aws lambda test added - #1
Merged
Merged
Conversation
drypa
commented
Oct 10, 2024
| Env: map[string]string{ | ||
| "ENV": "staging", | ||
| }, | ||
| Secrets: map[string]string{}, |
Contributor
Author
There was a problem hiding this comment.
these places was confusing to me
i do not see those setup in other tests
Contributor
There was a problem hiding this comment.
Looks like there was no proper test for this case :) thanks for adding
Cre-eD
added a commit
that referenced
this pull request
May 28, 2026
…w release tag (#298) Two related SC-preview fixes (bundled). ## 1. Phantom diff on the cloudtrail helper image (`pkg/clouds/pulumi/aws/alerts.go`) The `cloudtrail-security-{audit,critical}--prod-security-helpers-image` resources showed as **2 to update** (`build: update, skipPush: update`) on every PR preview: - `SkipPush: ctx.DryRun()` — true in preview / false in up → permanent `skipPush: update`. Kept it (no push during preview) + added `IgnoreChanges(["skipPush"])`. - `Context: "."` — Dockerfile `COPY`s nothing, so the whole-project context is irrelevant, but Pulumi hashes it and reports `build: update` on any unrelated file change. Narrowed to the Dockerfile's temp dir. ## 2. branch-preview release step (`.github/workflows/branch-preview.yaml`) `branch-preview.yaml`'s release step seds for `:staging`, but **#284** switched all `action.yml` image refs to `:latest`. Since then the rewrite is a no-op → `git add` stages nothing → "nothing to commit" → **every preview build fails at the tag step** (binary + images publish, but no `v$VERSION` tag). Now rewrites whatever tag is pinned and fails loudly on future drift. ## Validation - `go build ./...` passes; `branch-preview.yaml` YAML valid; sed verified against both `:latest` and `:staging`. - Re-running the branch-preview build on this branch exercises fix #2 (should now produce a `v$VERSION` tag), which in turn unblocks CI-side validation of fix #1. --------- Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
3 tasks
smecsia
added a commit
that referenced
this pull request
Jul 14, 2026
## What Bumps the `go` directive in `go.mod` from `1.26.4` to `1.26.5`. ## Why `govulncheck` reads the stdlib version it scans from the `go` directive. Go **1.26.4** is affected by **GO-2026-5856** (`crypto/tls`), fixed in **go1.26.5**. The finding is *reachable* through several pre-existing paths, so the reachability gate now fails on **every Go-touching PR** until the toolchain is bumped: ``` Vulnerability #1: GO-2026-5856 (crypto/tls@go1.26.4 → fixed in go1.26.5) #1 pkg/util/exec.go … tls.Conn.Handshake #2 pkg/assistant/mcp/server.go … tls.Conn.HandshakeContext #3 pkg/assistant/llm/ollama.go … tls.Conn.Read #4 pkg/api/git/repo.go … tls.Conn.Write #5 pkg/clouds/pulumi/mongodb/drop_db.go … tls.Dial #6 pkg/assistant/llm/openai.go … tls.Dialer.DialContext ``` Bumping the directive clears the advisory fleet-wide (unblocks #363 and any other open Go PR). `go1.26.5` is released; `GOTOOLCHAIN=auto` already resolves the toolchain, and the other workflows read the version from `go.mod` / auto-upgrade — so **no source change** is needed. ## Scope One line in `go.mod`. No code changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Ilya Sadykov <smecsia@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Cre-eD
added a commit
that referenced
this pull request
Sep 6, 2026
…6-6354/6355) (#394) ## Summary Closes the open OpenSSF Scorecard `Vulnerabilities` finding, plus two reachable `x/crypto/ssh` advisories that CI surfaced on the first run of this branch. | Severity | Fixed | Deferred | Unfixable | | --- | --- | --- | --- | | HIGH | 1 | 0 | 0 | | MEDIUM (govulncheck, unscored) | 2 | 0 | 0 | | CRITICAL / LOW | 0 | 0 | 1 (pre-existing, VEXed) | ## Fixed | Package | Old -> New | Advisory | Reachable? | Source | | --- | --- | --- | --- | --- | | `google.golang.org/grpc` | 1.82.1 -> 1.83.2 | [GHSA-vp52-pcj8-j9qc](GHSA-vp52-pcj8-j9qc) / CVE-2026-84304, HIGH | linked, on deploy path | Scorecard, osv.dev | | `golang.org/x/crypto` | 0.55.0 -> 0.56.0 | [GO-2026-6355](https://pkg.go.dev/vuln/GO-2026-6355) + [GO-2026-6354](https://pkg.go.dev/vuln/GO-2026-6354) | **called** (trace below) | govulncheck CI gate | ### 1. grpc — heap exhaustion via DATA-frame fragmentation An unauthenticated remote peer opens a gRPC stream and fragments its payload into millions of 1-byte HTTP/2 DATA frames. Every fragment carries its own tracking-struct and queue allocation, so heap use scales with *frame count*, not payload bytes -- the total stays inside the connection and stream flow-control windows while the runtime OOMs. Multiplexed across concurrent streams that is a remote DoS. Upstream fixed it in 1.83.1 with receive-buffer compaction (consecutive small buffers coalesce from a shared pool). 1.83.2 is current stable, so this takes the newer one. Reaches us indirectly, through the Pulumi SDK's gRPC transport: ``` $ go mod why -m google.golang.org/grpc github.com/simple-container-com/api/pkg/api github.com/pulumi/pulumi/sdk/v3/go/pulumi google.golang.org/grpc ``` Every provision/deploy talks to the Pulumi engine over that channel. **MVS collateral:** grpc 1.83.2's own `go.mod` pulled four transitive companions forward. All patch/minor, none are lint or codegen tooling, so no `golangci-lint` / `staticcheck` analysis-API fallout: - `cel.dev/expr` 0.25.1 -> 0.25.2 - `github.com/spiffe/go-spiffe/v2` 2.6.0 -> 2.7.0 - `github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp` 1.32.0 -> 1.33.0 - `go.opentelemetry.io/contrib/detectors/gcp` 1.43.0 -> 1.44.0 ### 2. x/crypto/ssh — two channel-deadlock DoS advisories Not caused by this branch -- `main` also pins 0.55.0. The advisories were published after the last green run, so this PR is simply the first build to see them. They are included here rather than split off because the `govulncheck` gate is required and would block on them regardless. govulncheck rates both **called**, not merely present: ``` Vulnerability #1: GO-2026-6355 Prevent DoS on deadlocked established channel Vulnerability #2: GO-2026-6354 Prevent DoS on deadlocked undecided channel Module: golang.org/x/crypto Found in: v0.55.0 Fixed in: v0.56.0 Example traces found: #1: pkg/clouds/pulumi/provision.go:100:50: pulumi.prepareStackForOperations calls auto.UpsertStackInlineSource, which eventually calls ssh.NewClientConn ``` That is `git+ssh` stack-source cloning inside `UpsertStackInlineSource`. A hostile or compromised git remote can wedge the SSH connection. Fixed in 0.56.0; one line each in `go.mod` and `go.sum`, no MVS collateral. ## Deferred to devs (breaking changes) None. Both are drop-in bumps, no app-side code change. ## Unfixable (no patched version yet) `GO-2026-5932` -- `golang.org/x/crypto/openpgp` is unmaintained and unsafe by design, `Fixed in: N/A`. Module-level only; govulncheck's symbol scan does not place it on any call path. Already carried as a `not_affected` statement in `vex/openvex.json`, and re-confirmed still valid this pass (upstream still ships no fix; it survives the x/crypto 0.56.0 bump unchanged). ## VEX re-triage `vex/openvex.json` carries 3 pre-existing `not_affected` statements: | Statement | Action this pass | | --- | --- | | `GO-2026-5932` (x/crypto/openpgp unmaintained) | **re-confirmed** -- still `Fixed in: N/A` at x/crypto 0.56.0 | | `GO-2022-0635` | carried forward unchanged, unrelated to this pass | | `GO-2022-0646` | carried forward unchanged, unrelated to this pass | No statement was added for any advisory in this PR -- all three are fixed, not suppressed. ## Dependabot reconciliation No open Dependabot PR touches `google.golang.org/grpc` or `golang.org/x/crypto`, so nothing to supersede or rebase onto. The repo's Dependabot alert API returned 403 for the token used here, so alert state was cross-checked against Trivy, govulncheck and osv.dev rather than the alert list. Any matching alert should auto-close once this lands on `main`. ## Evidence <details> <summary>Source scan -- <code>trivy fs --scanners vuln --severity CRITICAL,HIGH,MEDIUM,LOW</code> (0.69.0)</summary> ``` 0 findings across all severities (targets: go.mod, go.sum) ``` Re-run after each of the two bumps; clean both times. </details> <details> <summary>govulncheck -- module mode, after the x/crypto bump</summary> ``` === Module Results === Vulnerability #1: GO-2026-5932 The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues Module: golang.org/x/crypto Found in: golang.org/x/crypto@v0.56.0 Fixed in: N/A ``` The two `ssh` advisories are gone; only the already-VEXed openpgp entry remains. The reachability-aware symbol scan runs on the CI gate. </details> <details> <summary>Advisory range check -- grpc</summary> ``` $ curl -s https://api.osv.dev/v1/vulns/GHSA-vp52-pcj8-j9qc | jq '.affected[0].ranges' [{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.83.1"}]}] $ go list -m -versions google.golang.org/grpc | tr ' ' '\n' | tail -4 v1.83.0 v1.83.1 v1.83.2 <- selected v1.84.0-dev ``` 1.82.1 is inside `[0, 1.83.1)`; 1.83.2 is outside it. </details> ## Test plan - `go mod tidy` clean after each bump; `go.sum` regenerated and committed. - `GOMEMLIMIT=3GiB go build -p 2 ./...` -- exit 0 after both bumps, no compile errors from the four transitive grpc companions or from the x/crypto minor. - `trivy fs` -- 0 findings at every severity. - `govulncheck -scan=module` -- only the pre-existing, VEXed openpgp entry remains. The symbol-mode reachability verdict comes from the CI gate (source mode peaks past local memory on this module). --------- Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.