Uh oh!
There was an error while loading. Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork 0
Thanos 0.42: embed Invoca Prometheus for REPLACE_RATE_FUNCS=2#6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base:invoca-0.42.0-base
Are you sure you want to change the base?
Uh oh!
There was an error while loading. Please reload this page.
Changes from all commits
File filter
Filter by extension
Conversations
Uh oh!
There was an error while loading. Please reload this page.
Jump to
Uh oh!
There was an error while loading. Please reload this page.
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| FROM golang:1.26 as build | ||
| WORKDIR $GOPATH/src/github.com/thanos-io/thanos | ||
| COPY . $GOPATH/src/github.com/thanos-io/thanos | ||
| RUN git update-index --refresh; make build | ||
| FROM invocaops/base:master | ||
| COPY --from=build /go/bin/thanos /bin/thanos | ||
| ENTRYPOINT ["/bin/thanos"] | ||
Large diffs are not rendered by default.
Uh oh!
There was an error while loading. Please reload this page.
Large diffs are not rendered by default.
Uh oh!
There was an error while loading. Please reload this page.
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| --- | ||
| version: 2 | ||
| updates: | ||
| - package-ecosystem: "gomod" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "weekly" | ||
| open-pull-requests-limit: 20 | ||
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: docs | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| tags: | ||
| - '*' | ||
| pull_request: | ||
| jobs: | ||
| check: | ||
| runs-on: ubuntu-latest | ||
| name: Documentation check | ||
| env: | ||
| GOBIN: /tmp/.bin | ||
| steps: | ||
| - name: Checkout code into the Go module directory. | ||
| uses: actions/checkout@v4 | ||
| - name: Install Go | ||
| uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | ||
| with: | ||
| go-version-file: go.mod | ||
| - name: Check docs | ||
| run: make check-docs |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,113 @@ | ||
| name: Test | ||
| on: | ||
| push: | ||
| branches: [ main ] | ||
| pull_request: | ||
| branches: [ main, update-prometheus-3.0 ] | ||
| jobs: | ||
| skip-check: | ||
| name: Skip check | ||
| continue-on-error: true | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| should_skip: ${{ steps.skip-check.outputs.should_skip }} | ||
| permissions: | ||
| actions: write | ||
| contents: read | ||
| steps: | ||
| - id: skip-check | ||
| uses: fkirc/skip-duplicate-actions@v4 | ||
| with: | ||
| do_not_skip: '["schedule", "workflow_dispatch"]' | ||
| paths: |- | ||
| [ | ||
| "**.go", | ||
| ".github/workflows/test.yml", | ||
| "go.mod", | ||
| "go.sum" | ||
| ] | ||
| skip_after_successful_duplicate: false | ||
| lint: | ||
| runs-on: ubuntu-latest | ||
| name: Linters (Static Analysis) for Go | ||
| env: | ||
| GOBIN: /tmp/.bin | ||
| steps: | ||
| - name: Checkout code into the Go module directory. | ||
| uses: actions/checkout@v4 | ||
| - name: Install Go | ||
| uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | ||
| with: | ||
| go-version-file: go.mod | ||
| cache: true | ||
| - name: Cache binary dependencies | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: /tmp/.bin | ||
| key: ${{ runner.os }}-binaries-${{ hashFiles('**/go.sum', '.bingo/**/*.sum') }} | ||
| restore-keys: | | ||
| ${{ runner.os }}-binaries- | ||
| - name: Format | ||
| run: make format | ||
| - name: Lint | ||
| run: make lint | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| name: Run tests | ||
| env: | ||
| GOBIN: /tmp/.bin | ||
| steps: | ||
| - name: Check out code into the Go module directory. | ||
| uses: actions/checkout@v4 | ||
| - name: Install Go. | ||
| uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | ||
| with: | ||
| go-version-file: go.mod | ||
| cache: true | ||
| - name: Run unit tests | ||
| run: make test | ||
| test-tag-slicelabels: | ||
| runs-on: ubuntu-latest | ||
| name: Run tests --tags=slicelabels | ||
| env: | ||
| GOBIN: /tmp/.bin | ||
| steps: | ||
| - name: Check out code into the Go module directory. | ||
| uses: actions/checkout@v4 | ||
| - name: Install Go. | ||
| uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | ||
| with: | ||
| go-version-file: go.mod | ||
| cache: true | ||
| - name: Run unit tests | ||
| run: make test-slicelabels | ||
| fuzz: | ||
| runs-on: ubuntu-latest | ||
| name: Run fuzz | ||
| env: | ||
| GOBIN: /tmp/.bin | ||
| steps: | ||
| - name: Check out code into the Go module directory. | ||
| uses: actions/checkout@v4 | ||
| - name: Install Go. | ||
| uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0 | ||
| with: | ||
| go-version-file: go.mod | ||
| cache: true | ||
| - name: Run fuzzing | ||
| run: make fuzz |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| .envrc | ||
| .bin | ||
| /vendor/ | ||
| /.idea | ||
| /*.iml | ||
| tmp/ | ||
| examples/tmp/ | ||
| # Ignore the MacOS Trash (DS-Store) | ||
| .DS_Store | ||
| # Ignore benchmarking output | ||
| benchmarks/ | ||
| engine.test |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| # This file contains all available configuration options | ||
| # with their default values. | ||
| # options for analysis running | ||
| run: | ||
| # timeout for analysis, e.g. 30s, 5m, default is 1m | ||
| timeout: 5m | ||
| # exit code when at least one issue was found, default is 1 | ||
| issues-exit-code: 1 | ||
| # output configuration options | ||
| output: | ||
| # colored-line-number|line-number|json|tab|checkstyle, default is "colored-line-number" | ||
| formats: | ||
| - format: colored-line-number | ||
| # print lines of code with issue, default is true | ||
| print-issued-lines: true | ||
| # print linter name in the end of issue text, default is true | ||
| print-linter-name: true | ||
| linters: | ||
| enable: | ||
| # Sorted alphabetically. | ||
| - errcheck | ||
| - godot | ||
| - gofmt | ||
| - gci | ||
| - gosimple | ||
| - govet | ||
| - ineffassign | ||
| - misspell | ||
| - staticcheck | ||
| - unparam | ||
| - unused | ||
| - copyloopvar | ||
| - promlinter | ||
| linters-settings: | ||
| errcheck: | ||
| exclude-functions: | ||
| - (github.com/go-kit/log.Logger).Log | ||
| - fmt.Fprintln | ||
| - fmt.Fprint | ||
| misspell: | ||
| locale: US | ||
| staticcheck: | ||
| checks: | ||
| - "all" | ||
| - "-SA1019" # Ignore deprecated warnings (labels.MetricName, LabelName.IsValid, etc.) | ||
| gci: | ||
| sections: | ||
| - standard | ||
| - prefix(github.com/thanos-io) | ||
| - default | ||
| - blank | ||
| - dot | ||
| skip-generated: false | ||
| custom-order: true | ||
| issues: | ||
| exclude-rules: | ||
| # We don't check metrics naming in the tests. | ||
| - path: _test\.go | ||
| linters: | ||
| - promlinter | ||
| # which dirs to skip: they won't be analyzed; | ||
| # can use regexp here: generated.*, regexp is applied on full path; | ||
| # default value is empty list, but next dirs are always skipped independently | ||
| # from this option's value: | ||
| # vendor$, third_party$, testdata$, examples$, Godeps$, builtin$ | ||
| exclude-dirs: | ||
| - vendor | ||
| - parser |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| version: 1 | ||
| validators: | ||
| # Validators to skip checking PR/issue links of Thanos, Prometheus and Cortex. | ||
| - regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)thanos-io\/thanos(\/pull\/|\/issues\/)' | ||
| type: 'githubPullsIssues' | ||
| - regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)prometheus\/prometheus(\/pull\/|\/issues\/)' | ||
| type: 'githubPullsIssues' | ||
| - regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)cortexproject\/cortex(\/pull\/|\/issues\/)' | ||
| type: 'githubPullsIssues' | ||
| # Ignore Thanos release links. | ||
| - regex: '(^http[s]?:\/\/)(www\.)?(github\.com\/)thanos-io\/thanos(\/releases\/)' | ||
| type: 'ignore' | ||
| # Causes http stream errors with statuscode 0 sometimes. But is safe to skip. | ||
| - regex: 'slack\.cncf\.io' | ||
| type: 'ignore' | ||
| # 301 errors even when curl-ed. | ||
| - regex: 'envoyproxy\.io' | ||
| type: 'ignore' | ||
| # couldn't reach even when curl-ed. | ||
| - regex: 'cloud\.baidu\.com' | ||
| type: 'ignore' | ||
| # 403 when curl-ed from GitHub actions, though not from a developer machine. Likely due to secondary rate limits. | ||
| - regex: 'docs\.github\.com' | ||
| type: 'ignore' |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| Copyright (c) The Thanos Community Authors. | ||
| Licensed under the Apache License 2.0. |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Missing User Instructionon resource
DockerfileMore Details
This rule checks whether a `USER` instruction is specified in the Dockerfile. The rule fails when the `USER` instruction is missing, causing the container to run with root privileges (UID 0). If an attacker compromises an application running as root, they gain the privileges needed to potentially escape the container and attack the host node. It also increases the blast radius of a breach, allowing full control to modify files or install malware within the container. Enforcing a non-root user is a fundamental security measure that minimizes the attack surface and contains the impact of a potential compromise.
Expected
Found
Security Frameworks: wf-id-264
To ignore this finding as an exception, reply to this conversation with
#wiz_ignore reasonIf you'd like to ignore this finding in all future scans, add an exception in the .wiz file (learn more) or create an Ignore Rule (learn more).
To get more details on how to remediate this issue using AI, reply to this conversation with
#wiz remediate