[DNM] fix(security): backport v0.48.0 fixes to v0.27.x

.golangci.yml

@@ -14,6 +14,9 @@ run:
   build-tags:
     - e2e
 linters-settings:
+  govet:
+    disable:
+      - inline
   gocritic:
     disabled-checks:
       - unlambda

.goreleaser.yml

@@ -42,7 +42,7 @@ archives:
 checksum:
   name_template: "checksums.txt"
 snapshot:
-  name_template: "{{ .Tag }}-next"
+  version_template: "{{ .Tag }}-next"
 release:
   extra_files:
     - glob: ./release.yaml

.markdownlint.json

@@ -1,7 +1,11 @@
 {
     "line-length": false,
     "first-header-h1": false,
+    "first-header-heading": false,
     "no-inline-html": false,
     "MD013": false,
-    "MD025": false
+    "MD025": false,
+    "MD041": false,
+    "descriptive-link-text": false,
+    "table-column-style": false
 }

.tekton/doc.yaml

@@ -49,7 +49,7 @@ spec:
                       name: "uploader-upload-credentials"
                       key: "public_url"
               script: |
-                version=$(curl -s https://api.github.com/repos/gohugoio/hugo/releases/latest|python -c 'import sys, json;dico=json.load(sys.stdin);print(dico["tag_name"])')
+                version="v0.121.2"
                 curl --fail-early -sL https://github.com/gohugoio/hugo/releases/download/${version}/hugo_extended_${version/v/}_linux-arm64.tar.gz -o-|tar -x -z -v -f- hugo
                 git config --global --add safe.directory $(workspaces.source.path)
                 cd docs

.tekton/go.yaml

@@ -4,10 +4,11 @@ kind: PipelineRun
 metadata:
   name: go-testing
   annotations:
-    pipelinesascode.tekton.dev/task: "[git-clone]"
     pipelinesascode.tekton.dev/max-keep-runs: "2"
-    pipelinesascode.tekton.dev/on-cel-expression: |
-      event == "pull_request" && "***/*.go".pathChanged()
+    pipelinesascode.tekton.dev/cancel-in-progress: "true"
+    pipelinesascode.tekton.dev/on-event: "pull_request"
+    pipelinesascode.tekton.dev/on-target-branch: "[*]"
+    pipelinesascode.tekton.dev/on-path-change: "[***/*.go]"
 spec:
   params:
     - name: repo_url
@@ -29,7 +30,7 @@ spec:
                 resolver: http
                 params:
                   - name: url
-                    value: https://raw.githubusercontent.com/tektoncd/catalog/main/stepaction/git-clone/0.1/git-clone.yaml
+                    value: https://raw.githubusercontent.com/openshift-pipelines/pipelines-as-code/refs/heads/main/.tekton/stepactions/git-clone.yaml
               params:
                 - name: output-path
                   value: $(workspaces.source.path)
@@ -42,7 +43,7 @@ spec:
                 resolver: http
                 params:
                   - name: url
-                    value: https://raw.githubusercontent.com/openshift-pipelines/tekton-caches/main/tekton/cache-fetch.yaml
+                    value: https://raw.githubusercontent.com/openshift-pipelines/pipelines-as-code/refs/heads/main/.tekton/tasks/cache-fetch.yaml
               params:
                 - name: patterns
                   value: ["**go.mod", "**go.sum"]
@@ -61,6 +62,8 @@ spec:
                   value: $(workspaces.source.path)/go-build-cache/cache
                 - name: GOMODCACHE
                   value: $(workspaces.source.path)/go-build-cache/mod
+                - name: GOTOOLCHAIN
+                  value: go1.21.13
               workingDir: $(workspaces.source.path)
               script: |
                 #!/usr/bin/env bash
@@ -81,6 +84,8 @@ spec:
                   value: $(workspaces.source.path)/go-build-cache/cache
                 - name: GOMODCACHE
                   value: $(workspaces.source.path)/go-build-cache/mod
+                - name: GOTOOLCHAIN
+                  value: go1.21.13
                 - name: GITHUB_REPOSITORY
                   value: "{{repo_owner}}/{{repo_name}}"
                 - name: GITHUB_PULL_REQUEST_ID
@@ -96,25 +101,30 @@ spec:
                 chmod +x ./codecov
                 ./codecov -P $GITHUB_PULL_REQUEST_ID -C {{revision}} -v
             - name: lint
-              image: golangci/golangci-lint:latest
+              image: golang:1.21
               workingDir: $(workspaces.source.path)
               env:
                 - name: GOCACHE
                   value: $(workspaces.source.path)/go-build-cache/cache
                 - name: GOMODCACHE
                   value: $(workspaces.source.path)/go-build-cache/mod
+                - name: GOTOOLCHAIN
+                  value: go1.21.13
                 - name: GOLANGCILINT_CACHE
                   value: $(workspaces.source.path)/go-build-cache/golangci-cache
+                - name: GOFLAGS
+                  value: "-buildvcs=false"
               script: |
                 #!/usr/bin/env bash
                 set -eux
+                git config --global --add safe.directory $(workspaces.source.path)
                 make lint-go
             - name: cache-upload
               ref:
                 resolver: http
                 params:
                   - name: url
-                    value: https://raw.githubusercontent.com/openshift-pipelines/tekton-caches/main/tekton/cache-upload.yaml
+                    value: https://raw.githubusercontent.com/openshift-pipelines/pipelines-as-code/refs/heads/main/.tekton/tasks/cache-upload.yaml
               params:
                 - name: patterns
                   value: ["**go.mod", "**go.sum"]

.tekton/linter.yaml

@@ -205,7 +205,7 @@ spec:
                 git config --global --add safe.directory $(workspaces.source.path)
                 project="goreleaser"
                 repo="goreleaser/goreleaser"
-                version=$(curl -H "Authorization: Bearer ${HUB_TOKEN}" -L -s https://api.github.com/repos/${repo}/releases/latest|python -c 'import sys, json;dico=json.load(sys.stdin);print(dico["tag_name"])')
+                version="v2.5.0"
                 curl -sH "Authorization: Bearer ${HUB_TOKEN}" -L https://github.com/${repo}/releases/download/${version}/${project}_Linux_arm64.tar.gz|tar -xz -C /tmp/ -f- ${project}
                 export NO_COLOR=1
                 /tmp/goreleaser check

.vale.ini

@@ -8,9 +8,6 @@ StylesPath = .vale/styles
 Packages = RedHat
 MinAlertLevel = error
 
-[*]
-BasedOnStyles = Vale, RedHat, PaaC
-
 # IgnoredScopes specifies inline-level HTML tags to ignore.
 # These tags may occur in an active scope (unlike SkippedScopes, skipped entirely) but their content still will not raise any alerts.
 # Default: ignore `code` and `tt`.
@@ -21,6 +18,9 @@ IgnoredScopes = code, tt, img, url, a, body.id
 # For AsciiDoc: by default, listingblock, and literalblock.
 SkippedScopes = script, style, pre, figure, code, tt, blockquote, listingblock, literalblock
 
+[*]
+BasedOnStyles = Vale, RedHat, PaaC
+
 RedHat.ConfigMap = NO
 RedHat.CaseSensitiveTerms = NO
 Vale.Spelling = NO
@@ -34,4 +34,3 @@ BasedOnStyles = RedHat, PaaC
 
 # Ignore code surrounded by backticks or plus sign, parameters defaults, URLs.
 TokenIgnores = (\x60[^\n\x60]+\x60), ([^\n]+=[^\n]*), (\+[^\n]+\+), (http[^\n]+\[), (\[[^\n]+\])
-

Makefile

@@ -1,5 +1,6 @@
 TARGET_NAMESPACE=pipelines-as-code
-GOLANGCI_LINT=golangci-lint
+GOLANGCI_LINT_VERSION ?= v1.59.1
+GO_TOOLCHAIN ?= go1.21.13
 GOFUMPT=gofumpt
 TKN_BINARY_NAME := tkn
 TKN_BINARY_URL := https://tekton.dev/docs/cli/\#installation
@@ -9,7 +10,18 @@ GO           = go
 TIMEOUT_UNIT = 20m
 TIMEOUT_E2E  = 45m
 GO_TEST_FLAGS +=
+GOTOOLCHAIN ?= $(GO_TOOLCHAIN)
+export GOTOOLCHAIN
 SHELL := bash
+TOPDIR := $(shell git rev-parse --show-toplevel)
+TMPDIR := $(TOPDIR)/tmp
+GOLANGCI_LINT_OS ?= $(shell uname -s | tr '[:upper:]' '[:lower:]')
+GOLANGCI_LINT_ARCH ?= $(shell uname -m | sed -e 's/x86_64/amd64/' -e 's/aarch64/arm64/')
+GOLANGCI_LINT_PACKAGE := golangci-lint-$(patsubst v%,%,$(GOLANGCI_LINT_VERSION))-$(GOLANGCI_LINT_OS)-$(GOLANGCI_LINT_ARCH)
+GOLANGCI_LINT_DIR := $(TMPDIR)/golangci-lint/$(GOLANGCI_LINT_VERSION)
+GOLANGCI_LINT_BIN := $(GOLANGCI_LINT_DIR)/golangci-lint
+GOLANGCI_LINT ?= $(GOLANGCI_LINT_BIN)
+GOLANGCI_LINT_EXTRA_ARGS ?= --concurrency=1
 
 PY_FILES := $(shell find . -type f -regex ".*\.py" -print)
 SH_FILES := $(shell find hack/ -type f -regex ".*\.sh" -print)
@@ -80,13 +92,21 @@ html-coverage: ## generate html coverage
 lint: lint-go lint-yaml lint-md lint-python lint-shell ## run all linters
 
 .PHONY: lint-go
-lint-go: ## runs go linter on all go files
+lint-go: golangci-lint ## runs go linter on all go files
 	@echo "Linting go files..."
-	@$(GOLANGCI_LINT) run ./... --modules-download-mode=vendor \
+	@$(GOLANGCI_LINT) run $(GOLANGCI_LINT_EXTRA_ARGS) ./... --modules-download-mode=vendor \
 							--max-issues-per-linter=0 \
 							--max-same-issues=0 \
 							--timeout $(TIMEOUT_UNIT)
 
+.PHONY: golangci-lint
+golangci-lint: $(GOLANGCI_LINT_BIN) ## download pinned golangci-lint into tmp
+
+$(GOLANGCI_LINT_BIN):
+	@mkdir -p $(GOLANGCI_LINT_DIR)
+	@echo "Downloading golangci-lint $(GOLANGCI_LINT_VERSION) for $(GOLANGCI_LINT_OS)-$(GOLANGCI_LINT_ARCH)"
+	@curl -fsSL "https://github.com/golangci/golangci-lint/releases/download/$(GOLANGCI_LINT_VERSION)/$(GOLANGCI_LINT_PACKAGE).tar.gz" | tar -xz -C "$(GOLANGCI_LINT_DIR)" --strip-components=1 "$(GOLANGCI_LINT_PACKAGE)/golangci-lint"
+
 .PHONY: lint-yaml
 lint-yaml: ${YAML_FILES} ## runs yamllint on all yaml files
 	@echo "Linting yaml files..."
@@ -192,5 +212,3 @@ generated: update-golden fumpt ## generate all files that needs to be generated
 .PHONY: clean
 clean: ## clean build artifacts
 	rm -fR bin
-
-

docs/content/dev/_index.md

@@ -276,6 +276,7 @@ to the tektoncd/pipeline version.
 
   ```shell
   find -name '*.go'|xargs sed -i 's,github.com/google/go-github/v56,github.com/google/go-github/v59,'
+  ```
 
 - This will update everything, sometime the library ghinstallation is not
 updated with the new version, so you will need to keep the old version kept in

go.mod

@@ -48,7 +48,7 @@ require (
 
 require (
 	github.com/coreos/go-oidc/v3 v3.9.0 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
 )
 
 replace (

go.sum

@@ -746,8 +746,8 @@ github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmn
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
-github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
+github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
 github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=

hack/dev/kind/gitea/deploy.py

@@ -250,7 +250,7 @@ def create_ingress_or_route(self):
 spec:
   port:
     targetPort: http-listener
-  { tls_mode }
+  {tls_mode}
   to:
     kind: Service
     name: gitea

hack/gh-workflow-ci.sh

@@ -129,13 +129,14 @@ get_tests() {
 }
 
 run_e2e_tests() {
-	bitbucket_cloud_token="${1}"
-	webhook_secret="${2}"
-	test_gitea_smeeurl="${3}"
-	installation_id="${4}"
-	gh_apps_token="${5}"
-	test_github_second_token="${6}"
-	gitlab_token="${7}"
+	# Accept secrets as positional args (v0.27.x workflow) or env vars (v0.37.x+ workflow)
+	local bitbucket_cloud_token="${1:-${TEST_BITBUCKET_CLOUD_TOKEN:-}}"
+	local webhook_secret="${2:-${TEST_EL_WEBHOOK_SECRET:-}}"
+	local test_gitea_smeeurl="${3:-${TEST_GITEA_SMEEURL:-}}"
+	local installation_id="${4:-${TEST_GITHUB_REPO_INSTALLATION_ID:-}}"
+	local gh_apps_token="${5:-${TEST_GITHUB_TOKEN:-}}"
+	local test_github_second_token="${6:-${TEST_GITHUB_SECOND_TOKEN:-}}"
+	local gitlab_token="${7:-${TEST_GITLAB_TOKEN:-}}"
 
 	# Nothing specific to webhook here it  just that repo is private in that org and that's what we want to test
 	export TEST_GITHUB_PRIVATE_TASK_URL="https://github.com/openshift-pipelines/pipelines-as-code-e2e-tests-private/blob/main/remote_task.yaml"
@@ -145,10 +146,10 @@ run_e2e_tests() {
 
 	export TEST_BITBUCKET_CLOUD_API_URL=https://api.bitbucket.org/2.0
 	export TEST_BITBUCKET_CLOUD_E2E_REPOSITORY=cboudjna/pac-e2e-tests
-	export TEST_BITBUCKET_CLOUD_TOKEN=${bitbucket_cloud_token}
+	export TEST_BITBUCKET_CLOUD_TOKEN="${bitbucket_cloud_token}"
 	export TEST_BITBUCKET_CLOUD_USER=cboudjna
 
-	export TEST_EL_URL="http://${CONTROLLER_DOMAIN_URL}"
+	export TEST_EL_URL="http://${CONTROLLER_DOMAIN_URL:-localhost}"
 	export TEST_EL_WEBHOOK_SECRET="${webhook_secret}"
 
 	export TEST_GITEA_API_URL="http://localhost:3000"
@@ -175,7 +176,7 @@ run_e2e_tests() {
 
 	export TEST_GITLAB_API_URL="https://gitlab.com"
 	export TEST_GITLAB_PROJECT_ID="34405323"
-	export TEST_GITLAB_TOKEN=${gitlab_token}
+	export TEST_GITLAB_TOKEN="${gitlab_token}"
 	# https://gitlab.com/gitlab-com/alliances/ibm-red-hat/sandbox/openshift-pipelines/pac-e2e-tests
 
 	# Use TEST_PROVIDER if set (matrix-based workflow), otherwise run all tests
@@ -273,7 +274,7 @@ create_second_github_app_controller_on_ghe)
 	create_second_github_app_controller_on_ghe "${2}" "${3}" "${4}"
 	;;
 run_e2e_tests)
-	run_e2e_tests "${2}" "${3}" "${4}" "${5}" "${6}" "${7}" "${8}"
+	run_e2e_tests "${2-}" "${3-}" "${4-}" "${5-}" "${6-}" "${7-}" "${8-}"
 	;;
 collect_logs)
 	collect_logs

pkg/adapter/incoming.go

@@ -58,7 +58,7 @@ func (l *listener) detectIncoming(ctx context.Context, req *http.Request, payloa
 	if req.URL.Path != "/incoming" {
 		return false, nil, nil
 	}
-	l.logger.Infof("incoming request has been requested: %v", req.URL)
+	l.logger.Infof("incoming request has been requested: %v", req.URL.Path)
 	if pipelineRun == "" || repository == "" || querySecret == "" || branch == "" {
 		err := fmt.Errorf("missing query URL argument: pipelinerun, branch, repository, secret: '%s' '%s' '%s' '%s'", pipelineRun, branch, repository, querySecret)
 		return false, nil, err
@@ -112,6 +112,7 @@ func (l *listener) detectIncoming(ctx context.Context, req *http.Request, payloa
 			return false, nil, err
 		}
 		l.event.Provider.URL = enterpriseURL
+		l.event.GHEURL = enterpriseURL
 		l.event.Provider.Token = token
 		l.event.InstallationID = installationID
 		// Github app is not installed for provided repository url

pkg/adapter/incoming_test.go

@@ -1,9 +1,10 @@
 package adapter
 
 import (
+	"context"
 	"fmt"
+	"io"
 	"net/http"
-	"net/http/httptest"
 	"os"
 	"reflect"
 	"strings"
@@ -33,6 +34,13 @@ import (
 	"github.com/openshift-pipelines/pipelines-as-code/pkg/test/kubernetestint"
 )
 
+func newRequest(t *testing.T, method, target string, body io.Reader) *http.Request {
+	t.Helper()
+	req, err := http.NewRequestWithContext(context.Background(), method, target, body)
+	assert.NilError(t, err)
+	return req
+}
+
 const fakePrivateKey = `-----BEGIN RSA PRIVATE KEY-----
 MIICXAIBAAKBgQC6GorZBeri0eVERMZQDFh5E1RMPjFk9AevaWr27yJse6eiUlos
 gY2L2vcZKLOrdvVR+TLLapIMFfg1E1qVr1iTHP3IiSCs1uW6NKDmxEQc9Uf/fG9c
@@ -682,7 +690,7 @@ func Test_listener_detectIncoming(t *testing.T) {
 			}
 
 			// make a new request
-			req := httptest.NewRequest(tt.args.method,
+			req := newRequest(t, tt.args.method,
 				fmt.Sprintf("http://localhost%s?repository=%s&secret=%s&pipelinerun=%s&branch=%s", tt.args.queryURL,
 					tt.args.queryRepository, tt.args.querySecret, tt.args.queryPipelineRun, tt.args.queryBranch),
 				strings.NewReader(tt.args.incomingBody))

pkg/adapter/sinker.go

@@ -45,12 +45,7 @@ func (s *sinker) processEventPayload(ctx context.Context, request *http.Request)
 }
 
 func (s *sinker) processEvent(ctx context.Context, request *http.Request) error {
-	if s.event.EventType == "incoming" {
-		if request.Header.Get("X-GitHub-Enterprise-Host") != "" {
-			s.event.Provider.URL = request.Header.Get("X-GitHub-Enterprise-Host")
-			s.event.GHEURL = request.Header.Get("X-GitHub-Enterprise-Host")
-		}
-	} else {
+	if s.event.EventType != "incoming" {
 		if err := s.processEventPayload(ctx, request); err != nil {
 			return err
 		}