From 062736a332b9362eedae81f25ca002c022db1b20 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Oct 2026 07:44:19 +0000 Subject: [PATCH 1/5] build(deps): bump github.com/GoCodeAlone/modular/modules/eventbus/v2 Bumps [github.com/GoCodeAlone/modular/modules/eventbus/v2](https://github.com/GoCodeAlone/modular) from 2.10.0 to 2.12.0. - [Release notes](https://github.com/GoCodeAlone/modular/releases) - [Changelog](https://github.com/GoCodeAlone/modular/blob/main/CHANGELOG.md) - [Commits](https://github.com/GoCodeAlone/modular/compare/modules/database/v2.10.0...modules/database/v2.12.0) --- updated-dependencies: - dependency-name: github.com/GoCodeAlone/modular/modules/eventbus/v2 dependency-version: 2.12.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 0e7958ce..09fa6b4b 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/GoCodeAlone/modular v1.13.6 github.com/GoCodeAlone/modular/modules/auth v1.19.0 github.com/GoCodeAlone/modular/modules/cache v1.19.0 - github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 + github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 github.com/GoCodeAlone/modular/modules/jsonschema v1.17.0 github.com/GoCodeAlone/modular/modules/reverseproxy/v2 v2.10.0 github.com/GoCodeAlone/workflow-plugin-control-plane v0.1.0 diff --git a/go.sum b/go.sum index a71a2978..655dbd52 100644 --- a/go.sum +++ b/go.sum @@ -21,8 +21,8 @@ github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5Kz github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= github.com/GoCodeAlone/modular/modules/cache v1.19.0 h1:s+3aFI7wncV0NhbPrJheFyVYr1WXwLJXOvSAP9RRaYU= github.com/GoCodeAlone/modular/modules/cache v1.19.0/go.mod h1:bj/yS2FPdEDb8Vdmd5hjs5W4hchzMAC57eoIB3YY9S4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/modular/modules/jsonschema v1.17.0 h1:zoWioqUvuNNDfnjHA1sHixdlHfBreJdGhnnEBtxkzI8= github.com/GoCodeAlone/modular/modules/jsonschema v1.17.0/go.mod h1:GDU/jsD6AddmXKedj0wZwieUIaQsTBSGMzuj+XHXMrw= github.com/GoCodeAlone/modular/modules/reverseproxy/v2 v2.10.0 h1:+2M/ecyCxDiXfJM4ibcERuu/BBeIbLTQNcVgRsllR64= From c61019acbd6138c9330960d1aa97301955922e7b Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 5 Oct 2026 15:57:51 -0400 Subject: [PATCH 2/5] test: supply event routes to policy fetch fixtures --- scripts/test-check-public-workflow-policy.sh | 34 ++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/scripts/test-check-public-workflow-policy.sh b/scripts/test-check-public-workflow-policy.sh index a0b878b0..0eb5b172 100755 --- a/scripts/test-check-public-workflow-policy.sh +++ b/scripts/test-check-public-workflow-policy.sh @@ -1524,6 +1524,9 @@ run_candidate_fetch() { ( cd "${workdir}" PATH="${fake_bin}:$PATH" \ + EVENT_NAME="${FAKE_EVENT_NAME-pull_request_target}" \ + BASE_REF="${FAKE_BASE_REF-main}" \ + EVENT_REF="${FAKE_EVENT_REF-refs/heads/main}" \ CANDIDATE_REPOSITORY="${repository}" \ CANDIDATE_SHA="${sha}" \ GIT_ASKPASS=/bin/false \ @@ -1558,6 +1561,37 @@ fi grep -Fq -- "-tvf candidate.tar" "${candidate_fetch_good}/tar.log" grep -Fq -- "--extract --file=candidate.tar --directory=candidate --no-same-owner --no-same-permissions" "${candidate_fetch_good}/tar.log" +candidate_fetch_push="${tmp_dir}/candidate-fetch-push" +FAKE_EVENT_NAME=push FAKE_BASE_REF= \ + run_candidate_fetch "${candidate_fetch_push}" example/repo "${candidate_sha}" "${fake_archive}" +test -f "${candidate_fetch_push}/candidate/.github/workflows/inert.yml" + +for invalid_route in \ + 'pull-request|pull_request|main|refs/heads/main' \ + 'other-base|pull_request_target|develop|refs/heads/main' \ + 'other-ref|pull_request_target|main|refs/heads/develop' \ + 'push-base|push|main|refs/heads/main' \ + 'push-ref|push||refs/heads/develop'; do + IFS='|' read -r label event_name base_ref event_ref <<<"${invalid_route}" + route_workdir="${tmp_dir}/candidate-route-${label}" + set +e + route_output="$(FAKE_EVENT_NAME="${event_name}" FAKE_BASE_REF="${base_ref}" \ + FAKE_EVENT_REF="${event_ref}" \ + run_candidate_fetch "${route_workdir}" example/repo "${candidate_sha}" "${fake_archive}" 2>&1)" + route_status=$? + set -e + if [[ "${route_status}" -eq 0 ]] || ! grep -Fq -- \ + "public workflow policy accepts only push or pull_request_target for main" <<<"${route_output}"; then + echo "candidate fetch accepted invalid event route ${label}" >&2 + printf '%s\n' "${route_output}" >&2 + exit 1 + fi + if [[ -e "${route_workdir}/git.log" || -e "${route_workdir}/tar.log" ]]; then + echo "candidate fetch invoked Git or tar before rejecting event route ${label}" >&2 + exit 1 + fi +done + for invalid_candidate in \ 'bad-repository|example/repo?token=leak|0123456789012345678901234567890123456789' \ 'short-sha|example/repo|0123456789'; do From f71d379874bf37eb06e03071da4d2c37b1cda12f Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 5 Oct 2026 16:01:12 -0400 Subject: [PATCH 3/5] test: compress conformance fixture archives at best speed --- cmd/wfctl/plugin_conformance_test.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/cmd/wfctl/plugin_conformance_test.go b/cmd/wfctl/plugin_conformance_test.go index 9301b22c..494dffca 100644 --- a/cmd/wfctl/plugin_conformance_test.go +++ b/cmd/wfctl/plugin_conformance_test.go @@ -425,7 +425,11 @@ func writeTarGzFromDir(t *testing.T, srcDir, dest string) { t.Fatalf("create archive: %v", err) } defer f.Close() - gw := gzip.NewWriter(f) + // Fixture compression need not spend the full race-test budget on release binaries. + gw, err := gzip.NewWriterLevel(f, gzip.BestSpeed) + if err != nil { + t.Fatalf("create fixture gzip writer: %v", err) + } defer gw.Close() tw := tar.NewWriter(gw) defer tw.Close() @@ -474,7 +478,11 @@ func writeTarGzFiles(t *testing.T, dest string, files map[string]string) { t.Fatalf("create archive: %v", err) } defer f.Close() - gw := gzip.NewWriter(f) + // Preserve real gzip archives while avoiding expensive default-level fixture compression. + gw, err := gzip.NewWriterLevel(f, gzip.BestSpeed) + if err != nil { + t.Fatalf("create fixture gzip writer: %v", err) + } defer gw.Close() tw := tar.NewWriter(gw) defer tw.Close() From 244e7602fdceb4ca92772fdda2d19b9cce989af3 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 5 Oct 2026 16:02:08 -0400 Subject: [PATCH 4/5] build(deps): synchronize example module checksums --- example/go.mod | 2 +- example/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/example/go.mod b/example/go.mod index 62d1b487..8da7e94f 100644 --- a/example/go.mod +++ b/example/go.mod @@ -16,7 +16,7 @@ require ( github.com/GoCodeAlone/go-plugin v1.7.0 // indirect github.com/GoCodeAlone/modular/modules/auth v1.19.0 // indirect github.com/GoCodeAlone/modular/modules/cache v1.19.0 // indirect - github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 // indirect + github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 // indirect github.com/GoCodeAlone/modular/modules/jsonschema v1.17.0 // indirect github.com/GoCodeAlone/modular/modules/reverseproxy/v2 v2.10.0 // indirect github.com/GoCodeAlone/yaegi v0.17.2 // indirect diff --git a/example/go.sum b/example/go.sum index 3e0ec393..ce2a1408 100644 --- a/example/go.sum +++ b/example/go.sum @@ -15,8 +15,8 @@ github.com/GoCodeAlone/modular/modules/auth v1.19.0 h1:ughD47BqEAhg7+3trucwcs5Kz github.com/GoCodeAlone/modular/modules/auth v1.19.0/go.mod h1:pGPazN7Irlza8kUxE7WsXri44PhURKYBGym1tlBUl+k= github.com/GoCodeAlone/modular/modules/cache v1.19.0 h1:s+3aFI7wncV0NhbPrJheFyVYr1WXwLJXOvSAP9RRaYU= github.com/GoCodeAlone/modular/modules/cache v1.19.0/go.mod h1:bj/yS2FPdEDb8Vdmd5hjs5W4hchzMAC57eoIB3YY9S4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0 h1:2ljVafd/1LYchF47WrnA1+ji8mcmVXMJ4F5qDrhZZi4= -github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.10.0/go.mod h1:AKLcRGsw5gp2Q1zhuK0TBnMJOsaRe3aJ2OKnLFE2O5w= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0 h1:58xUt5rMMdSHZ7XWOBc7rf8kajrdcKPO4nVm67U8+iE= +github.com/GoCodeAlone/modular/modules/eventbus/v2 v2.12.0/go.mod h1:tH+3zxfUCKRofm6BcGDSCX5izdb+ox7nP8FYAm4zwvc= github.com/GoCodeAlone/modular/modules/jsonschema v1.17.0 h1:zoWioqUvuNNDfnjHA1sHixdlHfBreJdGhnnEBtxkzI8= github.com/GoCodeAlone/modular/modules/jsonschema v1.17.0/go.mod h1:GDU/jsD6AddmXKedj0wZwieUIaQsTBSGMzuj+XHXMrw= github.com/GoCodeAlone/modular/modules/reverseproxy/v2 v2.10.0 h1:+2M/ecyCxDiXfJM4ibcERuu/BBeIbLTQNcVgRsllR64= From f41e7ef9170010e1214ea928c071a4c95a5d3542 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 5 Oct 2026 16:15:57 -0400 Subject: [PATCH 5/5] test: preserve pinned policy harness pending governed repair --- scripts/test-check-public-workflow-policy.sh | 34 -------------------- 1 file changed, 34 deletions(-) diff --git a/scripts/test-check-public-workflow-policy.sh b/scripts/test-check-public-workflow-policy.sh index 0eb5b172..a0b878b0 100755 --- a/scripts/test-check-public-workflow-policy.sh +++ b/scripts/test-check-public-workflow-policy.sh @@ -1524,9 +1524,6 @@ run_candidate_fetch() { ( cd "${workdir}" PATH="${fake_bin}:$PATH" \ - EVENT_NAME="${FAKE_EVENT_NAME-pull_request_target}" \ - BASE_REF="${FAKE_BASE_REF-main}" \ - EVENT_REF="${FAKE_EVENT_REF-refs/heads/main}" \ CANDIDATE_REPOSITORY="${repository}" \ CANDIDATE_SHA="${sha}" \ GIT_ASKPASS=/bin/false \ @@ -1561,37 +1558,6 @@ fi grep -Fq -- "-tvf candidate.tar" "${candidate_fetch_good}/tar.log" grep -Fq -- "--extract --file=candidate.tar --directory=candidate --no-same-owner --no-same-permissions" "${candidate_fetch_good}/tar.log" -candidate_fetch_push="${tmp_dir}/candidate-fetch-push" -FAKE_EVENT_NAME=push FAKE_BASE_REF= \ - run_candidate_fetch "${candidate_fetch_push}" example/repo "${candidate_sha}" "${fake_archive}" -test -f "${candidate_fetch_push}/candidate/.github/workflows/inert.yml" - -for invalid_route in \ - 'pull-request|pull_request|main|refs/heads/main' \ - 'other-base|pull_request_target|develop|refs/heads/main' \ - 'other-ref|pull_request_target|main|refs/heads/develop' \ - 'push-base|push|main|refs/heads/main' \ - 'push-ref|push||refs/heads/develop'; do - IFS='|' read -r label event_name base_ref event_ref <<<"${invalid_route}" - route_workdir="${tmp_dir}/candidate-route-${label}" - set +e - route_output="$(FAKE_EVENT_NAME="${event_name}" FAKE_BASE_REF="${base_ref}" \ - FAKE_EVENT_REF="${event_ref}" \ - run_candidate_fetch "${route_workdir}" example/repo "${candidate_sha}" "${fake_archive}" 2>&1)" - route_status=$? - set -e - if [[ "${route_status}" -eq 0 ]] || ! grep -Fq -- \ - "public workflow policy accepts only push or pull_request_target for main" <<<"${route_output}"; then - echo "candidate fetch accepted invalid event route ${label}" >&2 - printf '%s\n' "${route_output}" >&2 - exit 1 - fi - if [[ -e "${route_workdir}/git.log" || -e "${route_workdir}/tar.log" ]]; then - echo "candidate fetch invoked Git or tar before rejecting event route ${label}" >&2 - exit 1 - fi -done - for invalid_candidate in \ 'bad-repository|example/repo?token=leak|0123456789012345678901234567890123456789' \ 'short-sha|example/repo|0123456789'; do