Skip to content

Commit 9e24aca

Browse files
infernus01infernus01
committed
fix: CVE-2025-61726 - upgrade go version to >1.25.5
Signed-off-by: Shubham Bhardwaj <shubbhar@redhat.com>
1 parent 085896b commit 9e24aca

File tree

4 files changed

+176
-70
lines changed

4 files changed

+176
-70
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 66 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -19,80 +19,92 @@ jobs:
1919
name: build
2020
runs-on: ubuntu-latest
2121
steps:
22-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
24-
with:
25-
go-version-file: "go.mod"
26-
- name: build
27-
run: |
28-
go build -v ./...
22+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
24+
with:
25+
go-version-file: "go.mod"
26+
- name: build
27+
run: |
28+
go build -v ./...
2929
linting:
3030
needs: [build]
3131
name: lint
3232
runs-on: ubuntu-latest
3333
steps:
34-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
35-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
36-
with:
37-
go-version-file: "go.mod"
38-
- name: gofmt
39-
run: |
40-
gofmt_out=$(gofmt -d $(find * -name '*.go' ! -path 'vendor/*' ! -path 'third_party/*'))
41-
if [[ -n "$gofmt_out" ]]; then
42-
failed=1
43-
fi
44-
echo "$gofmt_out"
45-
- name: golangci-lint
46-
uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
47-
with:
48-
version: v2.1.6
49-
only-new-issues: true
50-
args: --timeout=10m
51-
- name: yamllint
52-
run: |
53-
apt update && apt install -y yamllint
54-
yamllint -c .yamllint $(find . -path ./vendor -prune -o -type f -regex ".*y[a]ml" -print | tr '\n' ' ')
55-
- name: check-license
56-
run: |
57-
go install github.com/google/go-licenses@v1.0.0
58-
go-licenses check ./...
34+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
35+
with:
36+
fetch-depth: 0
37+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
38+
with:
39+
go-version-file: "go.mod"
40+
- name: gofmt
41+
run: |
42+
gofmt_out=$(gofmt -d $(find * -name '*.go' ! -path 'vendor/*' ! -path 'third_party/*'))
43+
if [[ -n "$gofmt_out" ]]; then
44+
failed=1
45+
fi
46+
echo "$gofmt_out"
47+
- name: golangci-lint
48+
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
49+
with:
50+
version: v2.7.2
51+
args: --new-from-merge-base=origin/${{ github.base_ref }} --timeout=10m
52+
- name: yamllint
53+
run: |
54+
apt update && apt install -y yamllint
55+
yamllint -c .yamllint $(find . -path ./vendor -prune -o -type f -regex ".*y[a]ml" -print | tr '\n' ' ')
56+
- name: check-license
57+
run: |
58+
go install github.com/google/go-licenses@v1.0.0
59+
go-licenses check ./...
5960
tests:
6061
needs: [build]
6162
name: test
6263
runs-on: ubuntu-latest
6364
steps:
64-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
65-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
66-
with:
67-
go-version-file: "go.mod"
68-
- name: build
69-
run: |
70-
make test-unit-verbose-and-race
65+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
66+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
67+
with:
68+
go-version-file: "go.mod"
69+
- name: build
70+
run: |
71+
make test-unit-verbose-and-race
7172
generated:
7273
needs: [build]
7374
name: Check generated code
7475
runs-on: ubuntu-latest
7576
steps:
76-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
77-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
78-
with:
79-
go-version-file: "go.mod"
80-
- name: generated
81-
run: |
82-
go install github.com/google/go-licenses@v1.0.0 # Not sure why it is needed here
83-
./hack/verify-codegen.sh
77+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
78+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
79+
with:
80+
go-version-file: "go.mod"
81+
- name: generated
82+
run: |
83+
go install github.com/google/go-licenses@v1.0.0 # Not sure why it is needed here
84+
./hack/verify-codegen.sh
8485
multi-arch-build:
8586
needs: [build]
8687
name: Multi-arch build
8788
runs-on: ubuntu-latest
8889
steps:
89-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
90-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
91-
with:
92-
go-version-file: "go.mod"
93-
- name: make cross
94-
run: |
95-
make cross
90+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
91+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
92+
with:
93+
go-version-file: "go.mod"
94+
- name: Free disk space
95+
run: |
96+
echo "--- Disk space before cleanup ---"
97+
df -h
98+
sudo rm -rf /usr/share/dotnet
99+
sudo rm -rf /usr/local/lib/android
100+
sudo rm -rf /opt/ghc
101+
sudo rm -rf /opt/hostedtoolcache/CodeQL
102+
sudo docker image prune -a -f
103+
echo "--- Disk space after cleanup ---"
104+
df -h
105+
- name: make cross
106+
run: |
107+
make cross
96108
e2e-tests:
97109
needs: [build]
98110
uses: ./.github/workflows/e2e-matrix.yml

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,23 @@
1111
#
1212
name: "CodeQL"
1313

14+
permissions:
15+
contents: read
16+
1417
on:
1518
push:
1619
branches: [main]
20+
paths-ignore:
21+
- '**/*.md'
22+
- '**/*.txt'
23+
- '**/*.yaml'
1724
pull_request:
1825
# The branches below must be a subset of the branches above
1926
branches: [main]
27+
paths-ignore:
28+
- '**/*.md'
29+
- '**/*.txt'
30+
- '**/*.yaml'
2031
schedule:
2132
- cron: '30 20 * * 2'
2233

@@ -37,34 +48,32 @@ jobs:
3748
# Learn more about CodeQL language support at https://git.io/codeql-language-support
3849

3950
steps:
51+
- name: Harden Runner
52+
uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
53+
with:
54+
egress-policy: audit
55+
4056
- name: Checkout repository
41-
uses: actions/checkout@v4
57+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
58+
- name: Setup go
59+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
60+
with:
61+
go-version-file: "go.mod"
4262

4363
# Initializes the CodeQL tools for scanning.
4464
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v3
65+
uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6 # v3.29.5
4666
with:
4767
languages: ${{ matrix.language }}
4868
# If you wish to specify custom queries, you can do so here or in a config file.
4969
# By default, queries listed here will override any specified in a config file.
5070
# Prefix the list here with "+" to use these queries and those in the config file.
5171
# queries: ./path/to/local/query, your-org/your-repo/queries@main
5272

53-
# setup cache to speed up the action
54-
- uses: actions/cache@v4
55-
with:
56-
path: |
57-
~/.cache/go-build
58-
~/.cache/pip
59-
~/go/pkg/mod
60-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
61-
restore-keys: |
62-
${{ runner.os }}-go-
63-
6473
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
6574
# If this step fails, then you should remove it and run the build manually (see below)
6675
# - name: Autobuild
67-
# uses: github/codeql-action/autobuild@v3
76+
# uses: github/codeql-action/autobuild@1b1aada464948af03b950897e5eb522f92603cc2 # v3.24.9
6877

6978
# ℹ️ Command-line programs to run using the OS shell.
7079
# 📚 https://git.io/JvXDl
@@ -81,4 +90,4 @@ jobs:
8190
make bin/tkn
8291
8392
- name: Perform CodeQL Analysis
84-
uses: github/codeql-action/analyze@v3
93+
uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6 # v3.29.5

‎.github/workflows/e2e-matrix.yml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Tekton Integration
2+
# Adapted from https://github.com/mattmoor/mink/blob/master/.github/workflows/minkind.yaml
3+
4+
on: [workflow_call]
5+
6+
defaults:
7+
run:
8+
shell: bash
9+
10+
jobs:
11+
e2e-tests:
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ matrix.k8s-name }}-${{ matrix.feature-flags }}-${{ github.event.pull_request.number || github.ref }}
14+
cancel-in-progress: true
15+
name: e2e tests
16+
runs-on: ubuntu-latest
17+
strategy:
18+
fail-fast: false # Keep running if one leg fails.
19+
matrix:
20+
k8s-name:
21+
- k8s-oldest
22+
- k8s-plus-one
23+
24+
include:
25+
- k8s-name: k8s-oldest
26+
k8s-version: v1.28.x
27+
- k8s-name: k8s-plus-one
28+
k8s-version: v1.29.x
29+
env:
30+
KO_DOCKER_REPO: registry.local:5000/tekton
31+
CLUSTER_DOMAIN: c${{ github.run_id }}.local
32+
ARTIFACTS: ${{ github.workspace }}/artifacts
33+
34+
steps:
35+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
36+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
37+
with:
38+
go-version-file: "go.mod"
39+
- uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
40+
41+
- name: Install Dependencies
42+
working-directory: ./
43+
run: |
44+
echo '::group:: install go-junit-report'
45+
go install github.com/jstemmer/go-junit-report@v0.9.1
46+
echo '::endgroup::'
47+
48+
echo '::group:: created required folders'
49+
mkdir -p "${ARTIFACTS}"
50+
echo '::endgroup::'
51+
52+
echo "${GOPATH}/bin" >> "$GITHUB_PATH"
53+
54+
- name: Run tests
55+
run: |
56+
./hack/setup-kind.sh \
57+
--registry-url $(echo ${KO_DOCKER_REPO} | cut -d'/' -f 1) \
58+
--cluster-suffix c${{ github.run_id }}.local \
59+
--nodes 3 \
60+
--k8s-version ${{ matrix.k8s-version }} \
61+
--e2e-script ./test/e2e-tests.sh \
62+
--e2e-env ./test/e2e-tests-kind-prow.env
63+
64+
- name: Upload test results
65+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
66+
with:
67+
name: ${{ matrix.k8s-version }}-${{ matrix.feature-flags }}
68+
path: ${{ env.ARTIFACTS }}
69+
70+
- uses: chainguard-dev/actions/kind-diag@0cf1221da92242205c2d9f8a63add344ebd6b304 # v1.6.1
71+
if: ${{ failure() }}
72+
with:
73+
artifact-name: ${{ matrix.k8s-version }}-${{ matrix.feature-flags }}-logs
74+
75+
- name: Dump Artifacts
76+
if: ${{ failure() }}
77+
run: |
78+
if [[ -d ${{ env.ARTIFACTS }} ]]; then
79+
cd ${{ env.ARTIFACTS }}
80+
for x in $(find . -type f); do
81+
echo "::group:: artifact $x"
82+
cat $x
83+
echo '::endgroup::'
84+
done
85+
fi

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/tektoncd/cli
22

3-
go 1.25.0
3+
go 1.25.6
44

55
require (
66
github.com/AlecAivazis/survey/v2 v2.3.7

0 commit comments

Comments
 (0)