diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 570d727..e20bf03 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -49,7 +49,7 @@ jobs: - if: matrix.build-mode == 'manual' env: # fix "go: download go1.22 for linux/amd64: toolchain not available" error - GOTOOLCHAIN: "go1.26.5" + GOTOOLCHAIN: "go1.27.1" run: | make go-build diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 98f3dc9..1c75896 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -27,4 +27,4 @@ jobs: - name: golangci-lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - version: v2.11.4 + version: v2.13.2 diff --git a/.github/workflows/gosec.yml b/.github/workflows/gosec.yml index 5884ae3..e629017 100644 --- a/.github/workflows/gosec.yml +++ b/.github/workflows/gosec.yml @@ -24,7 +24,7 @@ jobs: persist-credentials: false - name: Run Gosec Security Scanner env: - GOTOOLCHAIN: "go1.26.5" + GOTOOLCHAIN: "go1.27.1" uses: securego/gosec@deb54465fea23d19a77f037e11e6589021f8501d # v2.29.0 with: args: ./... diff --git a/.ko.yaml b/.ko.yaml index 8b3cc32..e6b3294 100644 --- a/.ko.yaml +++ b/.ko.yaml @@ -1,4 +1,4 @@ -defaultBaseImage: cgr.dev/chainguard/static +defaultBaseImage: cgr.dev/chainguard/static:latest@sha256:f51c2493951313c3ad4069080b2814ffb6ed6fe3909dabeb84a9482f42d5600b defaultPlatforms: # possible values: all, linux/s390x, linux/arm64, linux/arm/v7, linux/ppc64le, linux/amd64 - linux/arm64 diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 29e0e4e..bd36ba1 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -23,7 +23,7 @@ repos: - id: go-imports - id: go-unit-tests - repo: https://github.com/golangci/golangci-lint - rev: v2.12.2 + rev: v2.13.2 hooks: - id: golangci-lint - repo: local @@ -32,6 +32,6 @@ repos: name: gosec entry: gosec language: golang - additional_dependencies: ['github.com/securego/gosec/v2/cmd/gosec@v2.25.0'] + additional_dependencies: ['github.com/securego/gosec/v2/cmd/gosec@v2.29.0'] args: ["./..."] pass_filenames: false diff --git a/CLAUDE.md b/CLAUDE.md index a303126..f2c2581 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -64,9 +64,23 @@ gh release view --repo google/ko --json tagName -q '.tagName' Then update `KO_VERSION` in [Makefile](Makefile) accordingly. -### 6. Update GitHub Actions versions +### 6. Update the ko base image digest -All workflow files under [.github/workflows/](.github/workflows/) pin actions by commit SHA with a tag comment, e.g.: +[.ko.yaml](.ko.yaml) pins the base image by digest. Dependabot cannot watch `.ko.yaml`, so this must be updated manually: + +```bash +crane digest cgr.dev/chainguard/static:latest +``` + +Then update the `@sha256:...` digest in `defaultBaseImage`: + +```yaml +defaultBaseImage: cgr.dev/chainguard/static:latest@sha256: +``` + +### 7. Update GitHub Actions versions + +All workflow files under [.github/workflows/](.github/workflows/) and the composite action [.github/actions/publish-image/action.yaml](.github/actions/publish-image/action.yaml) pin actions by commit SHA with a tag comment, e.g.: ```yaml uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -97,9 +111,10 @@ Actions used across the workflows: | `actions/checkout` | all | | `actions/dependency-review-action` | dependency-review.yml | | `actions/setup-go` | release.yml, golangci-lint.yml | -| `actions/upload-artifact` | scorecard.yml | +| `actions/upload-artifact` | scorecard.yml, actions/publish-image/action.yaml | | `anchore/sbom-action` | release.yml | | `creekorful/goreportcard-action` | release.yml | +| `CycloneDX/gh-gomod-generate-sbom` | actions/publish-image/action.yaml | | `docker/login-action` | release.yml | | `github/codeql-action` | codeql.yml, scorecard.yml | | `golangci/golangci-lint-action` | golangci-lint.yml — also update `version:` param to match `rev` in [.pre-commit-config.yaml](.pre-commit-config.yaml) | @@ -111,7 +126,7 @@ Actions used across the workflows: | `slsa-framework/slsa-github-generator` | release.yml (**tag only**) | | `slsa-framework/slsa-verifier` | release-verification.yml | -### 7. Update pre-commit hooks +### 8. Update pre-commit hooks [.pre-commit-config.yaml](.pre-commit-config.yaml) pins the `rev` of each hook repository. Update all revisions to their latest tags: @@ -125,7 +140,7 @@ This updates the `rev` fields for all four repos in [.pre-commit-config.yaml](.p - `dnephin/pre-commit-golang` - `golangci/golangci-lint` -### 8. Verify +### 9. Verify ```bash go build ./... diff --git a/Makefile b/Makefile index f513296..0d6ac11 100644 --- a/Makefile +++ b/Makefile @@ -17,7 +17,7 @@ DESCRIPTION ?= Export Proxmox Backup Server metrics for Prometheus .PHONY: go-tidy go-tidy: - go mod tidy -compat=1.26 + go mod tidy -compat=1.27 @echo "Go modules tidied." .PHONY: go-update @@ -35,7 +35,7 @@ go-build: # TOOLS # ######### -KO_VERSION = v0.18.1 +KO_VERSION = v0.19.1 KO = $(shell pwd)/bin/ko ko: diff --git a/go.mod b/go.mod index f7e320a..58fe50c 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/natrontech/pbs-exporter -go 1.26.5 +go 1.27.1 require github.com/prometheus/client_golang v1.24.1 @@ -8,9 +8,9 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect - github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.70.1 // indirect - github.com/prometheus/procfs v0.21.1 // indirect + github.com/prometheus/client_model v0.6.3 // indirect + github.com/prometheus/common v0.71.0 // indirect + github.com/prometheus/procfs v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect - google.golang.org/protobuf v1.36.11 // indirect + google.golang.org/protobuf v1.36.12 // indirect ) diff --git a/go.sum b/go.sum index 5dd0cea..9e0a509 100644 --- a/go.sum +++ b/go.sum @@ -2,8 +2,6 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= @@ -12,25 +10,23 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU= github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE= -github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= -github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY= -github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc= -github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI= -github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo= +github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM= +github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8= +github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk= +github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics= +github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= -google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= diff --git a/main.go b/main.go index f575def..1988569 100644 --- a/main.go +++ b/main.go @@ -273,6 +273,7 @@ type Exporter struct { } func ReadSecretFile(secretfilename string) string { + // #nosec G703 -- path comes from operator-set *_FILE env vars (docker secrets), not untrusted input file, err := os.Open(filepath.Clean(secretfilename)) // flag to check the file format if err != nil {