-
Notifications
You must be signed in to change notification settings - Fork 0
ci(vulncheck): one declaration for the govulncheck pin, and a check that keeps it (backend#1972) #501
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
ci(vulncheck): one declaration for the govulncheck pin, and a check that keeps it (backend#1972) #501
Changes from all commits
Commits
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,83 @@ | ||
| #!/usr/bin/env bash | ||
| # ============================================================================= | ||
| # check-tool-pins.sh — one declaration per pinned tool version (backend#1972) | ||
| # | ||
| # govulncheck's version used to live in THREE places: build.yml's job, | ||
| # vulncheck.yml's job, and GOVULNCHECK_VERSION in the Makefile — kept in step by | ||
| # a comment reading "keep the job in lockstep". Two copies held in sync by a | ||
| # request is not a mechanism; all three happened to read v1.1.4, which is | ||
| # exactly what made it look fine. | ||
| # | ||
| # Both workflows now run `make vulncheck`, so the Makefile is the declaration. | ||
| # This guard exists so that stays true: it PARSES the Makefile for the tools it | ||
| # covers and fails if a workflow hardcodes a version for one of them. | ||
| # | ||
| # DERIVED, NOT RESTATED: the version to look for is read from the Makefile. This | ||
| # guard holds no version of its own, so it cannot agree with itself while | ||
| # disagreeing with reality. | ||
| # | ||
| # Runs in CI (the Lint job, beside check-style.sh) and locally: | ||
| # make check-tool-pins (or: bash scripts/check-tool-pins.sh) | ||
| # Exit 0 = clean, 1 = a restated pin was found, 2 = the guard itself errored. | ||
| # ============================================================================= | ||
| set -uo pipefail | ||
| cd "$(dirname "$0")/.." || exit 2 | ||
|
|
||
| # Fail CLOSED. A guard that cannot find its inputs must not report clean: that is | ||
| # the failure this file was written against (backend#1729). | ||
| [[ -f Makefile ]] || { echo "check-tool-pins: no Makefile — refusing to report clean" >&2; exit 2; } | ||
| [[ -d .github/workflows ]] || { echo "check-tool-pins: no .github/workflows — refusing to report clean" >&2; exit 2; } | ||
|
|
||
| # Tools whose version the Makefile owns, as <make var>:<module path fragment>. | ||
| # Add a row when a tool moves to a `make` target that CI calls. | ||
| TOOLS=( | ||
| "GOVULNCHECK_VERSION:golang.org/x/vuln/cmd/govulncheck" | ||
| ) | ||
|
|
||
| fail=0 | ||
| checked=0 | ||
|
|
||
| for row in "${TOOLS[@]}"; do | ||
| var="${row%%:*}" | ||
| module="${row#*:}" | ||
|
|
||
| # Parse the REAL declaration. `?=` or `=`, any surrounding spaces. | ||
| version="$(sed -nE "s/^[[:space:]]*${var}[[:space:]]*\\??=[[:space:]]*([^[:space:]#]+).*/\\1/p" Makefile | head -1)" | ||
| if [[ -z "$version" ]]; then | ||
| echo "check-tool-pins: ${var} is not declared in the Makefile, so this guard cannot" >&2 | ||
| echo " verify anything about ${module}. Either restore the declaration or drop the" >&2 | ||
| echo " row from TOOLS — an unparseable input is a finding, not a pass." >&2 | ||
| exit 2 | ||
| fi | ||
|
|
||
| # Any workflow naming the module with an @version is holding its own copy. | ||
| # `make <target>` references carry no version and are therefore invisible here, | ||
| # which is the whole point. | ||
| # | ||
| # No 2>/dev/null and no `|| true`: grep rc 1 is "no offender" and fine, but rc>=2 | ||
| # is a real error (unreadable tree, bad invocation) and must fail CLOSED. Laundering | ||
| # it into an empty hit list is the unearned exit 0 this guard was written against | ||
| # (backend#1729); scan() in check-style.sh handles the same grep class this way. | ||
| offenders="$(grep -rn -- "${module}@" .github/workflows/)" | ||
| rc=$? | ||
| if (( rc >= 2 )); then | ||
| echo "check-tool-pins: grep errored (rc=${rc}) scanning .github/workflows for '${module}@' — refusing to report clean" >&2 | ||
| exit 2 | ||
| fi | ||
| if [[ -n "$offenders" ]]; then | ||
| echo "A workflow pins ${module} directly:" >&2 | ||
| printf '%s\n' "$offenders" >&2 | ||
| echo >&2 | ||
| echo " ${var} in the Makefile already declares this (${version}), and CI runs it" >&2 | ||
| echo " via a make target. A second copy here is what backend#1972 removed: three" >&2 | ||
| echo " copies agreeing today, drifting on the next bump, with nothing to notice." >&2 | ||
| echo " Call the make target instead." >&2 | ||
| fail=1 | ||
| fi | ||
| checked=$((checked + 1)) | ||
| done | ||
|
|
||
| if (( fail )); then | ||
| exit 1 | ||
| fi | ||
| echo "check-tool-pins: ${checked} tool pin(s) declared once, in the Makefile" |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.