chore: add test, security and build-and-push CI workflows [#5] - #14
Open
nisargabd wants to merge 9 commits into
Open
chore: add test, security and build-and-push CI workflows [#5]#14nisargabd wants to merge 9 commits into
nisargabd wants to merge 9 commits into
Conversation
Adds a run-tests/security/build-and-push flow: gated lint, gotestsum with diff-scoped coverage, dependency+image Trivy scans gated on HIGH/CRITICAL, multi-registry multi-arch build-and-push on release tags. Both Dockerfiles switch to dhi.io base images (with public overrides for a local build without a DHI subscription), so the security and build-and-push jobs authenticate to dhi.io first.
… dependency [#5] security.yml's Trivy gate failed on unpatched CVEs in dhi.io/debian-base's bundled perl-base, ncurses, util-linux and zlib1g -- none of which the adapter uses. Neither can move to the fully static dhi.io/static image though: the adapter loads plugin .so files at runtime via Go's `plugin` package, which needs cgo and a real glibc dynamic linker to work at all. dhi.io/static's glibc variant is the middle ground -- keeps libc6 so plugin.Open still works, drops everything else the scan was flagging. That variant has no shell, so CMD's `sh -c "./server --config=$CONFIG_FILE"` can no longer expand the env var. Switched to an exec-form ENTRYPOINT and taught main.go to read CONFIG_FILE itself as the --config default.
…wn CVEs [#5] security.yml's trivy-deps scan flagged CVE-2026-56854 (x/crypto, CRITICAL) and CVE-2026-84304 (grpc, HIGH), both with fixed versions already published upstream.
Ran on every push including this branch and always failed here -- missing Gerrit credentials for the private Terraform-CICD repo it clones. workflow_dispatch stays, so it's still runnable by hand; kept, not deleted, pending a decision on whether it's folded into build-and-push.yml or removed outright.
…ersions [#5] This is CI setup, not a dependency-bump PR -- the two CVEs trivy-deps flags (CVE-2026-56854, CVE-2026-84304) are real and the scan catching them is working as intended; the actual bump is deferred to its own change.
Dockerfile.adapter goes back to the original public base images -- Dockerfile.adapter-with-plugins is the one actually deployed, so that's the one that needs the CVE fix. Keeps dhi.io/static's glibc-only variant (clears the unpatched perl-base/ncurses/util-linux/zlib1g CVEs, keeps libc6 so plugin.Open still works) but drops the main.go change entirely: Deployment/deployment.yaml now passes --config=$(CONFIG_FILE) via args, letting the kubelet do the substitution instead of a shell inside the container.
…dapter [#5] security.yml and build-and-push.yml still pointed at Dockerfile.adapter, which we just reverted back to the original, unpatched base images -- so the security gate was scanning the wrong Dockerfile and the CVE fix never took effect. Dockerfile.adapter-with-plugins is the one actually deployed and the one carrying the DHI glibc-only runtime fix.
🛡️ Trivy — Go dependency scan (HIGH,CRITICAL)
|
🛡️ Trivy — image scan (HIGH,CRITICAL)No HIGH or CRITICAL findings. |
…ce+coverage run [#5] pkg/plugin and benchmarks/e2e each build a real .so via a subprocess `go build -buildmode=plugin`, then load it with plugin.Open in the same test run. Instrumenting the whole module for coverage/race in one ./... build gives a shared package a different build identity than the plain subprocess build produces, so plugin.Open rejects the .so. Split them into their own go test invocation and merge the coverage output.
|
📊 Test Coverage: ✅ Passed — not applicable, no changed Go files vs origin/development |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
run-tests.yml— lint (advisory) + tests viagotestsum, with diff-scoped coverage posted as a PR commentsecurity.yml— Trivy dependency scan + image scan (built fromDockerfile.adapter-with-plugins), SARIF uploaded to the Security tab, gated on HIGH/CRITICAL findingsbuild-and-push.yml— multi-arch (amd64/arm64) image build onvX.Y.Ztags, Trivy release gate before push, multi-registry pushMakefile—build/test/test-ci/cover-diff/lint/trivy-*targets, the single source of truth both the workflows and a localmakecall useDockerfile.adapter-with-plugins(the image actually deployed) switched todhi.io(Docker Hardened Images) glibc-only runtime;Dockerfile.adapteris unchangedDeployment/deployment.yaml— passes--configvia Kubernetes' native$(CONFIG_FILE)arg substitution, since the hardened runtime has no shell to do it itself.github/actions/dhi-login— composite action to authenticate to dhi.io, used bysecurity.ymlandbuild-and-push.ymlonix-gcp-terraform-deploy.yml— disabled itspushtrigger (keptworkflow_dispatchonly); it was failing on every push for unrelated reasonsWhy
No consistent test/security/release pipeline existed for this repo. This adds one: gated tests with coverage feedback on PRs, dependency and image vulnerability scanning before merge, and a signed-off multi-arch release path on tag push.
Testing
go build ./cmd/adapter/...,go vet ./...,go test -race ./...pass locally (one pre-existing, non-deterministic failure:pkg/plugin'svalid_config_with_so_filesubtest — a checked-in.sofixture that only loads when it matches the active Go toolchain's ABI fingerprint; unrelated to this change)make lint,make test-ci,make trivy-deps,make trivy-imagerun clean locallyCloses #5