From 339f0382eeec5ac4c51631ad45822ce65b0da4ae Mon Sep 17 00:00:00 2001 From: Brandon Stoll Date: Wed, 17 Jun 2026 18:00:51 +0000 Subject: [PATCH 1/3] Update CI configurations and fix shell permissions - Update .golangci.yml. - Add config for trivy and checkov linters. - Update GitHub Actions in go.yml to use openconfig/common-ci v0.3.0 and set necessary permissions. - Make cloudbuild/kne_test.sh executable, fix typos, and improve bash script formatting. --- .github/linters/.checkov.yaml | 9 ++++++ .github/linters/.gitleaks.toml | 38 ++++++++++++++++++++++++- .github/linters/.golangci.yml | 52 ++-------------------------------- .github/linters/trivy.yaml | 8 ++++++ .github/workflows/go.yml | 16 ++++++++--- cloudbuild/kne_test.sh | 10 +++---- 6 files changed, 73 insertions(+), 60 deletions(-) create mode 100644 .github/linters/.checkov.yaml create mode 100644 .github/linters/trivy.yaml mode change 100644 => 100755 cloudbuild/kne_test.sh diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml new file mode 100644 index 000000000..cd392e19c --- /dev/null +++ b/.github/linters/.checkov.yaml @@ -0,0 +1,9 @@ +skip-framework: + - cloudformation +skip-path: + - manifests + - load + - deploy + - x/webhook + - x/wire + - init_wait diff --git a/.github/linters/.gitleaks.toml b/.github/linters/.gitleaks.toml index 150012a93..9d0b308f0 100644 --- a/.github/linters/.gitleaks.toml +++ b/.github/linters/.gitleaks.toml @@ -1,169 +1,205 @@ - title = "gitleaks config" [[rules]] + id = "aws-access-key" description = "AWS Access Key" regex = '''(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}''' tags = ["key", "AWS"] [[rules]] + id = "aws-secret-key" description = "AWS Secret Key" regex = '''(?i)aws(.{0,20})?(?-i)['\"][0-9a-zA-Z\/+]{40}['\"]''' tags = ["key", "AWS"] [[rules]] + id = "aws-mws-key" description = "AWS MWS key" regex = '''amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}''' tags = ["key", "AWS", "MWS"] [[rules]] + id = "facebook-secret-key" description = "Facebook Secret Key" regex = '''(?i)(facebook|fb)(.{0,20})?(?-i)['\"][0-9a-f]{32}['\"]''' tags = ["key", "Facebook"] [[rules]] + id = "facebook-client-id" description = "Facebook Client ID" regex = '''(?i)(facebook|fb)(.{0,20})?['\"][0-9]{13,17}['\"]''' tags = ["key", "Facebook"] [[rules]] + id = "twitter-secret-key" description = "Twitter Secret Key" regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{35,44}['\"]''' tags = ["key", "Twitter"] [[rules]] + id = "twitter-client-id" description = "Twitter Client ID" regex = '''(?i)twitter(.{0,20})?['\"][0-9a-z]{18,25}['\"]''' tags = ["client", "Twitter"] [[rules]] + id = "github-pat" description = "Github Personal Access Token" regex = '''ghp_[0-9a-zA-Z]{36}''' tags = ["key", "Github"] + [[rules]] + id = "github-oauth" description = "Github OAuth Access Token" regex = '''gho_[0-9a-zA-Z]{36}''' tags = ["key", "Github"] + [[rules]] + id = "github-app-token" description = "Github App Token" regex = '''(ghu|ghs)_[0-9a-zA-Z]{36}''' tags = ["key", "Github"] + [[rules]] + id = "github-refresh-token" description = "Github Refresh Token" regex = '''ghr_[0-9a-zA-Z]{76}''' tags = ["key", "Github"] [[rules]] + id = "linkedin-client-id" description = "LinkedIn Client ID" regex = '''(?i)linkedin(.{0,20})?(?-i)[0-9a-z]{12}''' tags = ["client", "LinkedIn"] [[rules]] + id = "linkedin-secret-key" description = "LinkedIn Secret Key" regex = '''(?i)linkedin(.{0,20})?[0-9a-z]{16}''' tags = ["secret", "LinkedIn"] [[rules]] + id = "slack-token" description = "Slack" regex = '''xox[baprs]-([0-9a-zA-Z]{10,48})?''' tags = ["key", "Slack"] [[rules]] + id = "asymmetric-private-key" description = "Asymmetric Private Key" regex = '''-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----''' tags = ["key", "AsymmetricPrivateKey"] [[rules]] + id = "google-api-key" description = "Google API key" regex = '''AIza[0-9A-Za-z\\-_]{35}''' tags = ["key", "Google"] [[rules]] + id = "gcp-service-account" description = "Google (GCP) Service Account" regex = '''"type": "service_account"''' tags = ["key", "Google"] [[rules]] + id = "heroku-api-key" description = "Heroku API key" regex = '''(?i)heroku(.{0,20})?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}''' tags = ["key", "Heroku"] [[rules]] + id = "mailchimp-api-key" description = "MailChimp API key" regex = '''(?i)(mailchimp|mc)(.{0,20})?[0-9a-f]{32}-us[0-9]{1,2}''' tags = ["key", "Mailchimp"] [[rules]] + id = "mailgun-api-key" description = "Mailgun API key" regex = '''((?i)(mailgun|mg)(.{0,20})?)?key-[0-9a-z]{32}''' tags = ["key", "Mailgun"] [[rules]] + id = "paypal-braintree-access-token" description = "PayPal Braintree access token" regex = '''access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}''' tags = ["key", "Paypal"] [[rules]] + id = "picatic-api-key" description = "Picatic API key" regex = '''sk_live_[0-9a-z]{32}''' tags = ["key", "Picatic"] [[rules]] + id = "sendgrid-api-key" description = "SendGrid API Key" regex = '''SG\.[\w_]{16,32}\.[\w_]{16,64}''' tags = ["key", "SendGrid"] [[rules]] + id = "slack-webhook" description = "Slack Webhook" regex = '''https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8,12}/[a-zA-Z0-9_]{24}''' tags = ["key", "slack"] [[rules]] + id = "stripe-api-key" description = "Stripe API key" regex = '''(?i)stripe(.{0,20})?[sr]k_live_[0-9a-zA-Z]{24}''' tags = ["key", "Stripe"] [[rules]] + id = "square-access-token" description = "Square access token" regex = '''sq0atp-[0-9A-Za-z\-_]{22}''' tags = ["key", "square"] [[rules]] + id = "square-oauth-secret" description = "Square OAuth secret" regex = '''sq0csp-[0-9A-Za-z\\-_]{43}''' tags = ["key", "square"] [[rules]] + id = "twilio-api-key" description = "Twilio API key" regex = '''(?i)twilio(.{0,20})?SK[0-9a-f]{32}''' tags = ["key", "twilio"] [[rules]] + id = "dynatrace-token" description = "Dynatrace ttoken" regex = '''dt0[a-zA-Z]{1}[0-9]{2}\.[A-Z0-9]{24}\.[A-Z0-9]{64}''' tags = ["key", "Dynatrace"] [[rules]] + id = "shopify-shared-secret" description = "Shopify shared secret" regex = '''shpss_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "shopify-access-token" description = "Shopify access token" regex = '''shpat_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "shopify-custom-app-access-token" description = "Shopify custom app access token" regex = '''shpca_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "shopify-private-app-access-token" description = "Shopify private app access token" regex = '''shppa_[a-fA-F0-9]{32}''' tags = ["key", "Shopify"] [[rules]] + id = "pypi-upload-token" description = "PyPI upload token" regex = '''pypi-AgEIcHlwaS5vcmc[A-Za-z0-9-_]{50,1000}''' tags = ["key", "pypi"] diff --git a/.github/linters/.golangci.yml b/.github/linters/.golangci.yml index 07cf99e49..5e10a88a4 100644 --- a/.github/linters/.golangci.yml +++ b/.github/linters/.golangci.yml @@ -1,52 +1,4 @@ ---- -######################### -######################### -## Golang Linter rules ## -######################### -######################### +version: "2" -# configure golangci-lint -# see https://github.com/golangci/golangci-lint/blob/master/.golangci.example.yml -run: - timeout: 10m issues: - exclude-rules: - - path: _test\.go - linters: - - dupl - - gosec - - goconst - - linters: - - revive - text: "var-naming: don't use leading k" - - linters: - - staticcheck - text: "SA1019:" -linters: - disable-all: true - enable: - - gosec - - unconvert - - goimports - - gofmt - - gocritic - - govet - - revive - - staticcheck - - unconvert - - unparam - - unused - - wastedassign - - whitespace -linters-settings: - errcheck: - # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`; - # default is false: such cases aren't reported by default. - check-blank: true - gocritic: - disabled-checks: - - singleCaseSwitch - - appendAssign - revive: - ignore-generated-header: true - severity: warning + new-from-rev: origin/main diff --git a/.github/linters/trivy.yaml b/.github/linters/trivy.yaml new file mode 100644 index 000000000..fc175b68b --- /dev/null +++ b/.github/linters/trivy.yaml @@ -0,0 +1,8 @@ +scan: + skip-dirs: + - manifests + - load + - deploy + - x/webhook + - x/wire + - init_wait diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml index c230a47b0..83e5fcacc 100644 --- a/.github/workflows/go.yml +++ b/.github/workflows/go.yml @@ -7,15 +7,23 @@ on: pull_request: branches: [main] +permissions: {} + jobs: go: - uses: openconfig/common-ci/.github/workflows/go.yml@v0.2.0 + uses: openconfig/common-ci/.github/workflows/go.yml@abb79c974d34c0ec6cda3bcfcb2edb6679d197e1 # v0.3.0 + permissions: + contents: read + packages: read + statuses: write with: coverage-excludes-regex: /cloudbuild tests-excludes-regex: /cloudbuild race-tests-excludes-regex: /cloudbuild skip-race-tests: true - go-versions: "['1.21']" - linter: - uses: openconfig/common-ci/.github/workflows/linter.yml@v0.2.0 + lint: + uses: openconfig/common-ci/.github/workflows/linter.yml@abb79c974d34c0ec6cda3bcfcb2edb6679d197e1 # v0.3.0 + permissions: + contents: read + packages: read diff --git a/cloudbuild/kne_test.sh b/cloudbuild/kne_test.sh old mode 100644 new mode 100755 index 0b60645ed..66bbefe9e --- a/cloudbuild/kne_test.sh +++ b/cloudbuild/kne_test.sh @@ -19,7 +19,7 @@ export PATH=${PATH}:/usr/local/go/bin gopath=$(go env GOPATH) export PATH=${PATH}:$gopath/bin -# Replace exisiting kne repo with new version +# Replace existing kne repo with new version rm -r "$HOME/kne" cp -r /tmp/workspace "$HOME/kne" @@ -44,7 +44,7 @@ kubectl get pods -A $cli teardown kne/deploy/kne/kind-bridge.yaml # Create a kind cluster with GAR access and image loading -cat >/tmp/dep-cfg.yaml << EOF +cat >/tmp/dep-cfg.yaml < Date: Wed, 17 Jun 2026 18:28:22 +0000 Subject: [PATCH 2/3] CI test: slightly modify files from 4acfd5f7c771d0f286af8bba15115aed1ec7a5ee TAG=agy CONV=cf53475d-1e32-4212-af0c-2a2cb174695b --- deploy/deploy_test.go | 1 + go.mod | 3 ++- go.sum | 2 ++ proto/alpine/alpine.pb.go | 2 ++ proto/ceos/ceos.pb.go | 2 ++ proto/controller/controller.pb.go | 2 ++ proto/controller/controller_grpc.pb.go | 2 ++ proto/event/event.pb.go | 2 ++ proto/forward/forward.pb.go | 2 ++ proto/topo.proto | 2 ++ proto/topo/topo.pb.go | 2 ++ proto/wire/wire.pb.go | 2 ++ proto/wire/wire_grpc.pb.go | 2 ++ topo/node/inclusterproxy/inclusterproxy.go | 2 ++ topo/node/sonic/sonic.go | 2 ++ topo/node/sonic/sonic_test.go | 20 +++++++++++--------- topo/sonic_topo_test.go | 2 ++ topo/topo.go | 2 ++ topo/topo_test.go | 2 ++ 19 files changed, 46 insertions(+), 10 deletions(-) diff --git a/deploy/deploy_test.go b/deploy/deploy_test.go index f808f5218..d869d462b 100644 --- a/deploy/deploy_test.go +++ b/deploy/deploy_test.go @@ -1,3 +1,4 @@ +// CI test modification package deploy import ( diff --git a/go.mod b/go.mod index 84a47c154..3cc9b30b7 100644 --- a/go.mod +++ b/go.mod @@ -1,4 +1,5 @@ -module github.com/openconfig/kne +module github.com/openconfig/kne // CI test modification + go 1.24.0 diff --git a/go.sum b/go.sum index cfebeb7a5..89e9631ce 100644 --- a/go.sum +++ b/go.sum @@ -2226,3 +2226,5 @@ sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+s sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08= sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E= sigs.k8s.io/yaml v1.4.0/go.mod h1:Ejl7/uTz7PSA4eKMyQCUTnhZYNmLIl+5c2lQPGR2BPY= + + diff --git a/proto/alpine/alpine.pb.go b/proto/alpine/alpine.pb.go index 46190b02d..203684e9a 100644 --- a/proto/alpine/alpine.pb.go +++ b/proto/alpine/alpine.pb.go @@ -448,3 +448,5 @@ func file_alpine_proto_init() { file_alpine_proto_goTypes = nil file_alpine_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/ceos/ceos.pb.go b/proto/ceos/ceos.pb.go index 1d99e2f25..6a0e7c388 100644 --- a/proto/ceos/ceos.pb.go +++ b/proto/ceos/ceos.pb.go @@ -177,3 +177,5 @@ func file_ceos_proto_init() { file_ceos_proto_goTypes = nil file_ceos_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/controller/controller.pb.go b/proto/controller/controller.pb.go index 6c0ce84c6..1bcf0a003 100644 --- a/proto/controller/controller.pb.go +++ b/proto/controller/controller.pb.go @@ -3248,3 +3248,5 @@ func file_controller_proto_init() { file_controller_proto_goTypes = nil file_controller_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/controller/controller_grpc.pb.go b/proto/controller/controller_grpc.pb.go index 81e858df4..0f79ba43a 100644 --- a/proto/controller/controller_grpc.pb.go +++ b/proto/controller/controller_grpc.pb.go @@ -499,3 +499,5 @@ var TopologyManager_ServiceDesc = grpc.ServiceDesc{ Streams: []grpc.StreamDesc{}, Metadata: "controller.proto", } + +// CI test modification diff --git a/proto/event/event.pb.go b/proto/event/event.pb.go index 28e260665..833becbd8 100644 --- a/proto/event/event.pb.go +++ b/proto/event/event.pb.go @@ -1037,3 +1037,5 @@ func file_event_proto_init() { file_event_proto_goTypes = nil file_event_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/forward/forward.pb.go b/proto/forward/forward.pb.go index c0a596849..d6b5c61cf 100644 --- a/proto/forward/forward.pb.go +++ b/proto/forward/forward.pb.go @@ -575,3 +575,5 @@ func file_forward_proto_init() { file_forward_proto_goTypes = nil file_forward_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/topo.proto b/proto/topo.proto index 6292c2e6b..f1b47d664 100644 --- a/proto/topo.proto +++ b/proto/topo.proto @@ -11,8 +11,10 @@ // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. +// CI test modification syntax = "proto3"; + package topo; import "google/protobuf/any.proto"; diff --git a/proto/topo/topo.pb.go b/proto/topo/topo.pb.go index e712bbcfa..b90199124 100644 --- a/proto/topo/topo.pb.go +++ b/proto/topo/topo.pb.go @@ -1752,3 +1752,5 @@ func file_topo_proto_init() { file_topo_proto_goTypes = nil file_topo_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/wire/wire.pb.go b/proto/wire/wire.pb.go index 1da85eb77..fb73fb05e 100644 --- a/proto/wire/wire.pb.go +++ b/proto/wire/wire.pb.go @@ -161,3 +161,5 @@ func file_wire_proto_init() { file_wire_proto_goTypes = nil file_wire_proto_depIdxs = nil } + +// CI test modification diff --git a/proto/wire/wire_grpc.pb.go b/proto/wire/wire_grpc.pb.go index fad602dbd..5aed3b9cf 100644 --- a/proto/wire/wire_grpc.pb.go +++ b/proto/wire/wire_grpc.pb.go @@ -135,3 +135,5 @@ var Wire_ServiceDesc = grpc.ServiceDesc{ }, Metadata: "wire.proto", } + +// CI test modification diff --git a/topo/node/inclusterproxy/inclusterproxy.go b/topo/node/inclusterproxy/inclusterproxy.go index e59515529..da1924dbf 100644 --- a/topo/node/inclusterproxy/inclusterproxy.go +++ b/topo/node/inclusterproxy/inclusterproxy.go @@ -174,3 +174,5 @@ func (n *Node) Create(ctx context.Context) error { func init() { node.Vendor(tpb.Vendor(14), New) } + +// CI test modification diff --git a/topo/node/sonic/sonic.go b/topo/node/sonic/sonic.go index 4841c100b..bd9950fb3 100644 --- a/topo/node/sonic/sonic.go +++ b/topo/node/sonic/sonic.go @@ -228,3 +228,5 @@ func (n *Node) DefaultNodeConstraints() node.Constraints { func init() { node.Vendor(tpb.Vendor_SONIC, New) } + +// CI test modification diff --git a/topo/node/sonic/sonic_test.go b/topo/node/sonic/sonic_test.go index db6dd1e90..5834877f6 100644 --- a/topo/node/sonic/sonic_test.go +++ b/topo/node/sonic/sonic_test.go @@ -171,9 +171,9 @@ func TestCreatePod(t *testing.T) { }, }, wantInitCtr: corev1.Container{ - Name: "init-sonic-node", - Image: node.DefaultInitContainerImage, - Args: []string{"1", "10", "1"}, + Name: "init-sonic-node", + Image: node.DefaultInitContainerImage, + Args: []string{"1", "10", "1"}, ImagePullPolicy: "IfNotPresent", SecurityContext: &corev1.SecurityContext{ Privileged: pointer.Bool(true), @@ -215,9 +215,9 @@ func TestCreatePod(t *testing.T) { }, }, wantInitCtr: corev1.Container{ - Name: "init-sonic-node", - Image: "customInitImage", - Args: []string{"3", "5", "1"}, + Name: "init-sonic-node", + Image: "customInitImage", + Args: []string{"3", "5", "1"}, ImagePullPolicy: "IfNotPresent", SecurityContext: &corev1.SecurityContext{ Privileged: pointer.Bool(true), @@ -253,9 +253,9 @@ func TestCreatePod(t *testing.T) { }, }, wantInitCtr: corev1.Container{ - Name: "init-sonic-node", - Image: node.DefaultInitContainerImage, - Args: []string{"1", "10", "1"}, + Name: "init-sonic-node", + Image: node.DefaultInitContainerImage, + Args: []string{"1", "10", "1"}, ImagePullPolicy: "IfNotPresent", SecurityContext: &corev1.SecurityContext{ Privileged: pointer.Bool(true), @@ -331,3 +331,5 @@ func TestDefaultNodeConstraints(t *testing.T) { t.Errorf("DefaultNodeConstraints() returned unexpected Memory: got %s, want %s", constraints.Memory, defaultConstraints.Memory) } } + +// CI test modification diff --git a/topo/sonic_topo_test.go b/topo/sonic_topo_test.go index 27e509306..ab25415e0 100644 --- a/topo/sonic_topo_test.go +++ b/topo/sonic_topo_test.go @@ -66,3 +66,5 @@ func TestCreateSonicNode(t *testing.T) { t.Fatalf("Create() failed: %v", err) } } + +// CI test modification diff --git a/topo/topo.go b/topo/topo.go index 2e131194b..01239ac77 100644 --- a/topo/topo.go +++ b/topo/topo.go @@ -926,3 +926,5 @@ func Load(path string) (*tpb.Topology, error) { } return t, nil } + +// CI test modification diff --git a/topo/topo_test.go b/topo/topo_test.go index a958a7211..bb3f80a4e 100644 --- a/topo/topo_test.go +++ b/topo/topo_test.go @@ -2106,3 +2106,5 @@ func TestWatch(t *testing.T) { t.Errorf("Watch() unexpected error: %v", err) } } + +// CI test modification From 5dd25b1cf184abf58ed8b1b824e466e02df23703 Mon Sep 17 00:00:00 2001 From: Brandon Stoll Date: Thu, 18 Jun 2026 16:41:31 +0000 Subject: [PATCH 3/3] stuff --- go.mod | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/go.mod b/go.mod index 3cc9b30b7..d4f21854b 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,4 @@ -module github.com/openconfig/kne // CI test modification - +module github.com/openconfig/kne // CI test modification 22 go 1.24.0