Skip to content

TT-17868 fix env-up race + drift-check GOPROXY cache #152

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
rafalgolarz wants to merge 8 commits into
base: main
Choose a base branch
from
+7 −0
Open

TT-17868 fix env-up race + drift-check GOPROXY cache #152

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a52a530
TT-17868 fix env-up race + drift-check GOPROXY cache
rafalgolarz Aug 12, 2026
65907d1
TT-17868 bump slave-datacenter --wait-timeout to 240s
rafalgolarz Aug 12, 2026
15cc93b
TT-17868 bump master-datacenter --wait-timeout to 240s
rafalgolarz Aug 12, 2026
dd0b5a3
TT-17868 dump keycloak logs on master-datacenter --wait failure
rafalgolarz Aug 12, 2026
e6d1ec3
TT-17868 fix keycloak log dump to use plain docker logs
rafalgolarz Aug 12, 2026
757a006
Revert env-up --wait experiment
rafalgolarz Aug 12, 2026
9effa5e
TT-17868 re-add --wait to env-up now that keycloak healthcheck is fixed
rafalgolarz Aug 12, 2026
0fbbc62
Revert --wait in env-up, keep only the GOPROXY drift-check fix
rafalgolarz Aug 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions .github/workflows/drift-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,13 @@

- name: Build gromit from master
if: ${{ !contains(github.event.pull_request.labels.*.name, inputs.label_name) }}
# GOPROXY=direct bypasses proxy.golang.org's CDN, which caches the
# @master ref's resolved commit for 30 minutes (Cache-Control:
# max-age=1800). Without this, a merge to gromit's master can take
# up to half an hour to be picked up here, making this check flag
# false drift against a stale render.

Check warning on line 44 in .github/workflows/drift-check.yml

View check run for this annotation

probelabs / Visor: security

security Issue 

Setting `GOPROXY=direct` bypasses the Go module proxy (`proxy.golang.org`) and its associated security features, such as the checksum database (`sum.golang.org`). This means the build fetches the tool directly from its source repository without an independent, immutable audit trail for the module's checksum. While this change is intended to bypass a cache for a floating reference (`@master`), it increases the risk of a supply-chain attack if the source code repository for `gromit` is compromised. The workflow would immediately pull and execute the compromised code without the potential safeguards or delay provided by the proxy.
Raw output 
To solve the caching issue without bypassing the Go module proxy, resolve the `@master` branch to a specific commit hash first, and then use that immutable hash for the `go install` command. This makes the build more auditable and restores the security benefits of using the proxy for the download.

Replace the 'Build gromit from master' step with these two steps:
```yaml
      - name: Resolve gromit master branch
        id: gromit
        if: ${{ !contains(github.event.pull_request.labels.*.name, inputs.label_name) }}
        run: |
          SHA=$(git ls-remote https://github.com/TykTechnologies/gromit.git refs/heads/master | cut -f1)
          echo "Resolved gromit master to commit: $SHA"
          echo "sha=${SHA}" >> $GITHUB_OUTPUT

      - name: Build gromit from master
        if: ${{ steps.gromit.outputs.sha != '' }}
        run: |
          echo "Installing gromit from commit ${{ steps.gromit.outputs.sha }}"
          go install github.com/TykTechnologies/gromit@${{ steps.gromit.outputs.sha }}
```
env:
GOPROXY: direct
run: go install github.com/TykTechnologies/gromit@master

- name: Check for drift from gromit
Expand Down
Loading