/SDK/registry/Docker/coldLinux +proof, and compatible golangci-lint2.14.0. Existing dependency/UI fixes remain. +Generated instructions and active prerequisites align; historical evidence +and deliberate explicit test overrides are not mechanically rewritten. + +S5 still excludes all protected CI/scripts/policy/trust writes. Its policytool +minimum remains1.26.5; Go1.27.1 execution/CI drivers are separately governed. +Native prior1.26.5 reachability evidence remains disclosed; new source must +pass all actual hosted checks after the CI rollover. Approved admin exception +affects ordinary review only; no settings, failed-check or policy bypass. +Manifest amendment: unchanged three tasks/one PR; Task2 gains S6/Go-minor and +maintained generator/Docker ownership. No fleet, release or Signal completion. + +### Backport 2026-10-04: Real Generated Engine Startup + +Actual default BuildBinaryStep factory/Execute emitted three files withGo1.27.1; +native generated-project compilation succeeded after disclosed local resolver +replacement, but the real binary exited1 with unknown http.server module. +Cause: emitted NewStdEngine constructs an empty factory registry, unlike the +existing app scaffold's NewEngineBuilder.WithAllDefaults/setup registration. +The first correction still failed real HTTP startup: WithAllDefaults omits +module plugins. Reuse plugins/all.DefaultPlugins in the existing builder and +all three application main templates. Correct the owning bootstrap and add a +regression; rerun actual emitted binary HTTP/lifecycle proof. No mock/fake app, +accepted compilation error or empty config proves this boundary. Task2 already +owns generated-runtime proof; ADR0058 explicitly adds the three main templates +to owning files, preserving three tasks/one PR and protected-file exclusions. + +### Backport 2026-10-04: Strict Generated StringValue Runtime + +Actual generated plugin compiles, starts, loads through the real host, then +fails configuration. Initial wrong main.Version probe flag was corrected to +the generated internal.Version before causal analysis; it is not a product bug. +Host mapToTypedAny sends object JSON to scalar StringValue, and typedAnyToMap +would decode scalar JSON into an object. Keep the generated strict wire schema; +adapt only StringValue's value field with canonical protojson validation, +empty-map default and strict unknown-field rejection. No legacy fallback or +other well-known type changes. ADR0058 adds external convert.go/tests to Task2; +native RED/GREEN, strict negative cases and real uppercase pipeline execution +must verify both directions. Three tasks/one PR and CI exclusions unchanged. + +Independent code review S1: Go Windows Process.Signal rejects SIGTERM. Retain +both generated native compilation modes on Windows, then explicitly skip only +the POSIX lifecycle portion before process launch. Darwin/Linux continue to +prove real HTTP and graceful SIGTERM; forced kill is never graceful evidence. +Windows cross-compilation is compile-only, not a native lifecycle receipt. + +### Backport 2026-10-04: Default App Config Has External Modules + +Actual wfctl init API output, compiled withGo1.27.1 and its corrected default +plugin bootstrap, exits1 because observability.telemetry/collector are external +plugin types, not built-ins. API/full-stack templates omit their installation +and discovery. Per ADR0059, remove only those optional external modules from +default configurations and disclose explicit opt-in composition in existing +READMEs. Assert every generated app module against the actual default registry; +rerun the real API config, changing only loopback address/response identity in +the proof. No alternate-type substitution or proof-only config deletion. +Task2 adds the two YAML templates; three tasks/one PR and CI exclusions remain. + +### Backport 2026-10-04: Default Health Route Is Not A Handler + +Fresh generated API now initializes all modules, then rejects its manual GET +/health route because the named health.checker service is not an HTTP handler. +All three app configs share that invalid route. Per ADR0060, set healthPath to +/health and let the existing observability hook mount its real health handler; +remove only the invalid manual route. Test generated paths/routes RED/GREEN +and rerun real API/health/shutdown. Task2 adds event-processor YAML alongside +the existing two YAML owners; no new core API or endpoint/feature removal. + +### Backport 2026-10-04: Remove Redundant Invalid Trigger Blocks + +The real API now reaches trigger configuration, then exits1 because the emitted +http-trigger key is not a registered trigger type. All three templates use this +obsolete named/type/config shape; event-processor also has event-trigger. Actual +HTTP/event trigger configuration expects type-keyed routes/subscriptions, not +the nested server/topic blocks. Existing workflows.http already configures the +real API routes; workflows.messaging already configures the event subscriptions +and producers. Remove only these redundant invalid top-level trigger blocks, +retaining those real workflow sections unchanged. Add actual default trigger +registry assertions RED/GREEN and regenerate/launch the API app again. This is +Task2C in its existing three YAML owners: no manifest, task/PR count, engine API, +or application-route/subscription removal. Do not repair only the proof config. + +### Backport 2026-10-04: Complete The Maintained-Default Inventory + +The structured33b4 version audit proves thirteen source module floors and five +scaffold workflow pins match1.27.1, but finds two old MCP legacy driver literals, +an old maintained e-commerce DHI builder, and five active prerequisite/default +claims. Per ADR0061, extend Task2's owning files for those defaults only; parsed +MCP emitter/actual CD handler regression RED/GREEN, verified DHI tag/compiler, +and updated source audit/frozen gates are required. Do not implement new MCP +plugin detection or count the legacy release helper as a proved host feature; +its existing HasPlugin condition is unchanged. Historical receipts and explicit +test overrides remain. Three tasks/one PR, no protected CI or runtime-image +hardening change. The current33b4 cold check predates this owning-file repair. + +### Backport 2026-10-03: Bootstrap Pins And Actual Toolchains + +Cause: full skew audit found existing Go 1.26.5 scaffold/generator, Docker +bootstrap and deployment-documentation pins, not just protected CI/policytool. +Changing those product defaults is the separately deferred fleet/generator +boundary; the source-only patch does not silently perform it. + +Evidence: root/example/eleven owning fixture floors and relevant fixture +overrides are 1.26.8; old `go1.26.5+auto` driver builds patched source with +actual 1.26.8 metadata. Exact policytool 1.26.5 analysis has eight module-only +stdlib rows and zero called findings; its wrapper passes unchanged. Forcing +`GOTOOLCHAIN=go1.26.5` across the root mutation harness prevents root-level +helper compilation. CI-equivalent authenticated auto selection runs all +mutation assertions, but concurrent worker edits invalidate its production +immutability snapshot; repeat once in a frozen, noncompeting plain checkout. + +Correction: audit classifies every residual pin as protected driver, standalone +legacy scaffold/bootstrap, historical example or pending fleet follow-up. +Never call this a completed fleet upgrade. Nested Git worktree artifact VCS +metadata reports the outer checkout: frozen plain-checkout verification is +required for exact-head evidence. Local path/actual CLI and compiler checks +establish source behavior, not a release. Scope: no manifest/task/PR change. + +### Backport 2026-10-03: Bundled Editor Parser Prerequisite + +Cause: installed editor 0.2.0 embeds its own js-yaml implementation. Updating +Workflow's external lock cannot patch it. Real consumer regression remains +RED (140 tests PASS, one editor hostile-merge test FAIL); direct updated +js-yaml tests and UI build pass. + +Correction: independently design/review/patch/release compatible editor 0.2.x, +then resolve it through existing Workflow `^0.2.0` range. Preserve current +Workflow manifest/PR grouping; no parser mock, UI shim, externalization shortcut +or weakened assertion. The adjacent owning-library fix has its own design and +PR, not an unrecorded edit in this source-only manifest. + +### Backport 2026-10-03: Match CI Filesystem Privilege + +Cause: the first local container used a read-only checkout/tmpfs and was not a +valid CI environment. Its writable replacement ran as root: wfctl finished in +542.027s, but root bypassed the intentional read-only lockfile denial and could +create `/nonexistent/path`, contaminating three subsequent missing-path tests. +Neither run is full-suite GREEN or a reason to modify tests or their deadlines. + +Correction: cold-cache proof uses a fresh complete plain checkout, writable +owned source copy and a non-root CI user, with disk-backed compiler cache. +Verify exact HEAD/clean tracked bytes before execution. Preserve the unchanged +`go test -v -race -coverprofile=coverage.out ./...` command and 600s package +timeout. Classify environmental failures separately from code regressions; no +retry without a falsifiable corrected cause. Scope: no manifest/task/PR change. + +### Backport 2026-10-03: Reproduce CI Init/Reaping + +Cause: non-root `runuser` as container PID 1 does not reap adopted helper +orphans; inherited-FD/cleanup tests saw surviving PID identities with no active +group. Matched control reproduces FAIL in 4.318s and observes PID-1-owned +zombies. A shell PID 1 can itself reap, so a superficially similar container +is not the negative control. No production defect was inferred from either. + +Correction/proof: same source/user/control with Docker `--init` passes the +inherited-FD and seven-case crash matrix (83.503s). Fresh disk compiler cache, +non-root user, normal init and clean plain source `40d5d6e6` pass the exact +full CI command: 152 packages, wfctl 519.387s below the unchanged 600s limit, +run 19:46:25-19:59:01 UTC. Go 1.26.8 real strict live Docker tests also pass +(36.661s), with journal/container cleanup. Explicitly source evidence, not +downloaded-release proof. Scope: no manifest/task/PR or protected-file change. + +### Backport 2026-10-03: Native Scanner Memory Custody + +Cause: digest-pinned OSV2.6 unchanged entrypoint discovered all14 Go modules, +then Docker killed the scanner after63.224s: exit137/OOMKilled=true, 7GiB +container cap, no results JSON and no reporter execution. Discovery alone is +not successful native analysis. Docker Desktop has8GiB total; another owner's +container must remain untouched. No production-code defect or clean scan is +inferred from this failed local verification environment. + +Hypothesis: a container-local `GOMEMLIMIT=4GiB` soft GC budget can reduce the +scanner's peak memory without changing analyses. This is ordinary runtime +resource tuning, not a Go/compiler/authentication or advisory exception. It +does not authorize CI adoption: the protected policytool's GO* env restriction +remains unchanged. Official [runtime docs](https://pkg.go.dev/runtime#hdr-Environment_Variables) +define a soft Go-managed-memory bound, not a hard shared container bound. + +Correction: one paired resource trial on the same frozen550c0f7a source/image, +platform, entrypoint, recursive command, container limits and analysis defaults; +only GOMEMLIMIT changes. Fresh outside-source evidence, exact OOM receipt and +raw logs retained. If it completes, verify final preserved-resolution source +separately under the corrected environment. Require all14 module discovery and +native-analysis coverage, current valid JSON, no loading/analysis/OOM/timeout +errors, raw classification and unchanged reporter acceptance. Missing analysis +stays unknown. Preserve the genuine called-control reporter rejection. Another +incomplete trial remains blocking; no automatic retry loop, ignores, disabled +analysis or deadline extension. This external resource failure needs no new +product/spec invariant. Scope: no manifest/task/PR or protected-file change. + +Trial disposition: paired550 source scanner0/reporter0; final preserved-source +cf28e5a4 scanner0/reporter0, no loading/analysis errors or OOM. Raw root/example +OpenPGP findings remain called:false; same GC-budget real-call control yields +called:true and reporter1. Upstream v2.6 default calls native analysis only for +sources with affected dependency groups. Classification covers all14 discovered +modules, distinguishing the12 without reported affected groups from the2 with +native results; no invented analysis receipt. Exact native compiler proofs +remain separate, including protected policytool stdlib module-only findings. + +### Backport 2026-10-10: HTTP/2 Patch Floor And Compute Ownership + +Authority: parent verified paused managed Signal successor and explicitly +assigned this repair to Compute; ADR0063. No Signal feature/acceptance re-entry. +Evidence: source3e62f5fa is Go1.27.1/x/net0.58.0/OTel1.45; actual consumed +wfctl0.86.1 is Go1.26.5/x/net0.58.0. GO-2026-6611 requires Go1.27.2 and +x/net0.60.0. Official stable Go, proxy/sumdb and Docker/CircleCI/DHI tag metadata +verified; their existence does not substitute for native/runtime artifact proof. + +S1/S6→Task2: upgrade the existing source/example/eleven fixtures, compiler-host +expectations and generated/default/container pins1.27.1→1.27.2; x/net0.58→0.60 +in owning graphs; retain OTel1.45 and all deliberate version overrides. +S4→Task2 plus existing Tasks1/3 acceptance: native authenticated targeted tidy, +focused literal RED/GREEN, real generated app/plugin and runtime/SDK/registry/ +Docker proof, exact-head four-command metadata, full cold Linux race/coverage, +native scanner/called control and UI gates. Prior Go1.27.1 receipts are history. +Task2 integration preserves accepted main's source-map-js1.2.2 repair, verified +at2fcb9baf; source-only protected diff compares to that recorded accepted main, +not the historical49e18034 base. Use the existing branch and a non-force merge. +S5: protected CI/scripts/policytool remain separate; current accepted CI/release +Go1.26.5 pins must be reconciled through the existing governed rollout before +source merge. No failed-check bypass, settings change, release or deployment +inside this source manifest. Source3tasks/1PR grouping retained; re-lock after +independent amendment review and structural alignment PASS. + +See `decisions/0063-source-go1272-http2-security.md`. + +### Backport 2026-10-10: Preserve Accepted Fixture Input Guards + +Accepted main2fcb9baf already owns reusable SDK/Docker fixture callers, a full +effective Go/config/compiler/tool/source fingerprint, cancellation-aware +exclusive copy, process teardown and the relocated linked-version regression. +Retaining the older source cache alone would bypass those accepted guards. + +Task1 keeps its source `.`+race cache, sticky failure/lazy/private-copy cases +and independent changed-input build semantics. Its actual request path first +uses accepted `fixtureBuildKey`; the full fingerprint joins cache identity. +Unclosed or failed input-key resolution uses the unchanged raw command, never +another cache. Cached delivery uses accepted context-aware exclusive copy. +Integrated source-dispatch controls cover fingerprint changes and native/ +GOENV bypass; helper sentinels remain distinct from real runtime acceptance. +Attempt both process-cache cleanups after `m.Run()` and fail on either error. +The accepted integration version test retains empty stdout, preceding stderr +diagnostics and final v9.9.9; remove only its duplicate package-main copy. +No new cache kind, SDK/Docker opt-in, task/PR count change, deadline increase or +protected-file source change. Final frozen runtime/CI gates remain mandatory. +Task2's inherited compiler-host inventory names +`cmd/wfctl/fixture_build_artifacts_contract_test.go`: its normal GOTOOLCHAIN pin +moves1.27.1→1.27.2, preserving deliberate older-version controls. The inherited +public-policy document describes separately protected bridge pins and remains +outside the source/generated-default patch. No1.27.2 proof is claimed here. + +### Backport 2026-10-10: Match Physical Overlay Source Paths + +The real native Go1.27.2 fixture/cache/host run passed wfctl/SDK/composite/ +cleanup and every other control, but its inherited overlay case returned the +original embedded asset. A matched raw-Go control changed only the overlay +source key: logical /var kept the original value; physical /private/var +returned both requested mutations. This proves a Darwin path-alias fixture +defect, not cached-byte reuse or an accepted Go overlay bypass. + +Task2/S4 corrects only the source key in already-owned +`cmd/wfctl/fixture_build_artifacts_contract_test.go` with `filepath.EvalSymlinks`. +Keep command/environment, two actual output assertions and2-build/0-hit/ +2-bypass counts unchanged. Retain native RED/causal evidence and require +focused race GREEN plus all fixture controls; final frozen Linux/full runtime/ +scanner/UI/CI gates remain mandatory. No cache/production behavior, task/PR +count, protected ownership or deadline change. + + +### Backport 2026-10-16: Recover snapshot acceptance through existing source PR1022 (ADR0198) + +Actual Task34/PR1073 is normally merged as main `3c5aa969` (reviewed tree `a0ebe8a9`, parent `aee545f5`). All13 actual-main CI jobs and the four strict checks pass, including153 uncached packages/57 critical parents, realCLI1272/liveDocker4.99s and wfctl578.623s. Its separate automatic snapshot38889204283 attempt1 genuinely FAILS: `go test -race ./...` reaches the unchanged600-second aggregate wfctl package alarm at600.221s while MissingLdflag has run1s;152 other packages pass, image/release jobs SKIP. The active one-second build is not proved hung. Preserve the complete failed log and all historical receipts. Existing source-host reuse in the already approved three-task/one-PR1022 lane is a recovery candidate, not a proved fix or a new task. + +| ID | Effective requirement | Existing boundary | +|---|---|---| +| SR1 | Preserve all36 compiler task IDs/branches/PRs, Task34's shipped four-map-only scope, source1022's existing3tasks/1PR/owners and the actual shipping order34→1022. No task, owner, PR grouping, shipped feature or Scope Manifest changes; all17 workspace locks and the source-plan lock remain byte-identical. Task35 remains conditional UNPERFORMED/open because the unchanged harness passes. | Governance/preservation | +| SR2 | Task34 remains unaccepted after its failed snapshot; mainCI PASS never substitutes for snapshot PASS and no original run is relabeled. Record Main1 failure reviews/counters before recovery. Allow only the existing source1022 lane to integrate the engineering-integrated actualmain3c5aa969 through its normal merge under ADR0063 while forward Task34 acceptance remains pending. This supersedes only the accepted-predecessor timing in SF1/RR1/IQ8 and sourceTask2 step1 for this recovery; it does not change which task ships in which PR or accept Task34/runtime. | Existing source1022 preparation | +| SR3 | Compose the already-owned Task1 source race-host reuse with accepted fixtureBuildKey/compiler/config/source identity and context-aware exclusive copy; retain all cache bypass/error/cancellation/cleanup controls and inherited SDK/Docker/registry/capability behavior. Retain existing Task2 Go1.27.2/x/net0.60/generated/runtime/module/default repairs and Task3 UI parsing scope. Reconcile only existing source owners against the recorded actual integration base; all protected .github/scripts/policytool/H/maps bytes must equal that base. No speculative cache efficacy or transferred historical1.27.1 proof. | Existing3tasks/1PR1022 | +| SR4 | Preserve source1022's exact-head focused/full native/default600 budget, generated app/plugin/realhost/UI/maintained-image and ordinary current security/review/protection requirements. Its publication/integration uses the existing PR and ordinary protected checks; actual corrected-main native and unchanged600 snapshot tests/release/image provenance plus final reviews must genuinely succeed before source acceptance. No timeout/race/assertion weakening, manual tag/image/release, blind rerun, private Go cache, extra clone or deployment. | Source1022 verification/integration | +| SR5 | Only after source1022 is genuinely accepted, perform a fresh Task34 Main2 forward reevaluation on that corrected accepted descendant. Prove Task34 H/fourmaps/realized context unchanged and classify every intervening source delta under the approved3/1 source owners; all other bytes/modes remain exact. Join genuine corrected-main/native/snapshot/security/protection evidence and two fresh final reviews before Task34 forward acceptance. Preserve originalMain1 snapshotFAIL and every counter/seal; no retroactivePASS or whole-planComplete. | Task34 forward acceptance | +| SR6 | Existing named34 same-known nonrequired OSV timing still expires at reviewed source1022 integration; source1022 retains its own ordinary current security obligation and no extension/Task35 inheritance is added. Preserve actual full finding/error/alias/risk assessment, CodeQL/Quality/required protections and UNKNOWN/AnalysisComplete=false/SecurityClean=false while incomplete. No scanner framework/upstream env-policy change, setting/credential/runner/deploy authority is added. | Security/runtime boundary | + +Forward: SR1→all36/source3/1/locks;SR2→Task34 failure and sourceTask2 integration timing;SR3–SR4→existing sourceTasks1–3;SR5→fresh Task34Main2;SR6→both current security/unchanged expiry. Reverse: Task34 four-map source→unchanged SF5; Task34 acceptance→SR2/SR5 plus unchanged real gates; sourceTasks1–3→ADR0063 andSR2–SR4/SR6; Task35→unchangedSF6; runtime/issuer/releasedLinuxCLI/Compute identities-worker-quietwindow→unchanged obligations. This is a bug/assumption design backport under existing approved source work: PR34 has already shipped before PR1022, and their task grouping/shipped scope is unchanged. Two independent scope-first/all15 governance reviews and full36+source3 alignment precede canonical apply; verify existing locks without relocking. + + +### Backport 2026-10-16: Preserve current accepted integration dependencies and compiler dispatch + +The SR2 normal merge records engineering-integrated main `3c5aa969` as the comparison base. Its owning module graphs already select OTel1.47.0/otelhttp0.70.0 and newer accepted schema/protobuf/genproto companions; its UI already selects js-yaml4.3.2/Vitest5.0.3/source-map-js1.2.2. Preserve those exact accepted versions and graph classifications instead of restoring the source branch's older1.45/4.x graph. Start the thirteen owning modules and their existing checksum files from that accepted base, then use native structured `go mod edit` for only the existing Go1.27.2 floor and x/net0.60.0 requirements, followed by native targeted tidy and complete graph-delta review. No unrelated upgrade, checksum text edit or protected policytool change. Any genuine companion correction must be evidence-backed and reviewed. Older literal1.45/source UI counts are historical proof details; final metadata/runtime expectations bind the inherited accepted1.47 graph and actual current UI suite. + +Preserve the accepted invoking-compiler dispatch and `GOTOOLCHAIN=local` registry environment, actual built-CLI metadata rejection and startup/PATH controls. The outer exact source verifier runs native1.27.2; it must not restore downloaded registry compiler selection or remove current main controls. In the already-owned fixture contract, update only normal fixed1.27.1 selection/observation expectations to1.27.2, preserve every deliberate old-compiler/floor variant and current startup/discovery/registry controls, and retain the source-owned physical overlay key fix. SourceTask1 remains source `.` plus race only, with complete accepted fixtureBuildKey, exclusive context-aware copy and both cache cleanups; capability/SDK/Docker/registry cache expansion remains excluded. + +This is an accepted-baseline integration clarification within the same three tasks, one PR1022 and existing module/UI/fixture/document owners. It changes no manifest, lock, task/PR grouping, API, timeout or security gate. All historical failure/review counters remain, actual current-head/generated/runtime/Linux default600/UI/image/security/main/snapshot/final proof remains due, and Task34 remains unaccepted under SR1–SR6. + + +### Backport 2026-10-16: Retain the already-approved editor security resolution + +Actual source3 owning CI38895629738/UI job116955296201 fails1/141 cases: the real imported editor parseYaml accepts the above-budget hostile merge, while direct js-yaml.load rejects it. Whole main-lock preservation had restored editor0.2.0 and dropped this source branch's existing0.2.1 correction. Root js-yaml4.3.2 alone does not establish the separately bundled editor parser's budget. Preserve original failure/log/source3 seals; no weakened or removed parser assertion. + +Existing Task3 already owns the compatible lock resolution. Native npm metadata resolution restores exactly the original source81b9 editor0.2.1 package object within unchanged manifest^0.2.0; every other package/root object remains exact, including accepted Vitest5/rootjsYaml4.3.2/source-map-js1.2.2. This narrowly corrects the earlier accepted-baseline UI-graph preservation note. No new editor release/repository source, package manifest edit, task/PR/owner/Scope Manifest or lock change. Resolver uses ignore-scripts/package-lock-only and installs no node_modules; its Node25 version is metadata tooling, not Node24 runtime proof. + +Installed original0.2.1 artifact statically includes default10000 merge-work accounting and the original source resolution is supporting evidence only. Fresh exact-source review and real Node24 focused/full UI141/build plus all ordinary current CI/security/runtime/main/snapshot/final gates remain due. Source4 review has not started and tests/builds are HELD for Tina after the source3 four-command batch released the local heavy slot. Do not blind-rerun b436, transfer historical1.27.1/older-Vitest proof, accept source1022/Task34 or infer the snapshot600 cause. All existing review counters and source3 M1 cancellation-delay limits remain. + + +### Backport 2026-10-16: Offline Generated-App Production Graph + +The original natural source3 run38895629738/native116955501479 failed both embedded/external `TestBuildBinaryStep_DryRun_GeneratedMainHTTPRuntime` variants before compilation: forced-offline `go mod tidy` loads dependency test graphs not provisioned by the owning source module's download/test. Preserve the complete failed producer log,82 proxy-off denials and both post-seal Important review supplements. This is a test dependency-resolution assumption defect; no generated-app runtime failure was reached or proved. + +Existing Task2 already owns this runtime test. Keep the exact three emitted files, default factory/Execute without a Go override, explicit source-only Workflow replacement, invoking native compiler and all HTTP identity/SIGTERM/endpoint-absence assertions in both modes. Seed only committed owning go.sum metadata into the disposable generated module; build its production graph with explicit `-mod=mod` under unchanged GOWORKoff/GOTOOLCHAINlocal/GOPROXYoff/GOSUMDBoff/CGO0. Do not preload dependency test modules, add a clone/private Go cache, enable network, suppress an error or reuse a prebuilt artifact. Add an independent literal1.27.2 assertion to the actual emitted module. This bounded runtime harness no longer invokes dependency-test-graph tidy; ordinary13-owning-module tidy and the separate generated-app/plugin native tidy integration proofs remain mandatory. No production emitter, dependency graph, task/PR/owner/manifest, lock, protected file, assertion or deadline changes. + +Fresh exact Node24.21.0 install, real-parser10/fullUI141 tests, build and lint now PASS on the already-reviewed editor0.2.1 resolution with accepted Vitest5.0.3/js-yaml4.3.2 preserved. Keep original UI140PASS1FAIL as failed historical evidence. Source5 continues round5/max5 with both Source4 static seals and new Important native supplements preserved; final full-source independent review follows meaningful actual offline HTTP/lifecycle validation, scoped vet/lint and source preservation checks. + +Source3 wfctl604.441s genuinely passed the actual900s CI alarm and exceeded the separate600s functional acceptance target by4.441s. Proportionate log assessment separates that timing gap from the concrete module-resolution failure and advisory benchmark. Do not treat a benchmark as a blocker or infer an individual hang/cache cause; no additional cache scope, assertion weakening, alarm increase or blind prior-head rerun. The corrected source's natural native run and genuine unchanged600 snapshot/acceptance must establish their own results. Source1022/Task34/runtime remain unaccepted until their ordinary current gates succeed; named34 security timing expiry and retired scanner-framework disposition remain unchanged. diff --git a/docs/plans/2026-10-03-release-security-source-plan-review.md b/docs/plans/2026-10-03-release-security-source-plan-review.md new file mode 100644 index 00000000..7668f183 --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source-plan-review.md @@ -0,0 +1,46 @@ +### Adversarial Review Report + +**Phase:** plan +**Artifact:** `docs/plans/2026-10-03-release-security-source.md` +**Status:** PASS after inline corrections + +Independent bounded pass initially found one Important and three Minor issues; reviewer explicitly required no additional exploration/review loop to resolve them. + +- `P1` Important, HTTP ownership: HTTP 200 alone can belong to another listener after asynchronous bind failure. Resolution: temporary structured YAML, explicit loopback listeners, run-specific response identity, process-alive/no-listener-error checks and verified owned shutdown. +- `P2` Minor, existence: `cmd/sandbox-runner` nonexistent. Resolution: actual `cmd/workflow-sandbox-runner` path. +- `P3` Minor, integration proof: valid/syntax cases alone omit hostile input at editor boundary. Resolution: hostile merge input also exercised through actual `parseYaml` default-budget path. +- `P4` Minor, evidence isolation: relative report path risks scanning previous reports. Resolution: absolute separately mounted `/evidence/results.json` outside root. + +| Class | Result | Note | +|---|---|---| +| Project guidance | Clean | Owning repo/source-only scope respected | +| Assumptions | P1 | Runtime ownership now asserted | +| Repo precedent | Clean | Existing helper/resolver conventions | +| Artifact class | Clean | Real fixture/import paths | +| YAGNI | Clean | No additional abstraction surface | +| Failure modes | P1 | Bind failure cannot fake successful launch | +| Security/privacy | P1 | Loopback confinement explicit | +| Infrastructure impact | P1 | Owned transient listeners only | +| Multi-component validation | P1/P3 | Real server and editor consumer | +| Declared integration | Clean | Every integration classified | +| Contributed UI rendering | Clean | No new contribution | +| Rollback story | Clean | Revert/rebuild/hold | +| Simpler alternative | Clean | Dependency-only source fixes plus narrow test reuse | +| User-intent drift | Clean | Material follow-up, no Signal feature expansion | +| Existence/runtime validity | P2 | Binary path corrected | +| Decomposition | Clean | Three disjoint owning tasks | +| Verification class | P1/P3 | Runtime/pin changes require real consumers | +| Auth/authz composition | Clean | Existing guards unchanged | +| Hidden serial dependencies | Clean | Module stabilization precedes broad Go tests | +| Rollback wiring | Clean | Task-specific notes | +| Integration proof | P1/P3 | Corrected above | +| Integration matrix | Clean | No installed-only success claim | +| Contributed UI routes | Clean | Not applicable | +| Infrastructure verification | P1 | Owned launch/shutdown | +| Plugin loader layout | Clean | Existing accepted layout reused | +| Config schema | Clean | Derived existing runnable example | +| Identifier conventions | P2 | Corrected actual command directory | +| Compile validity | Clean | No embedded implementation code | +| Evidence isolation | P4 | Separate absolute report mount | + +Verdict: all S1-S5 map to executable tasks; inline fixes close P1 without changing manifest. Cold 600s, exact compiler/native analysis, real host matrices and required CI remain mandatory. No nitpick rerun. diff --git a/docs/plans/2026-10-03-release-security-source-verification.md b/docs/plans/2026-10-03-release-security-source-verification.md new file mode 100644 index 00000000..1e687c62 --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source-verification.md @@ -0,0 +1,198 @@ +# Source Security Verification Checkpoint + +2026-10-03; source-only boundary, not scanner rollout or release promotion. + +## Go1.27.1 Amendment Checkpoint + +Final frozen452cff8f native Linux/ARM64 cold compiler-cache command +`go test -v -race -coverprofile=coverage.out ./...` exits0 in607s. +All154 Workflow package results succeed; wfctl428.833s stays below its +unchanged600s default. UID1000/registered ci, Docker-init and native source/ +temp/cache custody; source status unchanged, coverage retained, owned +container removed. Expected negative child/plugin output is not a package +failure; no Workflow package failure or race report. This supersedes the +failed33b4/ee6e whole gates below, without erasing their evidence. + +Same clean452cff8f four actual commands report Go1.27.1/exact revision/ +vcs.modified=false and OTel1.45.0 where linked; three platform import graphs +exclude OpenPGP. Actual owned server HTTP200/random identity, SIGTERM0, +endpoint absence and failure-signature scrape pass. Real maintained +Dockerfile.legacy builds/launches with the same metadata, nonroot65532, +cap-drop/no-new-privileges/read-only root/private tmp, negative endpoints and +clean shutdown/owned cleanup. This is not the auth-gated DHI image proof. + +Fresh generated SDK plugin, API/health app and default BuildBinaryStep output +all run through their real boundaries at452cff8f; local dependency replacement +and local plugin version flag remain disclosed below. Strict live Docker +record-host matrix passes31.372s. Registry32.060s control/all30 denials at +ee6eb078 remain applicable: its registry/product/module bytes are identical +to452cff8f; the intervening change is root rate-test plus four evidence docs. + +Fresh UI clean install/full141 tests/types/Vite/installed-family audit pass +at452cff8f. Native digest-pinned OSV2.6 source scanner0/reporter0 in76s, +all14 modules discovered, genuine root/example GO-2026-5932 called:false; +same actual called-control scanner1/reporter1 rejection. No analysis errors, +ignore changes or clean-all-dependencies claim; local GC budget retained. +Unchanged full policy mutation harness under Go1.27.1 exits0; protected +`.github/`/`scripts/` diff versus49e18034 is empty. This source harness PASS +does not resolve the separate legal-stage B2 harness failure. + +Native corrected-custody ee6eb078 whole command finishes622s, source clean, +wfctl PASS460.576s below unchanged600s. Whole exit1 solely root rate-recovery +fixture: its10ms token interval cannot require depletion after a50ms HTTP +burst. All filesystem/home failures and stale init/version assertions pass. +Controlled25ms HTTP pause reproduces old-rate RED;60RPM/derived refill wait +GREEN3.433s; one-variable old-rate reversal fails the same exact429 assertion. +Independent test-only review SHIP-IT; root vet0 and scoped lint0; production +limiter/CI/script bytes unchanged. Final restored/frozen whole gate passes above. + +Actual ee6eb078 native Linux default GitHub-API/TLS proxy control plus all30 +CLI denials pass32.060s (177s with cold compile), zero failures/skips, source +clean and owned container removed. No live-release or whole-suite claim. + +Checkpoint2026-10-04, ADR0061/0062: independent narrow delta review SHIP-IT, +no Important/Critical findings. Real MCP CD/release pins RED on1.26.5 and +GREEN on1.27.1; existing init/version focused tests GREEN14.532s after stale +optional-module and final stderr-line corrections. Version diagnostics remain +visible, existing stderr behavior unchanged. Compatible full scoped source +lint reports0issues; changed MCP/wfctl vet exits0. Protected diff remains empty. + +Cold33b4 Go27 whole suite exited1 (wfctl549.956s below600s), not acceptance. +Stale init/version expectations are corrected above. Matched unchanged-source +control with registered UID1000 and native container source/temp/cache passes +all atomic/lock/permission/home and LRU cases, zero failures/skips, clean source; +the host VirtioFS/unregistered UID setup was not valid CI custody. No product +filesystem or timeout changes. Corrected final frozen-source cold run remains. + +Maintained e-commerce builder uses the exact official DHI catalog tag +1.27.1-alpine3.23-dev, preserving vendor/dev/CGO0 and static3.22 nonroot runtime. +Official definition declares both release architectures and compiler1.27.1; +registry401 prevents published digest/native compiler/build verification here. +Authentication is requested, not bypassed; no image-availability claim. +Actual CI Task1 also holds on independent B2 bootstrap evidence: its legal +five-JSON stage makes the unchanged current harness's own lifecycle fixture +append a forbidden second staged bundle. Promoted synthetic harness PASS is +not actual stage CI acceptance. No new CI stage/merge or exception approved. + +2026-10-04: earlier Go1.26.8 receipts below are historical, not new-compiler +acceptance. Root/example/eleven fixture floors, generated defaults/CI/Docker, +SDK/build defaults and maintained builders now use1.27.1. Explicit overrides +remain supported. Compatible golangci-lint2.14.0 scoped lint exits0 after final +edits. Independent literal/module/YAML/AST assertions and actual emitted +default-build HTTP runtime tests pass under1.27.1. Protected .github/scripts +diff against49e18034 remains empty. + +Real generated bootstrap, strict StringValue, optional default module, health +route and obsolete named-trigger failures were reproduced before correcting +their owning source/templates. Generated app defaults use the existing plugin +registry, real health wiring and existing HTTP/messaging workflow sections; +no test-only module/route substitution or core ABI expansion. Generated config +module/health/trigger assertions each fail on their original template defect +and pass after repair; ordinary message and invalid StringValue cases remain. + +Actual rebuilt wfctl emits a fresh API app; explicit local Workflow replacement +is disclosed (published dependency resolution is not proved). Go1.27.1 build +serves an unpredictable owned API identity, /health reports healthy, SIGTERM +exits0 without forced kill and endpoint is absent. Fresh generated SDK plugin +executes through actual plugin-dir discovery and pipeline run, returning the +exact uppercase randomized StringValue input. Its1.0.0 internal build flag is +local probe metadata, not a release. Default BuildBinaryStep output likewise +builds/serves/shuts down through its real emitted bootstrap, not a copied app. + +Windows native-test cross-compiles pass. Its generated runtime test compiles +the exact emitted binaries before skipping only the POSIX SIGTERM lifecycle; +Windows graceful shutdown is not claimed. The corresponding actual POSIX +embedded/external-config runtime cases pass. + +Raw current evidence: /private/tmp/workflow-go127-source-proof-20261004; +worker bootstrap TDD: /private/tmp/workflow-go127-source-main-20261004-report.md. +Final452cff8f source/runtime/cold/UI/scanner receipts are recorded above. +Final static/cross-compile readback, exact-head warm relink after evidence-only +commits, DHI authentication/build, all actual PR checks and merged-main +receipts remain required. CI alignment +uses its separate locked twelve-PR plan; no source/Signal completion claim. + +## Go And Host Evidence + +- Exact Go1.26.5 baseline govulncheck called findings retained; patched native + Go1.26.8 has zero called findings. Unchanged isolated policytool at exact + Go1.26.5 also has zero called findings, with module-only advisories disclosed. +- Cache/compiler/env mutation RED/restored GREEN; focused race5.124s and + Windows test compile PASS. Independent spec/quality review Tasks1/2 PASS. +- Fresh plain40d5d6e6 source, nonrootUID1000 Docker-init, cold compiler cache: + exact full race/coverage all152 packages PASS, wfctl519.387s within unchanged + default600s timeout. Root permission bypass and no-init orphan zombies were + separately reproduced environmental defects, not production/test changes. +- Frozen unchanged policy mutation suite PASS. Actual server returns an + unpredictable run-specific HTTP identity and shuts down cleanly. Strict live + Docker builtin/sandbox proof36.661s PASS, digest-pinned image and empty cleanup. +- Fresh plain6051d68d source/native LinuxGo1.26.8: real registry default HTTPS + proxy fixture forward/no-op/rollback control and all30 denials PASS30.169s; + listener/process cleanup and clean source read back. Dependency GitHub API is + fixture-backed, not live immutable-release evidence. + +## Real UI Consumer + +Direct YAML and actual public editor parseYaml imports: old dependencies RED; +compatible released editor0.2.1 GREEN. Old editor reinstall reproduces the +budget failure. Existing ^0.2.0 range/manifest unchanged. Package registry SRI +and installed gitHead6ed54b08f573cf701d8ba0ee35c16879475e29e4 match the verified +maintenance release, not a local tarball or source replacement. + +Node24.14.0/npm11.9.0: clean npmci, focused10, full141 tests, targeted lint, +types/Vite build all PASS. Installed ten-family/duplicate audit PASS. Babel, +Vitest and browser-data changes retain required family alignment. Independent +review found chai/tinyrainbow refreshes unnecessary; an isolated npm resolver +restored base6.2.2/3.1.0, with only those two lock entries changed and no manifest +changes. Fresh clean install/full141 tests/types/build/targeted lint and all ten +installed-family checks PASS after restoration. No ecommerce-lock changes. +Build chunk-size warning +remains, not suppressed or refactored in this security boundary. + +## Final Source And Native Scanner + +Plain committed550c0f7a binaries all report exact VCS identity, unmodified source +and Go1.26.8; server/wfctl link OTel1.45.0. Shipped Darwin/Linux/Windows import +lists contain no OpenPGP. Actual credential-free server smoke returns the +owned unpredictable identity, exits0 on SIGTERM and leaves no listener. +Fresh plaincf28e5a4 four-artifact metadata also passes with exact revision, +unmodified source/Go1.26.8/OTel1.45.0; owned server smoke returns HTTP200, +loopback-only listener, clean SIGTERM0 and endpoint absence. Go source/modules +remain byte-identical to cold-suite40d5d6e6. Final evidence-doc commits require +only exact-head warm relink/readback, not a repeat cold compiler test. + +Original native production scan: OOM137 at7GiB after63.224s, no results or +reporter, not accepted. Same550c0f7a paired resource trial with container-local +GOMEMLIMIT=4GiB completes scanner0/reporter0. Final preserved-resolutioncf28e5a4 +full recursive scan completes scanner0/reporter0 in96s, no loading/analysis +errors and no OOM. Image/entrypoint/analysis command unchanged; no exclusions, +ignores, authentication/Go compiler override or repository policy changes. +This local GC budget is not authorized CI configuration; policytool GO* env +restriction remains unchanged. + +All14 committed Go modules are discovered. Raw JSON retains root/example +x/crypto0.57.0 GO-2026-5932 with genuine called:false. Other12 modules have no +reported affected groups and therefore no upstream default native-analysis +trigger; do not label them fourteen govulncheck invocations. Exact Go1.26.8 +shipped-code and Go1.26.5 policytool proofs independently retain stdlib/module +classification. Current-run source/evidence custody, image/entrypoint, all14 +discovery, classification/no-error and reporter assertions pass. A throwaway +collector's entrypoint-shape assertion was corrected from actual Docker/image +readback; raw scanner output was never changed. + +Same corrected environment detects the existing real OpenPGP API call as +called:true; scanner1 and unchanged --fail-on-vuln=true reporter1 are expected +rejection, without analysis errors. Original no-import reversal/restored-called +evidence retained. This is a labeled scanner control, not an application demo. + +## Remaining Integration Gates +Independent final UI/whole-boundary review SHIP-IT, no Critical/Important +findings; the sole Minor unnecessary-resolution finding is addressed above. +See the committed code-review disposition. Exact-head PR/CI, merge and retro +remain. Protected .github/scripts/policytool bytes are unchanged; maintained +Dockerfile source changes are explicitly owned by the Go27 amendment. + +The separately pinned old CI scanner cannot analyze the root floor; local +source proof does not silently repair public scanner authority. Its failure +must stay visible. No tags/releases or Signal Task35 completion here. Current +editor0.85.4 also requires its own compatible patch outside this plan. diff --git a/docs/plans/2026-10-03-release-security-source.md b/docs/plans/2026-10-03-release-security-source.md new file mode 100644 index 00000000..9b25e212 --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source.md @@ -0,0 +1,344 @@ +# Workflow Source Security Remediation Implementation Plan + +> **For the implementing agent:** REQUIRED SUB-SKILL: Use autodev:executing-plans to implement this plan task-by-task. + +**Goal:** Patch shipped Go/UI vulnerabilities and remove redundant record-host builds without weakening runtime evidence. +**Architecture:** Preserve the public Workflow engine/SDK contracts and existing test cases. Patch owning module/lock resolutions; lazily reuse only identical source race-host builds in process-owned temporary custody. CI authority, scanner rollout and release promotion remain separate. +**Tech Stack:** Go 1.27.2, golangci-lint 2.14.0, OTel 1.45.0, Node 24/npm, Vitest, real Workflow binaries, Docker, digest-pinned OSV 2.6.0. +**Base branch:** main (`49e1803424f303f6f98cef51cc9ea2dee96c7d38`). +**Design:** `docs/plans/2026-10-03-release-security-source-design.md`. +**Decisions:** `decisions/0056-isolate-source-security-remediation.md`; approved amendment `decisions/0057-upgrade-source-and-generated-go.md`. +Generated-runtime owning-file amendment: `decisions/0058-repair-generated-runtime-boundaries.md`. +Default-config owning-file amendment: `decisions/0059-use-self-contained-app-scaffolds.md`. +Health-config owning-file amendment: `decisions/0060-use-existing-scaffold-health-wiring.md`. +Remaining-default owning-file amendment: `decisions/0061-align-remaining-go-defaults.md`. +Existing-test owning-file backport: `decisions/0062-align-scaffold-and-version-test-boundaries.md`. +Approved patch-security amendment: `decisions/0063-source-go1272-http2-security.md`. + +## Guidance And Evidence + +Guidance: `AGENTS.md`, `CLAUDE.md`, `docs/AGENT_GUIDE.md`, `docs/REPO_LAYOUT.md`, `docs/public-workflow-policy.md`; workspace portfolio consulted. No parallel scanner/framework/plugin invented. + +Baseline: exact base/main OSV rows identical (159 findings, 157 fixable); old scanner Go 1.26.2 cannot analyze Go 1.26.5 modules. Shipped TLS/relative-URL DoS and UI YAML parsing warrant dependency remediation. Full wfctl race/coverage exceeded its existing 600s budget twice; no retry loop or deadline increase. + +## Scope Manifest + +**PR Count:** 1 +**Tasks:** 3 +**Estimated Lines of Change:** ~1,000 + +**Out of scope:** +- All `.github/`, `scripts/`, policytool, authority manifests and staged workflow contexts; embedded scaffold CI templates are Task2 source, not executable repository workflows. +- Release tags/publication, deployment, Signal manifest changes and other-repository fleet migration. Workflow Go1.27.2/generated defaults and maintained Docker builders are explicitly included by ADR0057/0063. +- Cache reuse for SDK, Docker, registry, mutant or capability executables; test removal, timeout extension, GORACE changes, scanner ignores/suppression. +- Generated strict StringValue/app bootstrap defects are Task2 per ADR0058; broader codec types, new scaffold ABI and new generator APIs remain excluded. +- Default optional external observability config repair is Task2 per ADR0059; new external-plugin loader and replacement telemetry semantics remain excluded. +- Existing health endpoint wiring is Task2 per ADR0060; no new health API or handler substitute. + +**PR Grouping:** + +| PR # | Title | Tasks | Branch | +|------|-------|-------|--------| +| 1 | Patch Workflow source security and reuse immutable test hosts | Task 1, Task 2, Task 3 | fix/workflow-release-security-20261003 | + +**Status:** Locked 2026-10-10T15:40:45Z + +### Task 1: Reuse Identical Source Record Hosts + +Requirements: S3, S4. Files: modify `cmd/wfctl/pipeline_record_host_test.go`, `cmd/wfctl/main_test.go`; create portable `cmd/wfctl/pipeline_record_host_cache_test.go`. + +**Accepted-main integration backport (ADR0063):** retain the source race-host +cache and every existing case. Actual requests use accepted `fixtureBuildKey` +to include effective Go config, selected compiler/tools and source contents in +identity; external/unclosed inputs execute the original command unchanged. +Use accepted context-aware exclusive copy for cache delivery. Add integrated +source-dispatch controls in the existing host-test owner. Both process caches +close after `m.Run()`, even if one fails. Accepted SDK/Docker cache callers and +the relocated linked-version test remain inherited baseline, not new scope. +All runtime, timeout and final exact-head proof gates below remain mandatory. + +1. Add local-cache tests for one build across repeated identical requests, distinct copied mode-0700 destinations, changed cwd/compiler/environment fallback, failure propagation, lazy initialization and owned-directory removal. Inject build operation only in helper unit tests; sentinel bytes are not runtime proof. Run `GOWORK=off GOTOOLCHAIN=go1.26.8 go test ./cmd/wfctl -run '^TestPipelineRecordHostCache' -count=1`; expected new tests fail before helper exists. +2. Implement a synchronized lazy process-owned cache only for source target `.` with `race=true`. Key exact cwd, resolved compiler identity and complete effective build environment. Error/cancellation never supplies a binary. For any differing key, retain original independent build. Never cache explicit downloaded-host selection, including invalid selections; existing denial branch remains first. Do not build eagerly in TestMain. +3. Copy cached bytes to each caller's existing isolated destination with 0700 mode. Remove only the owned cache after `m.Run()` and before `os.Exit`; preserve private-child dispatch. Cache helper must compile on Windows. No test parallelism/global environment mutations added. +4. Run `GOWORK=off GOTOOLCHAIN=go1.26.8 go test ./cmd/wfctl -run '^TestPipelineRecordHost(Cache|PrebuiltBinary)' -race -count=1`; expected exit 0, all copy/denial/cache cases PASS. Run `GOOS=windows GOARCH=amd64 GOWORK=off GOTOOLCHAIN=go1.26.8 go test -c -o /tmp/wfctl-security-windows.test.exe ./cmd/wfctl`; expected exit 0. +5. After Task 2 stabilizes modules, run the exact CI `go test -v -race -coverprofile=coverage.out ./...` on a cold Linux compiler cache, unchanged default package timeout. Retain output and timings; wfctl must finish below 600s with all late-output, composites, SDK and cleanup cases present. Otherwise backport A1 and hold, not extend limits. +6. Commit only helper/test files after focused proof. Rollback: revert this test-helper change and rerun focused/full tests; no production behavior changes. + +### Task 2: Patch Go Runtime Dependencies And Prove Real Hosts + +**Operative patch-security amendment (ADR0063):** existing Task2/sole PR1022, +assigned to Compute by the parent; Signal stays paused. Every final1.27.1 +compiler/floor/default/assertion/command in the earlier Task2A-E amendment below +now targets1.27.2. Earlier dated receipts remain historical; explicit older +version overrides and unrelated dependency/checksum versions stay unchanged. + +1. Integrate the accepted main into the existing source branch with a normal + merge before collecting source acceptance, preserving its source-map-js1.2.2 + repair and all accepted authority bytes. Record that exact integration base; + source-only protected-file diff against it must be empty. This supersedes + the historical49e18034 protected comparison, not its evidence. No new clone, + worktree or private Go cache. Every following gate binds the integrated head. +2. Update the existing independent default-version assertions first; retain + their literal1.27.2 expectations and all existing override/runtime cases. + Run the unchanged focused Task2A command with GOTOOLCHAIN=go1.27.2: RED must + come from old defaults, not compiler setup. Parent serial allocation governs + heavy local/native work; existing authorized CI supplies public evidence. +3. Update root/example/eleven fixture Go floors and every already-owned + generated/source-host/default/container pin1.27.1→1.27.2. Update x/net0.58→ + 0.60 in root/example and ten linked fixture graphs; iac-hang has no x/net. + The inherited `cmd/wfctl/fixture_build_artifacts_contract_test.go` compiler + control also moves its normal GOTOOLCHAIN1.27.1 pin to1.27.2; retain its + deliberate older source-floor/compiler-variant controls. The inherited + public-policy documentation describes its separate protected bridge and + is not a generated/source default owner. + Retain OTel1.45 and existing crypto/sys/text/term versions unless native + targeted tidy requires a documented compatible companion correction. +4. With GOWORK=off/GOTOOLCHAIN=go1.27.2, authenticated native targeted module + resolution/tidy must preserve unrelated resolutions. Never replace text in + go.sum checksum rows. Verify all owning module files are tidy and focused + literal assertions GREEN; existing explicit overrides still pass. +5. Rerun Task2C/D actual generated/host/SDK/registry/Docker/four-command proofs + with1.27.2, full cold Linux race/coverage under the same600s wfctl deadline, + and Tasks1/3 native scanner/called-control/UI gates. Inspect exact frozen + revision, vcs.modified=false, compiler1.27.2/x/net0.60/OTel1.45 where linked. + Official image catalog metadata alone cannot pass maintained-image gates. +6. Independently review exact source, commit/push the existing PR1022 only, + and require all real current-head checks. Compatible CI/release drivers + remain the separately locked rollout; no protected source-PR writes, + skipped acceptance, timeout extension, settings exception or failing merge. + Subsequent official release/artifact verification uses its separately + authorized governing path; this source manifest does not publish a tag. + +Requirements: S1, S4, S5. Files: `go.mod`, `go.sum`, `example/go.mod`, `example/go.sum`; all eleven module pairs under `cmd/wfctl/testdata/conformance/{iac-hang,iac-pass,no-iac}/` and `cmd/wfctl/testdata/verify_capabilities/{iac-extra-service,good,name-drift,release-good,version-drift,iac-good,missing-ldflag,iac-missing-service}/`; `cmd/wfctl/plugin_registry_sync_host_test.go`, `README.md`, `cmd/wfctl/testdata/pipeline-record/README.md`, `cmd/wfctl/testdata/registry-sync/README.md`. + +Approved2026-10-04 amendment additionally owns S6: `cmd/wfctl/templates/` +existing module/CI/release/Docker/README files, `cmd/wfctl/generate.go`, +`cmd/wfctl/generate_test.go`, `cmd/wfctl/deploy.go`, `cmd/wfctl/deploy_test.go`, +`plugin/sdk/generator.go`, `plugin/sdk/generator_test.go`, +`module/pipeline_step_build_binary.go`, `module/pipeline_step_build_binary_test.go`, +`cigen/render_circleci.go`, `cigen/render_circleci_test.go`, `Dockerfile.admin`, +`Dockerfile.legacy` and active minimum-version docs. No new generator API. +ADR0058 additionally owns `cmd/wfctl/templates/{api-service,event-processor,full-stack}/main.go.tmpl` +and `plugin/external/convert.go`, `plugin/external/convert_test.go`. Reuse the +existing default-plugin registry for all generated app bootstraps and preserve +the generated strict StringValue schema with a bounded bidirectional host +value-map adapter. Add failing tests first; invalid fields/types must still +reject and ordinary messages retain existing behavior. No wider WKT support. +ADR0059 adds only `cmd/wfctl/templates/{api-service,full-stack}/workflow.yaml.tmpl`: +remove optional external observability modules from the self-contained defaults, +document opt-in composition in existing owning READMEs, and test generated module +types against the actual default-plugin registry. Add failing assertions first; +rerun real generated API config with only address/identity parameterization. +ADR0060 adds `cmd/wfctl/templates/event-processor/workflow.yaml.tmpl` to the two +existing YAML owners: preserve /health via healthPath and existing observability +wiring, not a manual route to a non-handler service. Add generated-config path/ +route regression RED/GREEN and rerun actual API/health/SIGTERM/endpoint absence. +Observed trigger backport additionally removes redundant invalid named trigger +blocks from these same owners, preserving existing HTTP routes and messaging +subscriptions/producers. Assert any emitted triggers against the actual default +trigger registry before final generated-app proof; no manifest change. +ADR0061 additionally owns `mcp/wfctl_tools.go`, `mcp/wfctl_tools_test.go`, +`example/ecommerce-app/Dockerfile`, `DOCUMENTATION.md` and `CONTRIBUTING.md`. +Assert structured Go pins in the real MCP CD result and existing release helper +RED/GREEN; retain current MCP API/HasPlugin behavior. Verify the DHI builder's +actual tag/compiler; update only active prerequisites/defaults in these and +existing README/build/deploy owners. No historical-plan rewrite, runtime image +vendor/hardening change or protected-file ownership. +The steps below supersede earlier1.26.8 commands for final verification; +previous tests/results remain historical receipts, not new-compiler acceptance. +ADR0062 additionally names `cmd/wfctl/init_test.go`: align optional-module +absence assertions with the approved self-contained defaults, retaining all +existing generated-file/module/UI checks. In already-owned `main_test.go`, +assert the exact final linked-version stderr line and empty stdout, retaining +preceding dependency stderr diagnostics. Preserve the existing handler writer. +Require authentic failure then focused GREEN; no production output change. +The observed scheduling backport additionally owns +`e2e_middleware_negative_test.go` for Task2/S4 only: controlled25ms client +pause must reproduce the old10ms-refill failure;60RPM/derived refill wait must +preserve all three actual engine/HTTP assertions and existing deadlines. +No production limiter/clock change; rerun the exact final cold command. + +A. Add independent literal1.27.1 assertions for scaffold modules/workflows, +legacy emitters, SDK module+local-replace modules, deploy Docker builder, +binary-build default and CircleCI image; preserve explicit overrides. Run +`GOWORK=off GOTOOLCHAIN=go1.27.1 go test ./cmd/wfctl ./plugin/sdk ./module ./cigen -run 'Test(InitTemplatesIncludeGithubWorkflows|CIWorkflowContent|CDWorkflowContent|ReleaseWorkflowContent|WriteDockerfile|GenerateProjectStructure|GenerateGoMod|BuildBinaryStep_Defaults|RenderCircleCI)' -count=1`; +new version assertions must fail on old pins, not compiler setup. +B. Use `go mod edit -go=1.27.1` and native targeted tidy in root/example/eleven +fixtures, no unrelated dependency upgrade. Update owning default pins above +and source-host expectations; preserve explicit overrides and prior dependency +fixes. Rerun A: all assertions PASS. Compatible2.14.0 lint, vet, Windows compile +and focused real record/registry suites use exact native1.27.1. +C. Build actual wfctl and use its existing `init`, `plugin init`, `generate` +and deploy-generation tests/commands. Parse emitted Go modules/YAML/Docker +versions independently; run a real generated API app with an explicit local +Workflow replacement, build with1.27.1/local, observe owned HTTP200/process +shutdown. Generate a fresh SDK plugin from built wfctl in source cwd using +`plugin init --author GoCodeAlone --output "$PLUGIN_SOURCE" workflow-plugin-go127proof`; +inside generated source run +`go mod edit -replace=github.com/GoCodeAlone/workflow="$SOURCE_ROOT"` to normalize +the discovered relative replacement for this integration-only proof, then +assert the absolute replacement, native tidy and compile +`go build -o "$WFCTL_PLUGIN_DIR/workflow-plugin-go127proof/workflow-plugin-go127proof" ./cmd/workflow-plugin-go127proof`, +and copy actual generated plugin.json/plugin.contracts.json alongside it. +Through the real Workflow plugin loader, execute generated +`step.go127proof_example` with a run-specific protobuf StringValue input; +require exact uppercase output, successful discovery/lifecycle/cleanup. +Record generated plugin output, not record-fixture binary, as this proof. +Exercise actual default BuildBinaryStep factory/Execute dry-run with no +go_version override, independently assert output go.mod1.27.1, materialize +those exact emitted files outside the repo, add explicit local Workflow +replacement via `go mod edit -replace` solely for unreleased source integration, +native tidy/build and launch the generated embedded-config binary. Require +owned HTTP200/identity and graceful shutdown. Existing compile test that accepts +an error cannot satisfy this gate; this proves generated output, not published +v0.0.0 dependency resolution. Dockerfile +builder smoke builds and launches a real maintained image; never insert a fake +prebuilt admin-plugin. Existing container/SDK matrices prove adjacent boundary. +D. Rebuild four shipped commands from clean frozen plain checkout and inspect +`go version -m`: exact frozen revision, vcs.modified=false, go1.27.1, +OTel1.45.0 where linked. Repeat actual server HTTP/SIGTERM/endpoint absence, +strict Docker, Linux default-API control plus30denials, and whole cold non-root +`--init` Linux152-package race/coverage under unchanged600s wfctl deadline. +Rerun full UI141/build and native source OSV/called-control evidence on final +source; no CI clean claim until all actual PR checks succeed. Run unchanged +policy harness under1.27.1 and byte-empty protected-file diff. +E. Commit only Task2 source files; push existing PR1022, independent bounded +review and all actual PR checks/trusted policy required before ordinary/admin +merge. No new source PR or settings changes. Rollback: reviewed source/default +revert, rebuild and launch; hold release because older limitations return. + +1. Preserve existing full-scan failure/actual code reachability evidence as RED; run exact Go 1.26.5 native `govulncheck` on shipped server/wfctl packages if needed to establish specific reachable advisory before update. Separately test policytool with its unchanged exact Go 1.26.5 compiler; errors/called vulnerable findings block, module-only uncalled findings must remain disclosed. +2. Use structured Go resolver commands: `go mod edit -go=1.26.8`, targeted `go get` OTel API/SDK/trace/metric/exporter families at 1.45.0, `go mod tidy` under `GOWORK=off GOTOOLCHAIN=go1.26.8`. Root existing gRPC 1.83.2/x-text 0.42.0 retained; fix stale fixture pins to these established versions. Repeat edit/tidy in each owning example/fixture module; exclude policytool. No broad `go get -u` or unrelated direct-dependency changes. +3. Set source-host registry compiler override/expected environment to 1.26.8; retain selector failures, default API and isolated TLS/proxy semantics. Update executable minimum-version commands/docs only, distinguishing historical Darwin trust behavior. Run `GOWORK=off GOTOOLCHAIN=go1.26.8 go test ./cmd/wfctl -run '^TestPluginRegistrySync(HostBinary|ReleaseProxy)_' -count=1`; expected exit 0. +4. Build actual `cmd/server`, `cmd/wfctl`, `cmd/workflow-sandbox-runner`, `cmd/workflow-lsp-server`; inspect `go version -m`: compiler 1.26.8, OTel 1.45.0 where linked. Probe original Go 1.26.5 driver with authenticated default `auto` selection, no workflow/env-policy change; built source must select 1.26.8. Enumerate shipped Linux/Darwin/Windows dependency lists: no OpenPGP packages. Full version-skew audit classifies residual protected CI/policytool drivers, legacy standalone scaffold/bootstrap pins and historical examples, with fleet/generator follow-up disclosed; no claim that those separate defaults were upgraded. Verify final exact-head artifact from a frozen plain checkout to avoid the nested-worktree VCS-stamp defect documented in the design backport. +5. Use a structured YAML parser to derive temporary config from a committed runnable HTTP example: explicit `127.0.0.1` listeners, a run-specific response identity, private data/management paths. Launch actual built server without production credentials, reject startup/bind/listener errors, assert owned process alive and HTTP 200 with that exact identity. Verify graceful owned-process shutdown and endpoint absence afterwards. No response from an unrelated existing listener or substitute server can satisfy the smoke gate. +6. Run full host matrix `go test ./cmd/wfctl -run '^TestPipelineRecordHost' -race -count=1`, including live Docker flags/image according to fixture README. Require actual sandbox properties and empty journals/containers. Run Linux default-API `go test -p=2 ./cmd/wfctl -run '^TestPluginRegistrySync(Target_ActualCLI|HostNegatives)$' -count=1 -v`; expected forward/no-op/rollback control and all 30 denials PASS, no source fallback for explicit downloaded selectors. +7. Run exact Go 1.26.8 vet and `golangci-lint run --new-from-rev=origin/main`; expected exit 0. Cross-platform builds, module tidy diffs stable. Commit only Task 2 owning files. Rollback: reviewed dependency revert/rebuild/runtime smoke, then hold release because vulnerabilities return. + +### Task 3: Patch UI Parsing And Integrated Verification + +Requirements: S2, S4, S5. Files: `ui/package-lock.json`; create `ui/src/utils/yamlSecurity.test.ts`; design/review/progress evidence docs for this plan. `ui/package.json` changes only if the existing compatible range genuinely cannot resolve a target; otherwise preserve it byte-for-byte. + +1. Add bounded real-parser tests: old js-yaml 4.2.0 must fail a merge-budget rejection assertion; actual imported `@gocodealone/workflow-editor/utils` `parseYaml` must parse a valid parametric Workflow config, reject malformed syntax and reject the hostile merge input through its real default-budget path. Do not mock parser or editor export. Run focused Vitest against old installed dependencies; retain RED attributable to actual parser. +2. Target only vulnerable resolutions within existing compatible ranges: js-yaml >=4.3.2, nanoid 3.x >=3.3.18, undici 7.x >=7.29.1, Babel core >=7.29.6, browserslist >=4.28.7, baseline-browser-mapping >=2.11.0, postcss 8.x >=8.5.23, humanfs/node 0.16.x >=0.16.8, vitest and its mocker 4.1.x >=4.1.11. Preserve existing overrides, direct manifest, unrelated npm graph and ecommerce e2e lock. Use npm resolver, not JSON string surgery. If peer alignment requires an additional resolution, justify exact causality in evidence. +3. `npm ci`, `npm test -- --run`, `npm run build` in ui: expected focused regression and complete suite PASS, tsc/Vite exit 0. Existing UI lint baseline may be measured separately; no unrelated UI refactor. Audit exact installed lock versions/paths; no vulnerable duplicate resolution of targeted families remains. Bundled editor 0.2.0 failure is a separate owning-library prerequisite: consume its independently reviewed compatible patch through the existing range before GREEN, never weaken the consumer assertion. +4. Run upstream OSV action container pinned to verified index `sha256:71ad04ab2f8798be47870f9b18817ad317c2f8f2f97aa6726ba10d5578bc174a` with its unchanged entrypoint, `scan source --format=json --output-file=/evidence/results.json -r --allow-no-lockfiles ./`. Bind `/evidence` to a private outside-checkout directory, never inside scanned root; retain scanner version, image identity, successful native-analysis log/classification JSON for all owning modules. No ignores, environment exception or trust changes. Module-only findings are not clean reachability claims. +5. Independently outside the production/scanned checkout, create one minimal real module calling a known vulnerable API at its vulnerable version. Same scanner/tool must identify called vulnerability; `/root/osv-reporter --new= --fail-on-vuln=true` must reject it. This is a labeled scanner positive-control, never an application demo. Errors/incomplete analysis cannot count as vulnerability rejection. Remove only owned control resources. +6. Run existing positive/mutation policy suite with unchanged policy files, root/full cold Linux race/coverage (Task 1), actual HTTP/SDK/Docker/registry proof (Task 2), UI tests/build. `git diff 49e18034 -- .github scripts` must be empty. Retain existing scanner-CI limitation explicitly; source-only proof cannot close Signal Task 35 or publish a tag. +7. Commit lock/regression files and bounded evidence. Request one independent spec/code review, fix real findings, push exact head and open the sole planned PR. Require all required PR checks green; monitor without repeated timeout retries. Merge under standing user approval, do post-merge retro and verify merged main. Remaining scanner-rollout/release work continues separately. Rollback: dependency/regression revert and rebuilt UI, known-vulnerability hold reinstated. + +## Integration Matrix + +| Integration | Class | Executable Proof | +|---|---|---| +| compiler + server | runtime-integrated | Task 2 actual artifact metadata, YAML startup and HTTP 200 | +| wfctl + SDK/composites/custody | runtime-integrated | Tasks 1/2 complete real host matrices | +| wfctl + Docker | runtime-integrated | Task 2 actual digest-pinned strict sandbox and cleanup | +| wfctl + registry/Git | runtime-integrated | Task 2 Linux default-API control and 30 exact denials | +| UI + editor/js-yaml | runtime-integrated | Task 3 real imports, parser RED/GREEN and UI build | +| upstream OSV + Go loader/reporter | runtime-integrated | Task 3 successful analysis plus called control rejection | +| current public CI policy | config-only | Task 3 unchanged bytes plus existing positive/mutation suite | +| scanner CI/release/Signal promotion | separate | approved CI reconciliation; existing Signal manifest not completed here | + +## Execution Order And Ownership + +Task 1 helper and Task 3 UI writes are independent; Task 2 module writes must settle before broad Go builds. Lead owns module/docs/integration verification; workers own disjoint cache or UI files, no git authority. Full scenario/shared-state tests and Docker matrix execute sequentially. Cold Linux race gate is measured once after dependency/cache stabilization, not during competing builds. On A1 failure, record actual elapsed evidence/backport; no silent timeout increase. + +## Alignment + +PASS after bounded plan-review corrections. S1 -> Task 2, S2 -> Task 3, S3 -> Task 1, S4 -> Tasks 1/2/3, S5 -> Tasks 2/3. Reverse trace: Task 1 -> S3/S4; Task 2 -> S1/S4/S5; Task 3 -> S2/S4/S5. All three task headings exist and ship only PR 1. Protected-file exclusions, policytool native proof and rollback are explicit; no workflow/trust/release task is orphaned or silently added. Programmatic strict manifest check PASS. + +Amendment alignment PASS after bounded P1/P2 proof corrections: S1/S6 -> Task2; S4 exact new compiler -> Task2A-D +and historical Task1/3 cases rerun. Task1 -> S3/S4, Task2 -> S1/S4/S5/S6, +Task3 -> S2/S4/S5. Three tasks/one existing PR preserved; no protected CI writes. + +ADR0058 bounded alignment PASS: observed generated bootstrap/strict StringValue +failures map to Task2C and its added owning files; strict negative/ordinary +message compatibility plus actual app/plugin runtime proof are explicit. +Three tasks/one existing PR retained. Independent reviewer Ramanujan approved +causal correction and checked ownership/coverage; strict manifest check passed. + +ADR0059 bounded alignment PASS: real default-config startup failure maps to +Task2C and the two added YAML owners, existing README opt-in notes, real default +registry assertions and generated API runtime gates. Forward/reverse trace +and strict three-task/one-PR manifest check passed; independent Ramanujan +confirmed the narrow coverage. Protected exclusions unchanged. + +ADR0060 inline alignment PASS: health path/service correction -> Task2C; +Task2 owning YAML/default runtime proof -> S6/S4 and the observed design backport. +S1/S3/S2 and Tasks1/3 retain their existing coverage. All tasks still ship the +sole existing PR; strict manifest check passed with no missing task, count +change, new health API or protected-file ownership. + +ADR0061 inline alignment PASS: maintained MCP/e-commerce/default-doc omissions +map to S6 and Task2A-D plus their named owning files. Task2 remains the sole +source PR row; Tasks1/3 and all other requirements retain coverage. Three +tasks/one existing PR and protected exclusions unchanged. No added MCP feature +or unverified image tag; strict manifest check required before execution. + +ADR0062 inline alignment PASS: init expectation correction -> Task2/S6/S4; +version final-line test boundary -> existing Task1/2/S4 ownership. Reverse trace +adds no product behavior, task, PR, dependency or protected-file change. +Three tasks/one existing PR retained; verify the unchanged manifest hash. + +Rate-fixture inline alignment PASS: observed real cold failure -> Task2/S4 +full-suite acceptance; test-only owning file and RED/GREEN/reversal -> same +runtime proof, no new API, task, PR, timeout or protected-file ownership. + +### Observed Overlay-Control Backport + +Task2/S4 already owns `cmd/wfctl/fixture_build_artifacts_contract_test.go`. +The native Go1.27.2 race run failed only its real-overlay mutation case: +Darwin logical /var source paths did not match Go's physical /private/var +working directory. Matched raw-Go controls exclude the fixture cache and +prove both requested asset values with a canonical source key. Resolve only +that overlay source key with `filepath.EvalSymlinks`; preserve the raw command, +both output assertions and exact2-build/0-hit/2-bypass counts. Retain the actual +RED and causal receipt, then rerun the real-overlay and all fixture controls +with the same compiler/race/deadlines. Final Linux/runtime/CI gates remain due. +Three tasks/one PR, owning files, protected exclusions and scope lock unchanged. + + +### Backport 2026-10-16: Recover snapshot acceptance through existing source PR1022 (ADR0198) + +Actual Task34/PR1073 is normally merged as main `3c5aa969` (reviewed tree `a0ebe8a9`, parent `aee545f5`). All13 actual-main CI jobs and the four strict checks pass, including153 uncached packages/57 critical parents, realCLI1272/liveDocker4.99s and wfctl578.623s. Its separate automatic snapshot38889204283 attempt1 genuinely FAILS: `go test -race ./...` reaches the unchanged600-second aggregate wfctl package alarm at600.221s while MissingLdflag has run1s;152 other packages pass, image/release jobs SKIP. The active one-second build is not proved hung. Preserve the complete failed log and all historical receipts. Existing source-host reuse in the already approved three-task/one-PR1022 lane is a recovery candidate, not a proved fix or a new task. + +| ID | Effective requirement | Existing boundary | +|---|---|---| +| SR1 | Preserve all36 compiler task IDs/branches/PRs, Task34's shipped four-map-only scope, source1022's existing3tasks/1PR/owners and the actual shipping order34→1022. No task, owner, PR grouping, shipped feature or Scope Manifest changes; all17 workspace locks and the source-plan lock remain byte-identical. Task35 remains conditional UNPERFORMED/open because the unchanged harness passes. | Governance/preservation | +| SR2 | Task34 remains unaccepted after its failed snapshot; mainCI PASS never substitutes for snapshot PASS and no original run is relabeled. Record Main1 failure reviews/counters before recovery. Allow only the existing source1022 lane to integrate the engineering-integrated actualmain3c5aa969 through its normal merge under ADR0063 while forward Task34 acceptance remains pending. This supersedes only the accepted-predecessor timing in SF1/RR1/IQ8 and sourceTask2 step1 for this recovery; it does not change which task ships in which PR or accept Task34/runtime. | Existing source1022 preparation | +| SR3 | Compose the already-owned Task1 source race-host reuse with accepted fixtureBuildKey/compiler/config/source identity and context-aware exclusive copy; retain all cache bypass/error/cancellation/cleanup controls and inherited SDK/Docker/registry/capability behavior. Retain existing Task2 Go1.27.2/x/net0.60/generated/runtime/module/default repairs and Task3 UI parsing scope. Reconcile only existing source owners against the recorded actual integration base; all protected .github/scripts/policytool/H/maps bytes must equal that base. No speculative cache efficacy or transferred historical1.27.1 proof. | Existing3tasks/1PR1022 | +| SR4 | Preserve source1022's exact-head focused/full native/default600 budget, generated app/plugin/realhost/UI/maintained-image and ordinary current security/review/protection requirements. Its publication/integration uses the existing PR and ordinary protected checks; actual corrected-main native and unchanged600 snapshot tests/release/image provenance plus final reviews must genuinely succeed before source acceptance. No timeout/race/assertion weakening, manual tag/image/release, blind rerun, private Go cache, extra clone or deployment. | Source1022 verification/integration | +| SR5 | Only after source1022 is genuinely accepted, perform a fresh Task34 Main2 forward reevaluation on that corrected accepted descendant. Prove Task34 H/fourmaps/realized context unchanged and classify every intervening source delta under the approved3/1 source owners; all other bytes/modes remain exact. Join genuine corrected-main/native/snapshot/security/protection evidence and two fresh final reviews before Task34 forward acceptance. Preserve originalMain1 snapshotFAIL and every counter/seal; no retroactivePASS or whole-planComplete. | Task34 forward acceptance | +| SR6 | Existing named34 same-known nonrequired OSV timing still expires at reviewed source1022 integration; source1022 retains its own ordinary current security obligation and no extension/Task35 inheritance is added. Preserve actual full finding/error/alias/risk assessment, CodeQL/Quality/required protections and UNKNOWN/AnalysisComplete=false/SecurityClean=false while incomplete. No scanner framework/upstream env-policy change, setting/credential/runner/deploy authority is added. | Security/runtime boundary | + +Forward: SR1→all36/source3/1/locks;SR2→Task34 failure and sourceTask2 integration timing;SR3–SR4→existing sourceTasks1–3;SR5→fresh Task34Main2;SR6→both current security/unchanged expiry. Reverse: Task34 four-map source→unchanged SF5; Task34 acceptance→SR2/SR5 plus unchanged real gates; sourceTasks1–3→ADR0063 andSR2–SR4/SR6; Task35→unchangedSF6; runtime/issuer/releasedLinuxCLI/Compute identities-worker-quietwindow→unchanged obligations. This is a bug/assumption design backport under existing approved source work: PR34 has already shipped before PR1022, and their task grouping/shipped scope is unchanged. Two independent scope-first/all15 governance reviews and full36+source3 alignment precede canonical apply; verify existing locks without relocking. + + +### Backport 2026-10-16: Preserve current accepted integration dependencies and compiler dispatch + +The SR2 normal merge records engineering-integrated main `3c5aa969` as the comparison base. Its owning module graphs already select OTel1.47.0/otelhttp0.70.0 and newer accepted schema/protobuf/genproto companions; its UI already selects js-yaml4.3.2/Vitest5.0.3/source-map-js1.2.2. Preserve those exact accepted versions and graph classifications instead of restoring the source branch's older1.45/4.x graph. Start the thirteen owning modules and their existing checksum files from that accepted base, then use native structured `go mod edit` for only the existing Go1.27.2 floor and x/net0.60.0 requirements, followed by native targeted tidy and complete graph-delta review. No unrelated upgrade, checksum text edit or protected policytool change. Any genuine companion correction must be evidence-backed and reviewed. Older literal1.45/source UI counts are historical proof details; final metadata/runtime expectations bind the inherited accepted1.47 graph and actual current UI suite. + +Preserve the accepted invoking-compiler dispatch and `GOTOOLCHAIN=local` registry environment, actual built-CLI metadata rejection and startup/PATH controls. The outer exact source verifier runs native1.27.2; it must not restore downloaded registry compiler selection or remove current main controls. In the already-owned fixture contract, update only normal fixed1.27.1 selection/observation expectations to1.27.2, preserve every deliberate old-compiler/floor variant and current startup/discovery/registry controls, and retain the source-owned physical overlay key fix. SourceTask1 remains source `.` plus race only, with complete accepted fixtureBuildKey, exclusive context-aware copy and both cache cleanups; capability/SDK/Docker/registry cache expansion remains excluded. + +This is an accepted-baseline integration clarification within the same three tasks, one PR1022 and existing module/UI/fixture/document owners. It changes no manifest, lock, task/PR grouping, API, timeout or security gate. All historical failure/review counters remain, actual current-head/generated/runtime/Linux default600/UI/image/security/main/snapshot/final proof remains due, and Task34 remains unaccepted under SR1–SR6. + + +### Backport 2026-10-16: Retain the already-approved editor security resolution + +Actual source3 owning CI38895629738/UI job116955296201 fails1/141 cases: the real imported editor parseYaml accepts the above-budget hostile merge, while direct js-yaml.load rejects it. Whole main-lock preservation had restored editor0.2.0 and dropped this source branch's existing0.2.1 correction. Root js-yaml4.3.2 alone does not establish the separately bundled editor parser's budget. Preserve original failure/log/source3 seals; no weakened or removed parser assertion. + +Existing Task3 already owns the compatible lock resolution. Native npm metadata resolution restores exactly the original source81b9 editor0.2.1 package object within unchanged manifest^0.2.0; every other package/root object remains exact, including accepted Vitest5/rootjsYaml4.3.2/source-map-js1.2.2. This narrowly corrects the earlier accepted-baseline UI-graph preservation note. No new editor release/repository source, package manifest edit, task/PR/owner/Scope Manifest or lock change. Resolver uses ignore-scripts/package-lock-only and installs no node_modules; its Node25 version is metadata tooling, not Node24 runtime proof. + +Installed original0.2.1 artifact statically includes default10000 merge-work accounting and the original source resolution is supporting evidence only. Fresh exact-source review and real Node24 focused/full UI141/build plus all ordinary current CI/security/runtime/main/snapshot/final gates remain due. Source4 review has not started and tests/builds are HELD for Tina after the source3 four-command batch released the local heavy slot. Do not blind-rerun b436, transfer historical1.27.1/older-Vitest proof, accept source1022/Task34 or infer the snapshot600 cause. All existing review counters and source3 M1 cancellation-delay limits remain. + + +### Backport 2026-10-16: Offline Generated-App Production Graph + +The original natural source3 run38895629738/native116955501479 failed both embedded/external `TestBuildBinaryStep_DryRun_GeneratedMainHTTPRuntime` variants before compilation: forced-offline `go mod tidy` loads dependency test graphs not provisioned by the owning source module's download/test. Preserve the complete failed producer log,82 proxy-off denials and both post-seal Important review supplements. This is a test dependency-resolution assumption defect; no generated-app runtime failure was reached or proved. + +Existing Task2 already owns this runtime test. Keep the exact three emitted files, default factory/Execute without a Go override, explicit source-only Workflow replacement, invoking native compiler and all HTTP identity/SIGTERM/endpoint-absence assertions in both modes. Seed only committed owning go.sum metadata into the disposable generated module; build its production graph with explicit `-mod=mod` under unchanged GOWORKoff/GOTOOLCHAINlocal/GOPROXYoff/GOSUMDBoff/CGO0. Do not preload dependency test modules, add a clone/private Go cache, enable network, suppress an error or reuse a prebuilt artifact. Add an independent literal1.27.2 assertion to the actual emitted module. This bounded runtime harness no longer invokes dependency-test-graph tidy; ordinary13-owning-module tidy and the separate generated-app/plugin native tidy integration proofs remain mandatory. No production emitter, dependency graph, task/PR/owner/manifest, lock, protected file, assertion or deadline changes. + +Fresh exact Node24.21.0 install, real-parser10/fullUI141 tests, build and lint now PASS on the already-reviewed editor0.2.1 resolution with accepted Vitest5.0.3/js-yaml4.3.2 preserved. Keep original UI140PASS1FAIL as failed historical evidence. Source5 continues round5/max5 with both Source4 static seals and new Important native supplements preserved; final full-source independent review follows meaningful actual offline HTTP/lifecycle validation, scoped vet/lint and source preservation checks. + +Source3 wfctl604.441s genuinely passed the actual900s CI alarm and exceeded the separate600s functional acceptance target by4.441s. Proportionate log assessment separates that timing gap from the concrete module-resolution failure and advisory benchmark. Do not treat a benchmark as a blocker or infer an individual hang/cache cause; no additional cache scope, assertion weakening, alarm increase or blind prior-head rerun. The corrected source's natural native run and genuine unchanged600 snapshot/acceptance must establish their own results. Source1022/Task34/runtime remain unaccepted until their ordinary current gates succeed; named34 security timing expiry and retired scanner-framework disposition remain unchanged. diff --git a/docs/plans/2026-10-03-release-security-source.md.scope-lock b/docs/plans/2026-10-03-release-security-source.md.scope-lock new file mode 100644 index 00000000..567d304f --- /dev/null +++ b/docs/plans/2026-10-03-release-security-source.md.scope-lock @@ -0,0 +1 @@ +dd5be46372d32f28946f0c180987343fbfc67a6fcd8c9b4e8dec813beb102c16 diff --git a/docs/tutorials/build-deploy-pipeline.md b/docs/tutorials/build-deploy-pipeline.md index d828acd6..493baec2 100644 --- a/docs/tutorials/build-deploy-pipeline.md +++ b/docs/tutorials/build-deploy-pipeline.md @@ -240,7 +240,7 @@ ci: - id: goprivate_token env: GOPRIVATE_TOKEN build_args: - BASE_IMAGE: golang:1.26-alpine + BASE_IMAGE: golang:1.27.2-alpine platforms: [linux/amd64, linux/arm64] push_to: [docr] ``` @@ -250,7 +250,7 @@ ci: ```sh WFCTL_BUILD_DRY_RUN=1 wfctl build image --config infra.yaml # [dry-run] docker build --file docker/api.Dockerfile --platform linux/amd64,linux/arm64 -# --secret id=goprivate_token,env=GOPRIVATE_TOKEN --build-arg BASE_IMAGE=golang:1.26-alpine . +# --secret id=goprivate_token,env=GOPRIVATE_TOKEN --build-arg BASE_IMAGE=golang:1.27.2-alpine . ``` ### Common pitfalls diff --git a/docs/tutorials/building-apps-with-workflow.md b/docs/tutorials/building-apps-with-workflow.md index 736fb396..0effde34 100644 --- a/docs/tutorials/building-apps-with-workflow.md +++ b/docs/tutorials/building-apps-with-workflow.md @@ -4,7 +4,7 @@ A hands-on tutorial for developers who want to build real applications using the Throughout this guide, the [Chat Platform example](../../example/chat-platform/) serves as the reference architecture. It is a production-grade mental health support platform built entirely from YAML configuration and dynamic Go components -- no custom server code required. -**Prerequisites**: Go 1.26.5+, the workflow server binary, and a text editor. +**Prerequisites**: Go 1.27.2+, the workflow server binary, and a text editor. --- @@ -63,7 +63,7 @@ It is not a good fit for: ### Prerequisites -1. **Go 1.26.5+** installed on your machine +1. **Go 1.27.2+** installed on your machine 2. **The workflow repository** cloned and built: ```bash @@ -2493,7 +2493,7 @@ spec: Create a `Dockerfile`: ```dockerfile -FROM golang:1.26-alpine AS builder +FROM golang:1.27.2-alpine AS builder WORKDIR /build COPY go.mod go.sum ./ RUN go mod download diff --git a/docs/tutorials/deploy-pipeline.md b/docs/tutorials/deploy-pipeline.md index f86c7eee..34c9c59c 100644 --- a/docs/tutorials/deploy-pipeline.md +++ b/docs/tutorials/deploy-pipeline.md @@ -2,7 +2,7 @@ This tutorial walks you through building a production-grade deploy pipeline using `wfctl` and workflow's multi-env infrastructure support. By the end you'll have a single `infra.yaml` that describes staging and prod, a GitHub Actions pipeline that auto-promotes from staging to prod after a health check, and zero manual secret setup thanks to `wfctl infra bootstrap`. -**Requires:** `wfctl` v0.11.0+, Go 1.26+. Examples use DigitalOcean — substitute your provider where needed. +**Requires:** `wfctl` v0.11.0+, Go 1.27.2+. Examples use DigitalOcean — substitute your provider where needed. **See also:** [CLI Reference](../WFCTL.md) · [Deployment Guide](../DEPLOYMENT_GUIDE.md) @@ -392,7 +392,7 @@ Insert a `build-image` job between `build-test` and the deploy jobs. This compil - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - uses: digitalocean/action-doctl@3cb3953159719656269e044e0e24ca16dd2a690f # v2.5.2 with: token: ${{ secrets.DIGITALOCEAN_TOKEN }} diff --git a/docs/tutorials/getting-started.md b/docs/tutorials/getting-started.md index e3e2933c..daf55f48 100644 --- a/docs/tutorials/getting-started.md +++ b/docs/tutorials/getting-started.md @@ -2,7 +2,7 @@ ## Prerequisites -- Go 1.26+ +- Go 1.27.2+ - Git ## Quick Start diff --git a/e2e_middleware_negative_test.go b/e2e_middleware_negative_test.go index 59425d4d..9f46a6c7 100644 --- a/e2e_middleware_negative_test.go +++ b/e2e_middleware_negative_test.go @@ -340,17 +340,16 @@ func TestE2E_Negative_RateLimit_PerClientIsolation(t *testing.T) { // TestE2E_Negative_RateLimit_RecoveryAfterWindow proves that rate limiting tokens // actually refill over time. If the rate limiter permanently blocked clients after -// burst exhaustion, this test would fail. A very high requestsPerMinute ensures -// tokens refill quickly so the test doesn't have to wait long. +// burst exhaustion, this test would fail. The refill interval tolerates client +// scheduling between requests on a cold race-instrumented host. func TestE2E_Negative_RateLimit_RecoveryAfterWindow(t *testing.T) { port := getFreePort(t) addr := fmt.Sprintf(":%d", port) baseURL := fmt.Sprintf("http://127.0.0.1:%d", port) burstSize := 2 - // 6000 requests/minute = 100 requests/second = 1 token per 10ms - // After 50ms, we should have ~5 tokens refilled - highRPM := 6000 + requestsPerMinute := 60 + refillInterval := time.Minute / time.Duration(requestsPerMinute) cfg := &config.WorkflowConfig{ Modules: []config.ModuleConfig{ @@ -358,7 +357,7 @@ func TestE2E_Negative_RateLimit_RecoveryAfterWindow(t *testing.T) { {Name: "rlr-router", Type: "http.router", DependsOn: []string{"rlr-server"}}, {Name: "rlr-handler", Type: "http.handler", DependsOn: []string{"rlr-router"}, Config: map[string]any{"contentType": "application/json"}}, {Name: "rlr-mw", Type: "http.middleware.ratelimit", Config: map[string]any{ - "requestsPerMinute": float64(highRPM), + "requestsPerMinute": float64(requestsPerMinute), "burstSize": float64(burstSize), }}, }, @@ -417,6 +416,8 @@ func TestE2E_Negative_RateLimit_RecoveryAfterWindow(t *testing.T) { t.Run("verify_429_after_exhaustion", func(t *testing.T) { t.Helper() t.Log("Confirm rate limit is active") + // Requests can take longer than 10ms on a cold race-instrumented host. + time.Sleep(25 * time.Millisecond) resp, err := client.Get(baseURL + "/api/recover") if err != nil { t.Fatalf("Request failed: %v", err) @@ -433,12 +434,7 @@ func TestE2E_Negative_RateLimit_RecoveryAfterWindow(t *testing.T) { t.Helper() t.Log("Waiting for token refill then retrying") - // With 6000 RPM, that is 100 per second. The refill logic: - // elapsed = time.Since(lastTimestamp).Minutes() - // tokensToAdd = int(elapsed * requestsPerMinute) - // For 1 token: elapsed >= 1/6000 minutes = 0.01 seconds = 10ms - // Wait 100ms to be safe and get at least 1 token back - time.Sleep(100 * time.Millisecond) + time.Sleep(refillInterval + 100*time.Millisecond) resp, err := client.Get(baseURL + "/api/recover") if err != nil { @@ -459,6 +455,9 @@ func TestE2E_Negative_RateLimit_RecoveryAfterWindow(t *testing.T) { if result["status"] != "success" { t.Errorf("Expected status='success' in recovery response, got %v", result["status"]) } + if result["handler"] != "rlr-handler" { + t.Errorf("Expected configured recovery handler, got %v", result["handler"]) + } t.Logf("Recovery verified: got 200 with body %s", string(body)) }) } diff --git a/example/ecommerce-app/Dockerfile b/example/ecommerce-app/Dockerfile index b1d15321..1f78c5c2 100644 --- a/example/ecommerce-app/Dockerfile +++ b/example/ecommerce-app/Dockerfile @@ -2,7 +2,7 @@ # Build: docker build -t workflow-store -f example/ecommerce-app/Dockerfile . # Run: docker run -p 8080:8080 -e JWT_SECRET=your-secret workflow-store -FROM dhi.io/golang:1.26-alpine3.22-dev AS builder +FROM dhi.io/golang:1.27.2-alpine3.23-dev AS builder WORKDIR /build diff --git a/example/go.mod b/example/go.mod index 1d4e8a6d..9368ec39 100644 --- a/example/go.mod +++ b/example/go.mod @@ -1,6 +1,6 @@ module example -go 1.26.5 +go 1.27.2 replace github.com/GoCodeAlone/workflow => ../ @@ -186,7 +186,7 @@ require ( golang.org/x/arch v0.28.0 // indirect golang.org/x/crypto v0.57.0 // indirect golang.org/x/mod v0.41.0 // indirect - golang.org/x/net v0.59.0 // indirect + golang.org/x/net v0.60.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.23.0 // indirect golang.org/x/sys v0.48.0 // indirect diff --git a/example/go.sum b/example/go.sum index d42a162d..67c367de 100644 --- a/example/go.sum +++ b/example/go.sum @@ -643,8 +643,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= diff --git a/go.mod b/go.mod index 6bd435be..f367429e 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/GoCodeAlone/workflow -go 1.26.5 +go 1.27.2 require ( charm.land/bubbles/v2 v2.1.1 @@ -21,6 +21,7 @@ require ( github.com/expr-lang/expr v1.17.8 github.com/fsnotify/fsnotify v1.10.1 github.com/github/copilot-sdk/go v0.3.0 + github.com/go-openapi/jsonpointer v1.0.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/uuid v1.6.0 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 @@ -53,8 +54,10 @@ require ( go.opentelemetry.io/otel/trace v1.47.0 golang.org/x/crypto v0.57.0 golang.org/x/mod v0.41.0 + golang.org/x/net v0.60.0 golang.org/x/oauth2 v0.36.0 golang.org/x/sync v0.23.0 + golang.org/x/sys v0.48.0 golang.org/x/text v0.42.0 golang.org/x/time v0.15.0 golang.org/x/tools v0.49.0 @@ -68,11 +71,6 @@ require ( modernc.org/sqlite v1.53.0 ) -require ( - github.com/go-openapi/swag/pools v0.28.0 // indirect - go.opentelemetry.io/otel/log v1.47.0 // indirect -) - require ( github.com/BurntSushi/toml v1.6.0 // indirect github.com/DataDog/datadog-go/v5 v5.8.3 // indirect @@ -133,7 +131,6 @@ require ( github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect - github.com/go-openapi/jsonpointer v1.0.0 github.com/go-openapi/jsonreference v1.0.0 // indirect github.com/go-openapi/swag v0.28.0 // indirect github.com/go-openapi/swag/cmdutils v0.28.0 // indirect @@ -143,6 +140,7 @@ require ( github.com/go-openapi/swag/loading v0.28.0 // indirect github.com/go-openapi/swag/mangling v0.28.0 // indirect github.com/go-openapi/swag/netutils v0.28.0 // indirect + github.com/go-openapi/swag/pools v0.28.0 // indirect github.com/go-openapi/swag/stringutils v0.28.0 // indirect github.com/go-openapi/swag/typeutils v0.28.0 // indirect github.com/go-openapi/swag/yamlutils v0.28.0 // indirect @@ -247,6 +245,7 @@ require ( go.mongodb.org/mongo-driver v1.17.9 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.47.0 // indirect + go.opentelemetry.io/otel/log v1.47.0 // indirect go.opentelemetry.io/otel/metric v1.47.0 // indirect go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.uber.org/atomic v1.11.0 // indirect @@ -256,8 +255,6 @@ require ( go.yaml.in/yaml/v3 v3.0.5 // indirect go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect golang.org/x/arch v0.28.0 // indirect - golang.org/x/net v0.59.0 - golang.org/x/sys v0.48.0 golang.org/x/term v0.46.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect diff --git a/go.sum b/go.sum index 2932ed19..5530d591 100644 --- a/go.sum +++ b/go.sum @@ -772,8 +772,8 @@ golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96b golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= -golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= +golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= +golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= diff --git a/mcp/wfctl_tools.go b/mcp/wfctl_tools.go index 81f2bf48..84e143cb 100644 --- a/mcp/wfctl_tools.go +++ b/mcp/wfctl_tools.go @@ -1714,7 +1714,7 @@ func mcpGenerateCDWorkflow(features *mcpProjectFeatures, registry, platforms str fmt.Fprintf(&b, " - uses: %s\n", mcpGithubActionsCheckoutRef) fmt.Fprintf(&b, " - uses: %s\n", mcpGithubActionsSetupGoRef) b.WriteString(" with:\n") - b.WriteString(" go-version: '1.26.5'\n") + b.WriteString(" go-version: '1.27.2'\n") if features.HasUI { fmt.Fprintf(&b, " - uses: %s\n", mcpGithubActionsSetupNodeRef) @@ -1917,7 +1917,7 @@ jobs: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: - go-version: '1.26.5' + go-version: '1.27.2' - name: Build plugin binaries run: | mkdir -p dist diff --git a/mcp/wfctl_tools_test.go b/mcp/wfctl_tools_test.go index f600d86e..474f94ae 100644 --- a/mcp/wfctl_tools_test.go +++ b/mcp/wfctl_tools_test.go @@ -3,7 +3,10 @@ package mcp import ( "context" "encoding/json" + "strings" "testing" + + "gopkg.in/yaml.v3" ) // --- Test YAML fixtures --- @@ -821,6 +824,7 @@ func TestGenerateGithubActions(t *testing.T) { if !contains(cdYAML, "name: CD") { t.Error("CD workflow should have name") } + assertMCPWorkflowGoVersion(t, cdYAML) features, _ := data["features"].(map[string]any) if features == nil { @@ -842,6 +846,41 @@ func TestGenerateGithubActions(t *testing.T) { } } +func TestMCPGenerateReleaseWorkflowGoVersion(t *testing.T) { + assertMCPWorkflowGoVersion(t, mcpGenerateReleaseWorkflow()) +} + +func assertMCPWorkflowGoVersion(t *testing.T, content string) { + t.Helper() + var workflow struct { + Jobs map[string]struct { + Steps []struct { + Uses string `yaml:"uses"` + With struct { + GoVersion string `yaml:"go-version"` + } `yaml:"with"` + } `yaml:"steps"` + } `yaml:"jobs"` + } + if err := yaml.Unmarshal([]byte(content), &workflow); err != nil { + t.Fatalf("parse MCP workflow output: %v", err) + } + found := false + for jobName, job := range workflow.Jobs { + for _, step := range job.Steps { + if strings.HasPrefix(step.Uses, "actions/setup-go@") { + found = true + if step.With.GoVersion != "1.27.2" { + t.Errorf("MCP job %s Go version = %q, want 1.27.2", jobName, step.With.GoVersion) + } + } + } + } + if !found { + t.Error("MCP workflow has no setup-go step") + } +} + func TestGenerateGithubActions_WithAuth(t *testing.T) { srv := NewServer("") req := makeCallToolRequest(map[string]any{ diff --git a/module/pipeline_step_build_binary.go b/module/pipeline_step_build_binary.go index 86c75f5e..68cd9564 100644 --- a/module/pipeline_step_build_binary.go +++ b/module/pipeline_step_build_binary.go @@ -68,7 +68,7 @@ func NewBuildBinaryStepFactory() StepFactory { goVersion, _ := config["go_version"].(string) if goVersion == "" { - goVersion = "1.22" + goVersion = "1.27.2" } dryRun, _ := config["dry_run"].(bool) @@ -213,9 +213,10 @@ func (s *BuildBinaryStep) generateMainGo() string { sb.WriteString("\t\"os/signal\"\n") sb.WriteString("\t\"syscall\"\n") sb.WriteString("\n") - sb.WriteString("\t\"github.com/GoCodeAlone/modular\"\n") sb.WriteString("\tworkflow \"github.com/GoCodeAlone/workflow\"\n") sb.WriteString("\t\"github.com/GoCodeAlone/workflow/config\"\n") + sb.WriteString("\tallplugins \"github.com/GoCodeAlone/workflow/plugins/all\"\n") + sb.WriteString("\t_ \"github.com/GoCodeAlone/workflow/setup\"\n") sb.WriteString(")\n\n") if s.embedConfig { @@ -244,10 +245,12 @@ func (s *BuildBinaryStep) generateMainGo() string { sb.WriteString("\t\tos.Exit(1)\n") sb.WriteString("\t}\n\n") - sb.WriteString("\tapp := modular.NewStdApplication(nil, logger)\n") - sb.WriteString("\tengine := workflow.NewStdEngine(app, logger)\n\n") - - sb.WriteString("\tif err := engine.BuildFromConfig(cfg); err != nil {\n") + sb.WriteString("\tengine, err := workflow.NewEngineBuilder().\n") + sb.WriteString("\t\tWithLogger(logger).\n") + sb.WriteString("\t\tWithAllDefaults().\n") + sb.WriteString("\t\tWithPlugins(allplugins.DefaultPlugins()...).\n") + sb.WriteString("\t\tBuildFromConfig(cfg)\n") + sb.WriteString("\tif err != nil {\n") sb.WriteString("\t\tfmt.Fprintf(os.Stderr, \"build engine: %v\\n\", err)\n") sb.WriteString("\t\tos.Exit(1)\n") sb.WriteString("\t}\n\n") diff --git a/module/pipeline_step_build_binary_test.go b/module/pipeline_step_build_binary_test.go index 450ace5e..e7ff05c2 100644 --- a/module/pipeline_step_build_binary_test.go +++ b/module/pipeline_step_build_binary_test.go @@ -2,12 +2,20 @@ package module import ( "context" + "encoding/json" + "net" + "net/http" "os" "os/exec" "path/filepath" "runtime" "strings" + "syscall" "testing" + "time" + + "github.com/GoCodeAlone/workflow/config" + "gopkg.in/yaml.v3" ) func TestBuildBinaryStep_FactoryRequiresConfigFile(t *testing.T) { @@ -51,14 +59,55 @@ func TestBuildBinaryStep_Defaults(t *testing.T) { if s.modulePath != "app" { t.Errorf("expected default module_path %q, got %q", "app", s.modulePath) } - if s.goVersion != "1.22" { - t.Errorf("expected default go_version %q, got %q", "1.22", s.goVersion) + if s.goVersion != "1.27.2" { + t.Errorf("expected default go_version %q, got %q", "1.27.2", s.goVersion) } if !s.embedConfig { t.Error("expected embed_config to default to true") } } +func TestBuildBinaryStep_DryRun_GoVersions(t *testing.T) { + for _, tc := range []struct { + name string + goVersion *string + want string + }{ + {name: "omitted", want: "1.27.2"}, + {name: "empty", goVersion: new(""), want: "1.27.2"}, + {name: "explicit-older", goVersion: new("1.22"), want: "1.22"}, + {name: "explicit-patch", goVersion: new("1.26.5"), want: "1.26.5"}, + } { + t.Run(tc.name, func(t *testing.T) { + cfg := map[string]any{ + "config_file": writeTempConfig(t, "version: 1\nmodules: []\n"), + "dry_run": true, + } + if tc.goVersion != nil { + cfg["go_version"] = *tc.goVersion + } + step, err := NewBuildBinaryStepFactory()("version-proof", cfg, nil) + if err != nil { + t.Fatalf("create step: %v", err) + } + result, err := step.Execute(t.Context(), &PipelineContext{}) + if err != nil { + t.Fatalf("execute dry run: %v", err) + } + if got := result.Output["go_version"]; got != tc.want { + t.Errorf("go_version = %v, want %s", got, tc.want) + } + contents, ok := result.Output["file_contents"].(map[string]string) + if !ok { + t.Fatalf("file_contents = %T, want map[string]string", result.Output["file_contents"]) + } + if got := contents["go.mod"]; !strings.Contains(got, "\ngo "+tc.want+"\n") { + t.Errorf("go.mod should preserve Go %s, got:\n%s", tc.want, got) + } + }) + } +} + func TestBuildBinaryStep_DryRun_GeneratesGoMod(t *testing.T) { configFile := writeTempConfig(t, "version: 1\nmodules: []\n") @@ -134,6 +183,225 @@ func TestBuildBinaryStep_DryRun_GeneratesMainGo_WithEmbedDirective(t *testing.T) } } +func TestBuildBinaryStep_DryRun_DefaultEngineBuilder(t *testing.T) { + for _, embedConfig := range []bool{true, false} { + name := "external-config" + if embedConfig { + name = "embedded-config" + } + t.Run(name, func(t *testing.T) { + step, err := NewBuildBinaryStepFactory()("defaults-proof", map[string]any{ + "config_file": writeTempConfig(t, "version: 1\nmodules: []\n"), + "embed_config": embedConfig, + "dry_run": true, + }, nil) + if err != nil { + t.Fatalf("create step: %v", err) + } + result, err := step.Execute(t.Context(), &PipelineContext{}) + if err != nil { + t.Fatalf("execute dry run: %v", err) + } + contents, ok := result.Output["file_contents"].(map[string]string) + if !ok { + t.Fatalf("file_contents = %T, want map[string]string", result.Output["file_contents"]) + } + mainGo := contents["main.go"] + for _, want := range []string{ + `_ "github.com/GoCodeAlone/workflow/setup"`, + `allplugins "github.com/GoCodeAlone/workflow/plugins/all"`, + "engine, err := workflow.NewEngineBuilder().\n\t\tWithLogger(logger).\n\t\tWithAllDefaults().\n\t\tWithPlugins(allplugins.DefaultPlugins()...).\n\t\tBuildFromConfig(cfg)", + } { + if !strings.Contains(mainGo, want) { + t.Errorf("generated main must wire real engine defaults: missing %q", want) + } + } + for _, forbidden := range []string{"workflow.NewStdEngine(", `"github.com/GoCodeAlone/modular"`} { + if strings.Contains(mainGo, forbidden) { + t.Errorf("generated main retains bare engine wiring %q", forbidden) + } + } + }) + } +} + +func TestBuildBinaryStep_DryRun_GeneratedMainHTTPRuntime(t *testing.T) { + sourceRoot, err := filepath.Abs("..") + if err != nil { + t.Fatalf("resolve source root: %v", err) + } + sourceSums, err := os.ReadFile(filepath.Join(sourceRoot, "go.sum")) + if err != nil { + t.Fatalf("read source dependency checksums: %v", err) + } + for _, embedConfig := range []bool{true, false} { + name := "external-config" + if embedConfig { + name = "embedded-config" + } + t.Run(name, func(t *testing.T) { + outputDir := t.TempDir() + cfg, err := config.LoadFromFile(filepath.Join(sourceRoot, "example", "api-server-config.yaml")) + if err != nil { + t.Fatalf("load real HTTP example: %v", err) + } + listener, err := net.Listen("tcp", "127.0.0.1:0") + if err != nil { + t.Fatalf("allocate HTTP address: %v", err) + } + address := listener.Addr().String() + if err := listener.Close(); err != nil { + t.Fatalf("release HTTP address: %v", err) + } + identity := "health-" + filepath.Base(filepath.Dir(outputDir)) + for i := range cfg.Modules { + switch cfg.Modules[i].Name { + case "api-http-server": + cfg.Modules[i].Config["address"] = address + case "health-handler": + cfg.Modules[i].Name = identity + } + } + for _, raw := range cfg.Workflows["http"].(map[string]any)["routes"].([]any) { + route := raw.(map[string]any) + if route["handler"] == "health-handler" { + route["handler"] = identity + } + } + configYAML, err := yaml.Marshal(cfg) + if err != nil { + t.Fatalf("parameterize HTTP example: %v", err) + } + step, err := NewBuildBinaryStepFactory()("runtime-proof", map[string]any{ + "config_file": writeTempConfig(t, string(configYAML)), + "embed_config": embedConfig, + "dry_run": true, + }, nil) + if err != nil { + t.Fatalf("create step: %v", err) + } + result, err := step.Execute(t.Context(), &PipelineContext{}) + if err != nil { + t.Fatalf("execute dry run: %v", err) + } + contents, ok := result.Output["file_contents"].(map[string]string) + if !ok || len(contents) != 3 { + t.Fatalf("file_contents = %v, want exactly three emitted files", result.Output["file_contents"]) + } + if !strings.Contains(contents["go.mod"], "\ngo 1.27.2\n") { + t.Fatalf("default emitted go.mod does not select Go 1.27.2:\n%s", contents["go.mod"]) + } + for _, path := range []string{"go.mod", "main.go", "app.yaml"} { + data, ok := contents[path] + if !ok { + t.Fatalf("missing emitted file %s", path) + } + if err := os.WriteFile(filepath.Join(outputDir, path), []byte(data), 0600); err != nil { + t.Fatalf("materialize %s: %v", path, err) + } + } + // Resolve the unreleased source using its committed checksums. Build only + // the app graph offline; tidy would also load dependencies' test graphs, + // which the owning module's normal download/test does not provision. + if err := os.WriteFile(filepath.Join(outputDir, "go.sum"), sourceSums, 0600); err != nil { + t.Fatalf("seed source dependency checksums: %v", err) + } + runGo := func(args ...string) { + t.Helper() + cmd := exec.CommandContext(t.Context(), "go", args...) + cmd.Dir = outputDir + cmd.Env = append(os.Environ(), "GOWORK=off", "GOTOOLCHAIN=local", "GOPROXY=off", "GOSUMDB=off", "CGO_ENABLED=0") + if output, err := cmd.CombinedOutput(); err != nil { + t.Fatalf("native go %v: %v\n%s", args, err, output) + } + } + // The emitter's unreleased dependency is resolved only for this source integration. + runGo("mod", "edit", "-replace=github.com/GoCodeAlone/workflow="+sourceRoot) + binary := filepath.Join(outputDir, "proof-app") + runGo("build", "-mod=mod", "-o", binary, ".") + if info, err := os.Stat(binary); err != nil || info.Size() == 0 { + t.Fatalf("missing or empty compiled generated binary: %v", err) + } + if runtime.GOOS == "windows" { + t.Skip("generated binary compiled; SIGTERM lifecycle requires a POSIX platform") + } + logPath := filepath.Join(outputDir, "runtime.log") + logFile, err := os.Create(logPath) + if err != nil { + t.Fatalf("create runtime log: %v", err) + } + t.Cleanup(func() { _ = logFile.Close() }) + launchCtx, cancel := context.WithTimeout(t.Context(), 30*time.Second) + defer cancel() + cmd := exec.CommandContext(launchCtx, binary) + cmd.Dir = outputDir + cmd.Stdout, cmd.Stderr = logFile, logFile + cmd.WaitDelay = time.Second + if err := cmd.Start(); err != nil { + t.Fatalf("launch generated binary: %v", err) + } + done := make(chan struct{}) + var waitErr error + go func() { + waitErr = cmd.Wait() + close(done) + }() + t.Cleanup(func() { + select { + case <-done: + default: + _ = cmd.Process.Kill() + <-done + } + }) + client := &http.Client{Timeout: time.Second, Transport: &http.Transport{Proxy: nil}} + t.Cleanup(client.CloseIdleConnections) + url := "http://" + address + "/health" + ticker := time.NewTicker(10 * time.Millisecond) + defer ticker.Stop() + readyDeadline := time.NewTimer(10 * time.Second) + defer readyDeadline.Stop() + for { + resp, err := client.Get(url) + if err == nil { + var body map[string]string + decodeErr := json.NewDecoder(resp.Body).Decode(&body) + _ = resp.Body.Close() + if resp.StatusCode != http.StatusOK || decodeErr != nil || body["handler"] != identity || body["status"] != "success" { + t.Fatalf("HTTP proof: status=%d body=%v decode=%v, want owned handler %q", resp.StatusCode, body, decodeErr, identity) + } + break + } + select { + case <-done: + logs, _ := os.ReadFile(logPath) + t.Fatalf("generated binary exited before HTTP readiness: %v\n%s", waitErr, logs) + case <-readyDeadline.C: + t.Fatalf("generated HTTP endpoint not ready: %v", err) + case <-ticker.C: + } + } + if err := cmd.Process.Signal(syscall.SIGTERM); err != nil { + t.Fatalf("signal generated binary: %v", err) + } + select { + case <-done: + logs, _ := os.ReadFile(logPath) + if waitErr != nil { + t.Fatalf("generated binary shutdown: %v\n%s", waitErr, logs) + } + case <-time.After(5 * time.Second): + t.Fatal("generated binary did not shut down gracefully") + } + if resp, err := client.Get(url); err == nil { + _ = resp.Body.Close() + t.Fatal("generated HTTP endpoint remains reachable after shutdown") + } + t.Logf("actual emitted binary: HTTP 200 with handler %q, SIGTERM exit 0, endpoint absent", identity) + }) + } +} + func TestBuildBinaryStep_DryRun_ConfigContentCopied(t *testing.T) { yamlContent := "version: 1\nmodules:\n - name: server\n type: http.server\n" configFile := writeTempConfig(t, yamlContent) diff --git a/plugin/external/convert.go b/plugin/external/convert.go index 91afa6be..14ad67f3 100644 --- a/plugin/external/convert.go +++ b/plugin/external/convert.go @@ -93,7 +93,25 @@ func mapToTypedAnyWithOptions(messageName string, values map[string]any, resolve // plugin to publish a coerce-aware contract or every BMW-style // template author to hand-quote in YAML. values = coerceMapScalars(values, msg.ProtoReflect().Descriptor()) - raw, err := json.Marshal(values) + var jsonValue any = values + if msg.ProtoReflect().Descriptor().FullName() == "google.protobuf.StringValue" { + // Wrapper ProtoJSON is scalar; Workflow step inputs remain field maps. + for key := range values { + if key != "value" { + return nil, fmt.Errorf("unknown field %q for %s", key, messageName) + } + } + value := "" + if rawValue, exists := values["value"]; exists { + var valid bool + value, valid = rawValue.(string) + if !valid { + return nil, fmt.Errorf("%s value must be a string", messageName) + } + } + jsonValue = value + } + raw, err := json.Marshal(jsonValue) if err != nil { return nil, fmt.Errorf("marshal %s input as JSON: %w", messageName, err) } @@ -260,6 +278,13 @@ func typedAnyToMap(payload *anypb.Any, messageName string, resolver protoregistr if err != nil { return nil, fmt.Errorf("marshal %s typed payload as JSON: %w", messageName, err) } + if msg.ProtoReflect().Descriptor().FullName() == "google.protobuf.StringValue" { + var value string + if err := json.Unmarshal(raw, &value); err != nil { + return nil, fmt.Errorf("decode %s typed JSON as string: %w", messageName, err) + } + return map[string]any{"value": value}, nil + } var values map[string]any if err := json.Unmarshal(raw, &values); err != nil { return nil, fmt.Errorf("decode %s typed JSON as map: %w", messageName, err) diff --git a/plugin/external/convert_test.go b/plugin/external/convert_test.go index f314baef..f5b74784 100644 --- a/plugin/external/convert_test.go +++ b/plugin/external/convert_test.go @@ -4,9 +4,84 @@ import ( "reflect" "testing" + "google.golang.org/protobuf/types/known/anypb" "google.golang.org/protobuf/types/known/structpb" + "google.golang.org/protobuf/types/known/wrapperspb" ) +func TestStringValueTypedMapRoundTrip(t *testing.T) { + for _, tc := range []struct { + name string + in map[string]any + want string + }{ + {name: "nil"}, + {name: "empty", in: map[string]any{}}, + {name: "empty-value", in: map[string]any{"value": ""}}, + {name: "value", in: map[string]any{"value": "actual-plugin-input"}, want: "actual-plugin-input"}, + } { + t.Run(tc.name, func(t *testing.T) { + before := make(map[string]any, len(tc.in)) + for k, v := range tc.in { + before[k] = v + } + payload, err := mapToTypedAny("google.protobuf.StringValue", tc.in, nil) + if err != nil { + t.Fatalf("encode StringValue: %v", err) + } + var decoded wrapperspb.StringValue + if err := payload.UnmarshalTo(&decoded); err != nil || decoded.Value != tc.want { + t.Fatalf("typed StringValue = %q, want %q: %v", decoded.Value, tc.want, err) + } + values, err := typedAnyToMap(payload, "google.protobuf.StringValue", nil) + if err != nil || !reflect.DeepEqual(values, map[string]any{"value": tc.want}) { + t.Fatalf("decode StringValue map = %v: %v", values, err) + } + if tc.in != nil && !reflect.DeepEqual(tc.in, before) { + t.Fatal("encoder mutated caller map") + } + }) + } +} + +func TestStringValueTypedMapRejectsInvalidInputs(t *testing.T) { + for _, input := range []map[string]any{ + {"unknown": "value"}, + {"value": "valid", "unknown": "value"}, + {"value": 1}, + {"value": false}, + {"value": nil}, + {"value": map[string]any{"value": "nested"}}, + } { + payload, err := mapToTypedAny("google.protobuf.StringValue", input, nil) + if err == nil || payload != nil { + t.Errorf("invalid StringValue map %v must reject, payload=%v err=%v", input, payload, err) + } + } + wrong, err := anypb.New(wrapperspb.Bool(true)) + if err != nil { + t.Fatal(err) + } + if values, err := typedAnyToMap(wrong, "google.protobuf.StringValue", nil); err == nil || values != nil { + t.Fatalf("wrong Any type must reject: %v %v", values, err) + } +} + +func TestStringValueTypedMapKnownFields(t *testing.T) { + input := map[string]any{"value": "selected", "other_pipeline_state": "retained"} + payload, err := mapToTypedAnyKnownFields("google.protobuf.StringValue", input, nil) + if err != nil { + t.Fatal(err) + } + var value wrapperspb.StringValue + if err := payload.UnmarshalTo(&value); err != nil || value.Value != "selected" { + t.Fatalf("known-field StringValue = %q: %v", value.Value, err) + } + if input["other_pipeline_state"] != "retained" { + t.Fatal("known-field conversion mutated pipeline state") + } +} + // mustMapToStruct is a test helper that wraps mapToStruct and fails the test // if the conversion errors. Use it for fixture data that is known to be // representable by structpb. diff --git a/plugin/sdk/generator.go b/plugin/sdk/generator.go index 4e015785..9ce59e8e 100644 --- a/plugin/sdk/generator.go +++ b/plugin/sdk/generator.go @@ -16,8 +16,8 @@ type TemplateGenerator struct{} const ( workflowReleasedVersion = "v0.18.15" workflowStrictContractsVersion = "v0.19.0-alpha.5" - workflowMinimumGoVersion = "1.26.5" - defaultPluginGoVersion = "1.26.5" + workflowMinimumGoVersion = "1.27.2" + defaultPluginGoVersion = "1.27.2" pluginManifestVersionSentinel = "0.0.0" ) diff --git a/plugin/sdk/generator_test.go b/plugin/sdk/generator_test.go index 84630472..9b302bf7 100644 --- a/plugin/sdk/generator_test.go +++ b/plugin/sdk/generator_test.go @@ -613,24 +613,65 @@ func TestGenerateProjectStructure(t *testing.T) { if !strings.Contains(string(modData), "module github.com/TestOrg/workflow-plugin-my-plugin") { t.Errorf("go.mod module path unexpected: %s", string(modData)) } - if !strings.Contains(string(modData), "go "+workflowMinimumGoVersion) { - t.Errorf("go.mod go version should match workflow minimum %s, got:\n%s", workflowMinimumGoVersion, string(modData)) + if !strings.Contains(string(modData), "\ngo 1.27.2\n") { + t.Errorf("go.mod should use Go 1.27.2, got:\n%s", string(modData)) } ciData, err := os.ReadFile(filepath.Join(outputDir, ".github/workflows/ci.yml")) if err != nil { t.Fatalf("read ci.yml: %v", err) } - if !strings.Contains(string(ciData), "go-version: '"+workflowMinimumGoVersion+"'") { - t.Errorf("ci.yml should use workflow minimum Go %s, got:\n%s", workflowMinimumGoVersion, string(ciData)) + if !strings.Contains(string(ciData), "go-version: '1.27.2'\n") { + t.Errorf("ci.yml should use Go 1.27.2, got:\n%s", string(ciData)) } releaseData, err := os.ReadFile(filepath.Join(outputDir, ".github/workflows/release.yml")) if err != nil { t.Fatalf("read release.yml: %v", err) } - if !strings.Contains(string(releaseData), "go-version: '"+workflowMinimumGoVersion+"'") { - t.Errorf("release.yml should use workflow minimum Go %s, got:\n%s", workflowMinimumGoVersion, string(releaseData)) + if !strings.Contains(string(releaseData), "go-version: '1.27.2'\n") { + t.Errorf("release.yml should use Go 1.27.2, got:\n%s", string(releaseData)) + } +} + +func TestGenerateProjectStructureGoVersions(t *testing.T) { + for _, tc := range []struct { + name string + workflowReplace string + legacyContracts bool + }{ + {name: "strict-local", workflowReplace: t.TempDir()}, + {name: "legacy-local", workflowReplace: t.TempDir(), legacyContracts: true}, + {name: "legacy-released", legacyContracts: true}, + } { + t.Run(tc.name, func(t *testing.T) { + outputDir := t.TempDir() + if err := generateProjectStructure(GenerateOptions{ + Name: "workflow-plugin-go-version-proof", + Author: "TestOrg", + OutputDir: outputDir, + WorkflowReplace: tc.workflowReplace, + LegacyContracts: tc.legacyContracts, + }); err != nil { + t.Fatalf("generate project: %v", err) + } + for _, file := range []struct { + path string + want string + }{ + {path: "go.mod", want: "\ngo 1.27.2\n"}, + {path: ".github/workflows/ci.yml", want: "go-version: '1.27.2'\n"}, + {path: ".github/workflows/release.yml", want: "go-version: '1.27.2'\n"}, + } { + data, err := os.ReadFile(filepath.Join(outputDir, file.path)) + if err != nil { + t.Fatalf("read %s: %v", file.path, err) + } + if !strings.Contains(string(data), file.want) { + t.Errorf("%s missing Go 1.27.2 declaration %q", file.path, file.want) + } + } + }) } } @@ -639,8 +680,8 @@ func TestGenerateGoModWithWorkflowReplace(t *testing.T) { if !strings.Contains(got, "github.com/GoCodeAlone/workflow "+workflowStrictContractsVersion) { t.Fatalf("go.mod should require local-development workflow version, got:\n%s", got) } - if !strings.Contains(got, "go "+workflowMinimumGoVersion) { - t.Fatalf("strict go.mod should use workflow minimum Go version, got:\n%s", got) + if !strings.Contains(got, "\ngo 1.27.2\n") { + t.Fatalf("strict go.mod should use Go 1.27.2, got:\n%s", got) } if !strings.Contains(got, "replace github.com/GoCodeAlone/workflow => /workspace/workflow") { t.Fatalf("go.mod should include workflow replace, got:\n%s", got) @@ -652,8 +693,8 @@ func TestGenerateGoModLegacyWithoutWorkflowReplace(t *testing.T) { if !strings.Contains(got, "github.com/GoCodeAlone/workflow "+workflowReleasedVersion) { t.Fatalf("legacy go.mod should require released workflow version, got:\n%s", got) } - if !strings.Contains(got, "go "+defaultPluginGoVersion) { - t.Fatalf("legacy go.mod should keep default plugin Go version, got:\n%s", got) + if !strings.Contains(got, "\ngo 1.27.2\n") { + t.Fatalf("legacy go.mod should use Go 1.27.2, got:\n%s", got) } } diff --git a/ui/package-lock.json b/ui/package-lock.json index 8140b267..6b9767ec 100644 --- a/ui/package-lock.json +++ b/ui/package-lock.json @@ -761,13 +761,13 @@ } }, "node_modules/@gocodealone/workflow-editor": { - "version": "0.2.0", - "resolved": "https://npm.pkg.github.com/download/@gocodealone/workflow-editor/0.2.0/6a0407820cb9825cd7db3498d75420168078907c", - "integrity": "sha512-sHjf/y3foZmReMVr7P1XMJIgSTIuoszYVW/dQqkLQIVB4PloRhcTLeYEYyLDCzpTEEGBGAaq4GA4cIR9pshiLg==", + "version": "0.2.1", + "resolved": "https://npm.pkg.github.com/download/@gocodealone/workflow-editor/0.2.1/bb5b68f417715bda45fd49f3ecec938baa23a783", + "integrity": "sha512-n9ou4081bH6CvfsvalvJuSnVhLV6Z29n84/ItGs8g2Zw98EkYpEviL9nmJfcM74jmm9R/KjogtGf6g3V4/PiBQ==", "license": "Apache-2.0", "dependencies": { "dagre": "^0.8.5", - "js-yaml": "^4.1.1", + "js-yaml": "^4.3.2", "jszip": "^3.10.1" }, "peerDependencies": { diff --git a/ui/src/utils/yamlSecurity.test.ts b/ui/src/utils/yamlSecurity.test.ts new file mode 100644 index 00000000..af62e23f --- /dev/null +++ b/ui/src/utils/yamlSecurity.test.ts @@ -0,0 +1,67 @@ +import { describe, it, expect } from 'vitest'; +import { load } from 'js-yaml'; +import { parseYaml } from '@gocodealone/workflow-editor/utils'; + +const defaultMergeBudget = 10_000; + +function mergeInput(mergeSources: number): string { + // Empty maps exercise merge-work accounting without expanding output keys. + const mappings = Array.from({ length: mergeSources }, (_, index) => + ` m${index}: {<<: *empty}`, + ).join('\n'); + return `base: &empty {} +modules: [] +workflows: {} +triggers: {} +payload: +${mappings} +`; +} + +describe.each([ + ['js-yaml.load', load], + ['workflow-editor.parseYaml', parseYaml], +] as const)('%s YAML security', (_name, parse) => { + it.each([ + ['tenant-alpha', 'resource-first'], + ['tenant-beta', 'resource-second'], + ])('parses a valid config for %s/%s', (tenant, resource) => { + const moduleName = `${tenant}-${resource}`; + const input = `modules: + - name: ${moduleName} + type: http.server + config: + address: '127.0.0.1:0' +workflows: {} +triggers: {} +`; + + expect(parse(input)).toEqual({ + modules: [{ + name: moduleName, + type: 'http.server', + config: { address: '127.0.0.1:0' }, + }], + workflows: {}, + triggers: {}, + }); + }); + + it('rejects malformed syntax', () => { + expect(() => parse('modules: [\n')).toThrow(/unexpected end|end of the stream/i); + }); + + it('accepts empty-map merges at the real default budget', () => { + expect(parse(mergeInput(defaultMergeBudget))).toMatchObject({ + modules: [], + workflows: {}, + triggers: {}, + }); + }); + + it('rejects hostile merge work above the real default budget', () => { + const hostile = mergeInput(defaultMergeBudget + 1); + expect(hostile.length).toBeLessThan(256_000); + expect(() => parse(hostile)).toThrow(/merge keys exceeded maxTotalMergeKeys \(10000\)/); + }); +});