Merge branch 'goharbor:main' into optimizer-adapter

Author: czifrushanna

.github/dependabot.yml

@@ -23,6 +23,17 @@ updates:
     reviewers:
       - "OrlinVasilev"
     groups:
+      # codeql-analysis.yml runs codeql-action/init and codeql-action/analyze
+      # in one job. init writes a config file stamped with its version and
+      # analyze rejects it from any other version, so both must be bumped
+      # in the same pull request.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"
+      codeql-action-security:
+        applies-to: security-updates
+        patterns:
+          - "github/codeql-action*"
       patch-updates:
         patterns:
           - "*"
@@ -100,6 +111,19 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "release-note/bump-version"
+    # Angular majors are a migration, not a bump: the new major pins a new
+    # TypeScript major, changes the ng-swagger-gen output and needs the wrapper
+    # libraries (ngx-markdown, @clr/*) to follow. Keep the group on the current
+    # major; upgrade Angular in a dedicated PR. See #23854 and #23856.
+    ignore:
+      - dependency-name: "@angular/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@angular-devkit/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@angular-eslint/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
     groups:
       # The Angular packages pin each other with exact peer dependencies, and
       # @angular-devkit/build-angular and @angular/core pin typescript and
@@ -133,6 +157,19 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "release-note/bump-version"
+    # Angular majors are a migration, not a bump: the new major pins a new
+    # TypeScript major, changes the ng-swagger-gen output and needs the wrapper
+    # libraries (ngx-markdown, @clr/*) to follow. Keep the group on the current
+    # major; upgrade Angular in a dedicated PR. See #23854 and #23856.
+    ignore:
+      - dependency-name: "@angular/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@angular-devkit/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "@angular-eslint/*"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "typescript"
+        update-types: ["version-update:semver-major"]
     groups:
       angular:
         patterns:

.github/workflows/codeql-analysis.yml

@@ -30,7 +30,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
@@ -55,4 +55,4 @@ jobs:
     # https://github.com/github/codeql/issues/15647#issuecomment-2003768106
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+      uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

.github/workflows/nightly-trivy-scan.yml

@@ -37,6 +37,6 @@ jobs:
           # Ref: https://github.com/aquasecurity/trivy-action/issues/389
           TRIVY_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-db:2'
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: 'trivy-results.sarif'

make/migrations/postgresql/0190_2.16.0_schema.up.sql

@@ -17,5 +17,5 @@ ALTER TABLE robot ALTER COLUMN creator_ref TYPE bigint;
 ALTER TABLE role_permission ALTER COLUMN role_id TYPE bigint;
 ALTER SEQUENCE robot_id_seq AS bigint MAXVALUE 9007199254740991;
 
-CREATE INDEX idx_sbom_report_sbom_digest
+CREATE INDEX IF NOT EXISTS idx_sbom_report_sbom_digest
   ON sbom_report (mime_type, ((report::jsonb ->> 'sbom_digest')));

src/cmd/exporter/main.go

@@ -15,6 +15,7 @@
 package main
 
 import (
+	"errors"
 	"net/http"
 	"os"
 	"strings"
@@ -99,7 +100,7 @@ func main() {
 		exporterOpt.CacheCleanInterval,
 	)
 	prometheus.MustRegister(harborExporter)
-	if err := harborExporter.ListenAndServe(); err != nil {
+	if err := harborExporter.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
 		log.Errorf("Error starting Harbor exporter %s", err)
 		os.Exit(1)
 	}

src/common/dao/testutils.go

@@ -70,7 +70,7 @@ func PrepareTestForPostgresSQL() {
 		},
 	}
 
-	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d, POSTGRES_PWD: %s\n", dbHost, dbUser, dbPort, dbPassword)
+	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d\n", dbHost, dbUser, dbPort)
 	o = initDatabaseForTest(database)
 }
 

src/common/security/secret/context.go

@@ -49,7 +49,7 @@ func (s *SecurityContext) IsAuthenticated() bool {
 	}
 	valid := s.store.IsValid(s.secret)
 	if !valid {
-		log.Debugf("invalid secret: %s", s.secret)
+		log.Debug("invalid secret")
 	}
 
 	return valid

src/common/utils/test/database.go

@@ -63,7 +63,7 @@ func InitDatabaseFromEnv() {
 		},
 	}
 
-	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d, POSTGRES_PWD: %s\n", dbHost, dbUser, dbPort, dbPassword)
+	log.Infof("POSTGRES_HOST: %s, POSTGRES_USR: %s, POSTGRES_PORT: %d\n", dbHost, dbUser, dbPort)
 
 	if err := dao.InitDatabase(database); err != nil {
 		log.Fatalf("failed to init database : %v", err)

src/common/utils/utils.go

@@ -51,7 +51,26 @@ func ParseEndpoint(endpoint string) (*url.URL, error) {
 		endpoint = "http://" + endpoint
 	}
 
-	return url.ParseRequestURI(endpoint)
+	u, err := url.ParseRequestURI(endpoint)
+	if err == nil && u != nil {
+		u.Host = strings.ToLower(u.Host)
+	}
+	return u, err
+}
+
+// EqualURL checks whether two URLs are equal, with case-insensitive host matching per RFC 1035.
+func EqualURL(rawURL1, rawURL2 string) bool {
+	if rawURL1 == rawURL2 {
+		return true
+	}
+	u1, err1 := url.Parse(rawURL1)
+	u2, err2 := url.Parse(rawURL2)
+	if err1 != nil || err2 != nil {
+		return false
+	}
+	u1.Host = strings.ToLower(u1.Host)
+	u2.Host = strings.ToLower(u2.Host)
+	return u1.String() == u2.String()
 }
 
 // ParseRepository splits a repository into two parts: project and rest
@@ -66,19 +85,33 @@ func ParseRepository(repository string) (project, rest string) {
 	return
 }
 
-// GenerateRandomStringWithLen generates a random string with length
-func GenerateRandomStringWithLen(length int) string {
+// GenerateRandomStringWithLenAndError generates a random string with length or returns an error if entropy cannot be read
+func GenerateRandomStringWithLenAndError(length int) (string, error) {
 	const chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
 	l := len(chars)
 	result := make([]byte, length)
 	_, err := rand.Read(result)
 	if err != nil {
-		log.Warningf("Error reading random bytes: %v", err)
+		return "", fmt.Errorf("failed to read random bytes: %w", err)
 	}
 	for i := range length {
 		result[i] = chars[int(result[i])%l]
 	}
-	return string(result)
+	return string(result), nil
+}
+
+// GenerateRandomStringOrError generates a random string with 32 byte length or returns an error if entropy cannot be read
+func GenerateRandomStringOrError() (string, error) {
+	return GenerateRandomStringWithLenAndError(32)
+}
+
+// GenerateRandomStringWithLen generates a random string with length
+func GenerateRandomStringWithLen(length int) string {
+	str, err := GenerateRandomStringWithLenAndError(length)
+	if err != nil {
+		log.Warningf("Error reading random bytes: %v", err)
+	}
+	return str
 }
 
 // GenerateRandomString generate a random string with 32 byte length

src/common/utils/utils_test.go

@@ -37,6 +37,9 @@ func TestParseEndpoint(t *testing.T) {
 		{"ftp://example.com", true, ""},
 		{"http://example.com", false, "http://example.com"},
 		{"https://example.com", false, "https://example.com"},
+		{"http://EXAMPLE.COM", false, "http://example.com"},
+		{"https://EXAMPLE.COM:8080/Path", false, "https://example.com:8080/Path"},
+		{" MIXED.case.com/path/ ", false, "http://mixed.case.com/path"},
 		{"http://example!@#!?//#", true, ""},
 	}
 
@@ -51,6 +54,31 @@ func TestParseEndpoint(t *testing.T) {
 	}
 }
 
+func TestEqualURL(t *testing.T) {
+	cases := []struct {
+		url1     string
+		url2     string
+		expected bool
+	}{
+		{"http://example.com:8080/v2", "http://example.com:8080/v2", true},
+		{"http://EXAMPLE.COM:8080/v2", "http://example.com:8080/v2", true},
+		{"http://example.com:8080/V2", "http://example.com:8080/v2", false},
+		{"https://core:8080", "https://CORE:8080", true},
+		{"http://example.com", "https://example.com", false},
+		{"http://example.com:8080", "http://example.com:8081", false},
+		{"http://example.com/foo", "http://example.com/bar", false},
+		{"://invalid-url-1", "http://example.com", false},
+		{"http://example.com", "://invalid-url-2", false},
+		{"http://example.com/A%", "http://example.com/a%", false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.url1+"_vs_"+c.url2, func(t *testing.T) {
+			assert.Equal(t, c.expected, EqualURL(c.url1, c.url2))
+		})
+	}
+}
+
 func TestParseRepository(t *testing.T) {
 	repository := "library/ubuntu"
 	project, rest := ParseRepository(repository)
@@ -155,13 +183,28 @@ func TestGenerateRandomString(t *testing.T) {
 	}
 }
 
+func TestGenerateRandomStringOrError(t *testing.T) {
+	str, err := GenerateRandomStringOrError()
+	assert.Nil(t, err)
+	assert.Equal(t, 32, len(str))
+	str2, err := GenerateRandomStringOrError()
+	assert.Nil(t, err)
+	assert.NotEqual(t, str, str2)
+}
+
 func TestGenerateRandomStringWithLen(t *testing.T) {
 	str := GenerateRandomStringWithLen(16)
 	if len(str) != 16 {
 		t.Errorf("Failed to generate ramdom string with fixed length.")
 	}
 }
 
+func TestGenerateRandomStringWithLenAndError(t *testing.T) {
+	str, err := GenerateRandomStringWithLenAndError(16)
+	assert.Nil(t, err)
+	assert.Equal(t, 16, len(str))
+}
+
 func TestTestTCPConn(t *testing.T) {
 	server := httptest.NewServer(nil)
 	defer server.Close()