ci: cost/correctness cleanup, security scanning, multi-arch image - #12
Merged
Conversation
- Delete the bridge-schema-regression job: its six -run tests already run as part of `go test ./bridge` in go-tests, so it was a second 10x-priced macOS runner sitting on the critical path for zero added coverage. - Make vendor-patch.sh sed portable (BSD `sed -i ''` -> grep -v temp file) so `make patch` runs on Linux as well as macOS. - Move go-tests onto ubuntu-latest now that the patch step is portable and the bridge package is pure Go. - Add timeout-minutes to every job (build 45) so a hung simulator/xcodebuild can't burn the 360-minute default at macOS pricing. - Skip the pipeline for docs/markdown-only changes. - Cache the gomobile toolchain in the build job.
- New Security workflow: a gofmt + go vet gate, govulncheck for the go bridge (run after `make patch` so it scans the vendored Syncthing fork) and for notify, plus a weekly Trivy scan of the published image. - Dependabot for go modules, GitHub Actions, and the notify Docker base. The patched syncthing/go-stun forks are ignored (local replace-shadowed copies pinned to a 2.x pseudo-version Dependabot can't reason about). - Document the upstream-advisory watch process for the gitignored, replace-shadowed forks (go/patches/README.md). - gofmt the two files the new gate flags.
- Build linux/amd64 + linux/arm64 (pure CGO_ENABLED=0 Go, arm64 self-host is a real deploy target) via setup-qemu/buildx. - Attach max build provenance + SBOM attestations (id-token/attestations). - Scan the freshly built image by digest, failing on fixable HIGH/CRITICAL. - Add timeout-minutes to both jobs.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (8)
📝 WalkthroughWalkthroughThis PR establishes infrastructure for automated security scanning, CI/CD optimization, and dependency management. It adds Dependabot, fixes the vendor-patch script for cross-platform use, creates a comprehensive security workflow with gofmt/vet/govulncheck checks, optimizes the CI pipeline to skip doc-only changes and cache gomobile, and hardens Docker builds with provenance attestation, SBOM generation, and Trivy vulnerability scanning. ChangesSecurity, CI/CD, and Dependency Management Infrastructure
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~28 minutes Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI cost & correctness (ci.yml)
Security (security.yml + dependabot.yml, new)
Docker (docker.yml)
First CI run is the real integration test for the ubuntu/make-patch move and govulncheck.
This PR enhances CI/security infrastructure and Docker build pipelines without affecting runtime sync behavior.
Security & Vulnerability Scanning
govulncheckscanning for Go code post-vendoring to catch vulnerabilities in patched dependenciesgo/patches/README.mdCI/Build Improvements
ubuntu-latest(cost reduction for pure Go tests while macOS/iOS tests remain on macOS)timeout-minutesto all jobs for resource protectionvendor-patch.shsed operations portable across Linux and macOSDocker
No changes to user-facing sync functionality or runtime behavior. Changes are infrastructure-focused with emphasis on supply chain security and cost optimization.