Update Go dependencies, builder images, GHAs: by jacobweinstock · Pull Request #180 · tinkerbell/actions

jacobweinstock · 2026-05-27T05:14:52Z

Description

The previously pinned deps are years old and pull in long-EOL containerd/oras releases, blocking any further upgrades and leaving known CVEs in the build. Refresh the module graph to currently supported versions, drop the deislabs/oras fork in favor of upstream oras.land/oras-go, and bump the builder/runtime base images to match. Code that touched removed APIs (go-diskfs Disk.File, oras.Pull) is ported to the supported equivalents.

Fixes: #

How Has This Been Tested?

How are existing users impacted? What migration steps/scripts do we need?

Checklist:

I have:

updated the documentation and/or roadmap (if required)
added unit or e2e tests
provided instructions on how to upgrade

Copilot

Pull request overview

This PR modernizes the project’s Go module graph and build/release tooling to unblock upgrades and reduce exposure to outdated, EOL dependencies. It updates multiple action images to build with newer Go builder images, migrates ORAS usage to oras.land/oras-go, and adjusts code for updated dependency APIs.

Changes:

Updated Go dependencies (notably containerd/containerd, go-diskfs) and migrated from github.com/deislabs/oras to oras.land/oras-go.
Bumped action builder images to golang:1.26-alpine and switched several builds to CGO_ENABLED=0 with simplified linker flags.
Updated GitHub Actions workflow dependencies and fixed a nproc typo in the release workflow.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`writefile/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`syslinux/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`slurp/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`rootio/storage/partition.go`	Port disk flush/close logic to newer `go-diskfs` APIs.
`rootio/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`qemuimg2disk/Dockerfile`	Bump Go builder image; replace `go mod tidy` with `go mod download`; disable CGO.
`oci2disk/image/writer.go`	Replace oras content import; add resolver/pusher shims for `oras.Copy`.
`oci2disk/image/image.go`	Replace `oras.Pull` with `oras.Copy` from `oras.land/oras-go`.
`oci2disk/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`kexec/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`image2disk/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`grub2disk/Dockerfile`	Bump Go builder image; disable CGO and update build flags.
`archive2disk/Dockerfile`	Bump Go builder image; disable CGO and simplify build flags.
`archive2disk/archive/utils.go`	Replace `github.com/pkg/errors` import with stdlib `errors`.
`.github/workflows/release.yml`	Bump action versions; fix `nproc` typo.
`.github/workflows/ci.yml`	Bump `actions/checkout` version.
`go.mod`	Bump Go version and refresh required/indirect dependencies; add `oras.land/oras-go`.
`go.sum`	Updated checksums to match refreshed module graph.

Comments suppressed due to low confidence (1)

grub2disk/Dockerfile:7

This stage installs gcc/musl-dev but the build now uses CGO_ENABLED=0, so the C toolchain is likely unused. Consider dropping these packages (and git if modules come from the proxy) to speed up builds and reduce the image footprint.

RUN apk add --no-cache grub grub-bios git ca-certificates gcc musl-dev

FROM base AS build-arm64
RUN apk add --no-cache grub git ca-certificates gcc musl-dev

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 33 out of 36 changed files in this pull request and generated 5 comments.

The previously pinned deps are years old and pull in long-EOL containerd/oras releases, blocking any further upgrades and leaving known CVEs in the build. Refresh the module graph to currently supported versions, drop the deislabs/oras fork in favor of upstream oras.land/oras-go, and bump the builder/runtime base images to match. Code that touched removed APIs (go-diskfs Disk.File, oras.Pull) is ported to the supported equivalents. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

The rootio partition helpers only closed the disk handle on the success path, so any error from GetPartitionTable, Backend.Sys, Sync or the partition writes leaked the underlying file descriptor against a block device the caller intends to keep operating on. Move the close into a defer so every return path releases it. The rootio and grub2disk builder stages still installed git, gcc, musl-dev and friends from when those builds used cgo; since they now build with CGO_ENABLED=0 those packages are dead weight in the image and slow the build for no benefit. A dependabot config is added so the Go module, GitHub Actions and Docker base image bumps that this branch had to do by hand happen automatically going forward. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

alpine:3.13 has been EOL for years and ships unfixed CVEs. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 33 out of 35 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

cexec/main.go:102

main creates a signal-cancellable context, but settings.cexec now ignores it (_ context.Context) and continues to use exec.Command without any cancellation. This makes SIGTERM/SIGINT handling ineffective for long-running child processes. Please thread the context through and use exec.CommandContext (and/or propagate cancellation to the executed command paths) so the action terminates promptly and predictably.

}

func (s settings) cexec(_ context.Context, log *slog.Logger) error {
	log.Info("CEXEC - Chroot Exec")

	if s.blockDevice == "" {
		return errors.New("no Block Device speified with Environment Variable [BLOCK_DEVICE]")

writefile relied on a deferred unmount that never ran because the error paths all called os.Exit, risking a mount leak into the host namespace. A nolint comment had been added to silence the warning with a justification that was simply wrong. The v2 golangci-lint migration dropped the explicit runtime timeout; the upstream default of 1m is not enough for this repo under GitHub Actions and the lint job started flaking. One builder stage still pulled compiler toolchain packages even though the build no longer uses cgo, wasting build time and diverging from its sibling stage. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 33 out of 35 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

cexec/main.go:103

Typo in error message: "speified" should be "specified".

func (s settings) cexec(_ context.Context, log *slog.Logger) error {
	log.Info("CEXEC - Chroot Exec")

	if s.blockDevice == "" {
		return errors.New("no Block Device speified with Environment Variable [BLOCK_DEVICE]")
	}

Copilot

Pull request overview

Copilot reviewed 35 out of 37 changed files in this pull request and generated 3 comments.

oci2disk unconditionally disabled TLS verification against the registry, which is unsafe against anything other than a local insecure registry. Make it opt-in via SKIP_VERIFY so the default is a verified TLS connection. writefile created the /mountAction mountpoint with os.ModeDir as the mode, which is the directory type bit — not permission bits — so the resulting directory had no usable permissions. Use 0o755, and MkdirAll so a pre-existing mountpoint isn't an error. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 35 out of 37 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

Lint.mk:28

After extracting shellcheck, the cleanup step removes .../shellcheck (a path that no longer exists after the mv). This leaves the extracted out/linters/shellcheck-$(SHELLCHECK_VERSION) directory behind. Consider deleting the whole extracted directory instead to keep out/linters tidy.

	mkdir -p out/linters
	rm -rf out/linters/shellcheck-*
	curl -sSfL https://github.com/koalaman/shellcheck/releases/download/$(SHELLCHECK_VERSION)/shellcheck-$(SHELLCHECK_VERSION).$(LINT_OS_LOWER).$(LINT_ARCH).tar.xz | tar -C out/linters -xJf -
	mv out/linters/shellcheck-$(SHELLCHECK_VERSION)/shellcheck $@
	rm -rf out/linters/shellcheck-$(SHELLCHECK_VERSION)/shellcheck

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

Copilot

Pull request overview

Copilot reviewed 35 out of 37 changed files in this pull request and generated 2 comments.

mergify · 2026-05-27T21:16:47Z

jacobweinstock requested a review from Copilot May 27, 2026 05:14

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 05:15 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread rootio/Dockerfile Outdated

Comment thread grub2disk/Dockerfile Outdated

Comment thread rootio/storage/partition.go

Comment thread rootio/storage/partition.go

Comment thread rootio/storage/partition.go

jacobweinstock requested a review from Copilot May 27, 2026 15:47

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 15:47 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread grub2disk/grub/grub.go

Comment thread grub2disk/grub/grub.go

Comment thread Lint.mk Outdated

Comment thread oci2disk/image/image.go

Comment thread qemuimg2disk/Dockerfile Outdated

jacobweinstock force-pushed the update branch from a1f6691 to 316d3dd Compare May 27, 2026 15:51

jacobweinstock added 3 commits May 27, 2026 10:03

Update a fix linting

b18706d

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

jacobweinstock force-pushed the update branch from 316d3dd to b18706d Compare May 27, 2026 16:03

bump builder base to alpine:3.21:

b26562d

alpine:3.13 has been EOL for years and ships unfixed CVEs. Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

jacobweinstock requested a review from Copilot May 27, 2026 16:16

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 16:17 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread writefile/main.go

Comment thread grub2disk/Dockerfile Outdated

Comment thread .golangci.yml

jacobweinstock requested a review from Copilot May 27, 2026 16:36

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 16:36 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread writefile/main.go

Comment thread grub2disk/grub/grub.go

Comment thread grub2disk/grub/grub.go

Comment thread oci2disk/image/image.go

jacobweinstock force-pushed the update branch from dfbbc5c to 0741791 Compare May 27, 2026 16:52

jacobweinstock requested a review from Copilot May 27, 2026 16:52

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 16:52 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread oci2disk/README.md Outdated

Comment thread oci2disk/image/image.go Outdated

Comment thread Lint.mk Outdated

jacobweinstock force-pushed the update branch from 0741791 to bdf33c1 Compare May 27, 2026 17:03

jacobweinstock requested a review from Copilot May 27, 2026 17:03

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 17:03 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread writefile/main.go

Comment thread .golangci.yml Outdated

Comment thread rootio/storage/partition.go

Improve golangci-lint downloading

422122e

Signed-off-by: Jacob Weinstock <jakobweinstock@gmail.com>

jacobweinstock force-pushed the update branch from bdf33c1 to 422122e Compare May 27, 2026 18:04

jacobweinstock requested a review from Copilot May 27, 2026 18:04

Copilot started reviewing on behalf of jacobweinstock May 27, 2026 18:04 View session

Copilot AI reviewed May 27, 2026

View reviewed changes

Comment thread writefile/main.go

Comment thread Lint.mk

jacobweinstock added the ready-to-merge Signal to Mergify to merge the PR. label May 27, 2026

mergify Bot added the queued label May 27, 2026

mergify Bot added a commit that referenced this pull request May 27, 2026

Merge of #180

82c5d40

mergify Bot mentioned this pull request May 27, 2026

merge queue: embarking main (544a3fc) and #180 together #182

Closed

mergify Bot merged commit 0847b08 into tinkerbell:main May 27, 2026
21 checks passed

mergify Bot removed the queued label May 27, 2026

jacobweinstock deleted the update branch May 28, 2026 03:18

Conversation

jacobweinstock commented May 27, 2026

Description

How Has This Been Tested?

How are existing users impacted? What migration steps/scripts do we need?

Checklist:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

mergify Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mergify Bot commented May 27, 2026 •

edited

Loading