Skip to content

chore: pin deps and security fixes #2124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yashmehrotra merged 2 commits into from
Apr 21, 2026
Merged

chore: pin deps and security fixes #2124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9a4ba23
chore: pin deps and security fixes
yashmehrotra Apr 20, 2026
0777aba
chore: update tests
yashmehrotra Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/benchmark.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
fetch-depth: 0

- name: Post "benchmark running" comment
uses: actions/github-script@v9
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
with:
script: |
const marker = '<!-- benchstat-report -->';
Expand Down Expand Up @@ -70,7 +70,7 @@ jobs:

- name: Install benchstat
run: |
GOBIN="$PWD/.bin" go install golang.org/x/perf/cmd/benchstat@latest
GOBIN="$PWD/.bin" go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260409210113-8e83ce0f7b1c
echo "$PWD/.bin" >> "$GITHUB_PATH"

- name: Prepare base worktree
Expand Down Expand Up @@ -138,7 +138,7 @@ jobs:
retention-days: 14

- name: Post report to PR
uses: actions/github-script@v9
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
with:
script: |
const fs = require('fs');
Expand Down
12 changes: 10 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,15 @@ on:
- main

permissions:
contents: write
id-token: write
contents: read

jobs:
semantic-release:
runs-on: ubuntu-latest
permissions:
contents: write
issues: write
pull-requests: write
outputs:
release-version: ${{ steps.semantic.outputs.release-version }}
new-release-published: ${{ steps.semantic.outputs.new-release-published }}
Expand All @@ -23,6 +26,8 @@ jobs:
binary:
runs-on: ubuntu-latest
needs: semantic-release
permissions:
contents: write
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
Expand Down Expand Up @@ -61,6 +66,9 @@ jobs:
docker:
needs: semantic-release
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
Comment on lines +69 to +71
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Drop OIDC permission while using static AWS keys.

Line 71 grants id-token: write, but the AWS step still authenticates with ECR_AWS_ACCESS_KEY / ECR_AWS_SECRET_ACCESS_KEY. That gives every step in the docker job OIDC token access without using it. Remove it unless this job is switching to role-to-assume.

🔒 Proposed least-privilege fix 
     permissions:
       contents: read
-      id-token: write

Also applies to: 104-109

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 69 - 71, Remove the unnecessary
OIDC permission by deleting the "id-token: write" entry from the permissions
block used by the docker job (the block that currently contains "contents: read"
and "id-token: write"); since authentication is done via ECR_AWS_ACCESS_KEY /
ECR_AWS_SECRET_ACCESS_KEY, ensure only "contents: read" (or other minimal needed
permissions) remain, and also remove the same "id-token: write" entry in the
duplicate permissions block referenced later (the lines applying to the same
docker job / release workflow).

steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install deps
uses: flanksource/deps@v1.0.28
uses: flanksource/deps@f04324f706a671af0fd0b1d7f9a708c9ec1643f4 # v1.0.28
with:
tools: |
bun
Expand Down Expand Up @@ -48,7 +48,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install deps
uses: flanksource/deps@v1.0.28
uses: flanksource/deps@f04324f706a671af0fd0b1d7f9a708c9ec1643f4 # v1.0.28
with:
tools: |
bun
Expand Down Expand Up @@ -99,7 +99,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install deps
uses: flanksource/deps@v1.0.28
uses: flanksource/deps@f04324f706a671af0fd0b1d7f9a708c9ec1643f4 # v1.0.28
with:
tools: |
bun
Expand Down Expand Up @@ -147,7 +147,7 @@ jobs:
restore-keys: |
cache-
- name: Install deps
uses: flanksource/deps@v1.0.28
uses: flanksource/deps@f04324f706a671af0fd0b1d7f9a708c9ec1643f4 # v1.0.28
with:
tools: |
bun
Expand Down Expand Up @@ -238,7 +238,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install deps
uses: flanksource/deps@v1.0.28
uses: flanksource/deps@f04324f706a671af0fd0b1d7f9a708c9ec1643f4 # v1.0.28
with:
tools: |
bun
Expand Down Expand Up @@ -276,7 +276,7 @@ jobs:
- name: Checkout code
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Install deps
uses: flanksource/deps@v1.0.28
uses: flanksource/deps@f04324f706a671af0fd0b1d7f9a708c9ec1643f4 # v1.0.28
with:
tools: |
etcd@v3.5.23
Expand Down
2 changes: 1 addition & 1 deletion build/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ COPY Makefile /app
COPY external/diffgen /app/external/diffgen
RUN make rust-diffgen

FROM golang:1.26-bookworm AS builder-base
FROM golang:1.26-bookworm@sha256:4f4ab2c90005e7e63cb631f0b4427f05422f241622ee3ec4727cc5febbf83e34 AS builder-base
WORKDIR /app

ARG VERSION
Expand Down
2 changes: 1 addition & 1 deletion build/Dockerfile.debug
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ COPY Makefile /app
COPY external/diffgen /app/external/diffgen
RUN make rust-diffgen

FROM golang:1.26-bookworm AS builder
FROM golang:1.26-bookworm@sha256:4f4ab2c90005e7e63cb631f0b4427f05422f241622ee3ec4727cc5febbf83e34 AS builder
WORKDIR /app

ARG VERSION
Expand Down
4 changes: 2 additions & 2 deletions scrapers/file/file.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
package file

import (
"crypto/md5"
"crypto/sha256"
"encoding/hex"
"net/url"
"os"
Expand Down Expand Up @@ -57,7 +57,7 @@ func convertToLocalPath(uri string) string {
if err != nil {
return uri
}
hash := md5.Sum([]byte(uri))
hash := sha256.Sum256([]byte(stripSecrets(uri)))
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Behavior change: cache key now collapses distinct credentials to the same path.

Hashing stripSecrets(uri) (instead of the raw uri) means two config entries pointing at the same host/path but with different embedded credentials now resolve to the same tempDir. Since getter.GetAny writes into that directory, concurrent or sequential scrapes for different credentialed URLs can share/overwrite each other's cached content. If that collision is intentional (dedup identical sources), consider calling it out; otherwise hash the raw uri and only use stripSecrets for logging.

Also worth noting: existing on-disk caches under the old MD5-suffixed directories will be orphaned after this change (harmless, but may warrant a one-time cleanup or a release note).

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@scrapers/file/file.go` at line 60, The cache key is being computed from
stripSecrets(uri) causing different credentialed URIs to collide; change the
hash input to the raw uri (use uri, not stripSecrets(uri)) when computing hash
(the line with hash := sha256.Sum256(...)) so tempDir is unique per exact URL,
and keep stripSecrets(uri) only where used for logging/debug output; ensure any
references to tempDir or getter.GetAny remain unchanged so writes stay isolated
per hashed raw URI.

p := ""
if _uri.Host != "" {
p = _uri.Host + "-"
Expand Down
8 changes: 4 additions & 4 deletions scrapers/file/file_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,9 @@ var _ = Describe("convertToLocalPath", func() {
func(input, expected string) {
Expect(convertToLocalPath(input)).To(Equal(expected))
},
Entry("file:// prefix", "file://foo", "foo-ecf5c8ee"),
Entry("git:: prefix", "git::foo", "foo-b943d8a5"),
Entry("git:: with URL and query", "git::https://foo/path?query=abc", "foo-path-8f49fbdc"),
Entry("plain path", "foo", "foo-acbd18db"),
Entry("file:// prefix", "file://foo", "foo-2c26b46b"),
Entry("git:: prefix", "git::foo", "foo-2c26b46b"),
Entry("git:: with URL and query", "git::https://foo/path?query=abc", "foo-path-90c2b34a"),
Entry("plain path", "foo", "foo-2c26b46b"),
)
})
Loading