chore(security): test plugins: harden security and update packages (#746)

Author: xnyo

.github/workflows/ci.yml

@@ -348,7 +348,7 @@ permissions:
 env:
   # Default versions for tooling
   DEFAULT_NODE_VERSION: "24"
-  DEFAULT_GO_VERSION: "1.26"
+  DEFAULT_GO_VERSION: "1.26.3"
   DEFAULT_GOLANGCI_LINT_VERSION: "2.11.4"
   DEFAULT_TRUFFLEHOG_VERSION: "3.94.3"
   DEFAULT_MAGE_VERSION: "1.17.1"

scripts/mockdata-dist-artifacts.sh

@@ -13,6 +13,13 @@ cd "$(dirname "$0")/.."
 mkdir -p "tests/act/mockdata/dist-artifacts-unsigned/$1"
 
 echo "[$1] Packaging os/arch ZIPs"
+
+# Ensure that no signature token is set in order to produce unsigned ZIPs
+if [ -n "${GRAFANA_ACCESS_POLICY_TOKEN:-}" ]; then
+    echo "Warning: GRAFANA_ACCESS_POLICY_TOKEN is set, unsetting it to produce unsigned ZIPs"
+fi
+unset GRAFANA_ACCESS_POLICY_TOKEN
+
 # Will exit with 0 if the plugin has no backend
 # (in that case, there's no need for os/arch ZIPs, just universal)
 ./actions/internal/plugins/package/package.sh "tests/act/mockdata/dist/$1" "tests/act/mockdata/dist-artifacts-unsigned/$1"

scripts/mockdata-dist.sh

@@ -33,6 +33,10 @@ echo "Using Package Manager: $(pm)"
 echo "[$1] (frontend) Installing"
 $(pm) install
 
+echo "[$1] (frontend) Lint + typecheck"
+$(pm) run lint
+$(pm) run typecheck
+
 echo "[$1] (frontend) Building the plugin"
 $(pm) run build
 

tests/act/main_tooling_versions_test.go

@@ -19,7 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-var goVersionRegex = regexp.MustCompile(`^go\s+(\d+\.\d+)`)
+var goVersionRegex = regexp.MustCompile(`^go\s+(\d+\.\d+(?:\.\d+)?)`)
 
 // readNodeMajorFromNvmrc reads the major Node.js version from an .nvmrc file.
 // It returns the major version string (e.g., "24").

tests/act/mockdata/dist-artifacts-unsigned/simple-backend/grafana-simplebackend-datasource-1.0.0.darwin_amd64.zip

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:37ff2c33368e6e3e6b67c9442adc4c59a6983da3b90713cd86d242b7183b50b0
-size 8865706
+oid sha256:75a382c902fa9c34479e4a1b5c79a5912f98c1bf3933a876973cb2cee908fb4f
+size 9211645

tests/act/mockdata/dist-artifacts-unsigned/simple-backend/grafana-simplebackend-datasource-1.0.0.darwin_amd64.zip.md5

@@ -1 +1 @@
-38530b26d7d9f58f47412e16021752a9
+419d1a455889ae0319a5fd4837d99f6d

tests/act/mockdata/dist-artifacts-unsigned/simple-backend/grafana-simplebackend-datasource-1.0.0.darwin_amd64.zip.sha1

@@ -1 +1 @@
-46c03fbbcba159cfe963fcfa83b701ebb208cfc4
+a092a9752558e7e50b590110161331b16fc03aa1

tests/act/mockdata/dist-artifacts-unsigned/simple-backend/grafana-simplebackend-datasource-1.0.0.darwin_arm64.zip

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:4c690cd87a7e3b89dd021e5f4c231327487c975ef0e244b4f4f4dc896dcf65e1
-size 8175141
+oid sha256:1e670ff0e4c2d876bc337ef4d2bf5568c54a662f2cbaae9a1771ac2d136bd23f
+size 8478453

tests/act/mockdata/dist-artifacts-unsigned/simple-backend/grafana-simplebackend-datasource-1.0.0.darwin_arm64.zip.md5

@@ -1 +1 @@
-cc0cfa48aec5d88376d4c7ac8ef186ec
+d10623adffa78f975a58ba4934a4372d

tests/act/mockdata/dist-artifacts-unsigned/simple-backend/grafana-simplebackend-datasource-1.0.0.darwin_arm64.zip.sha1

@@ -1 +1 @@
-02760ee634554c7f9293a8ebc611b059bb42cb16
+00e72d059a73da6dd911c6ae570bc2a114876b9c