pkg/osquery: fix flaky secretless enrollment test (#2805) #5315
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: lint | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: '**' | |
| merge_group: | |
| types: [checks_requested] | |
| permissions: | |
| contents: read | |
| jobs: | |
| golangci: | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [macos-latest, windows-latest, ubuntu-latest] | |
| name: lint | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit # Audit network and disk activity | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: './go.mod' | |
| check-latest: true | |
| cache: false | |
| - run: make deps | |
| - name: golangci-lint | |
| uses: step-security/golangci-lint-action@ce3368d2f0a15c79206a120861e3f847c8beb466 # v9.2.1 | |
| with: | |
| skip-save-cache: true | |
| # Run again as a workaround for https://github.com/golangci/golangci-lint-action/issues/362 | |
| - name: golangci-lint | |
| if: ${{ always() }} | |
| run: golangci-lint run | |
| govulncheck: | |
| permissions: | |
| contents: read | |
| id-token: write # Required to create an OIDC token for Cloudsmith auth | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [macos-latest, windows-latest, ubuntu-latest] | |
| name: govulncheck | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit # Audit network and disk activity | |
| - name: Setup Cloudsmith CLI # Exports CLOUDSMITH_API_KEY | |
| uses: step-security/cloudsmith-cli-action@dd1da513017145043c2d29a38b3b85c2b609b5ad # v2.0.3 | |
| # We don't distribute any artifacts from this job, but we still use Cloudsmith where we can (main and tags). | |
| if: github.ref == 'refs/heads/main' || github.ref_type == 'tag' | |
| with: | |
| oidc-auth-only: 'true' # Just the auth, don't need the CLI installed in CI | |
| oidc-namespace: '1password' | |
| oidc-service-slug: 'ga-kolide-launcher' | |
| - name: Configure GOPROXY | |
| # We don't distribute any artifacts from this job, but we still use Cloudsmith where we can (main and tags). | |
| # cloudsmith-cli-action should mask the API key, but we add additional masks just to be safe. | |
| if: github.ref == 'refs/heads/main' || github.ref_type == 'tag' | |
| shell: bash | |
| run: | | |
| echo "::add-mask::${CLOUDSMITH_API_KEY}" | |
| [ -z "${CLOUDSMITH_API_KEY:-}" ] && exit 1 | |
| goproxy="https://token:${CLOUDSMITH_API_KEY}@go.pkg.1infra.dev/op-golang/" | |
| echo "::add-mask::$goproxy" | |
| echo "GOPROXY=$goproxy" >> "$GITHUB_ENV" | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: './go.mod' | |
| check-latest: true | |
| cache: false | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@3e6f44f962742443c11ae2261f02e0c917aeb2bc # v1.5.0 | |
| shell: bash | |
| # For false positives, filtering out in jq by `select(.osv != "GO-2024-3166")` | |
| # and exiting 0 early allows ignoring specific vulns. | |
| - id: govulncheck | |
| shell: bash | |
| run: | | |
| if govulncheck -C . ./...; then | |
| echo "govulncheck exited zero" | |
| exit 0 | |
| fi | |
| echo "govulncheck exited non-zero, capturing output" | |
| govulncheck -C . -format json ./... > govulncheck.json | |
| findingCount=$(jq -r '.finding | select ( . != null ) | .osv' govulncheck.json | wc -l) | |
| findingCount=$((findingCount + 0)) | |
| printf "govulncheck reports %d findings" "$findingCount" | |
| jq -r '.finding | select ( . != null )' govulncheck.json | |
| exit 1 | |
| table_specs: | |
| permissions: | |
| contents: read | |
| id-token: write # Required to create an OIDC token for Cloudsmith auth | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [macos-latest, windows-latest, ubuntu-latest] | |
| name: table specs | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit # Audit network and disk activity | |
| - name: Setup Cloudsmith CLI # Exports CLOUDSMITH_API_KEY | |
| uses: step-security/cloudsmith-cli-action@dd1da513017145043c2d29a38b3b85c2b609b5ad # v2.0.3 | |
| # We don't distribute the results of running table specs here, but we use Cloudsmith where we can (main and tags) nonetheless. | |
| if: github.ref == 'refs/heads/main' || github.ref_type == 'tag' | |
| with: | |
| oidc-auth-only: 'true' # Just the auth, don't need the CLI installed in CI | |
| oidc-namespace: '1password' | |
| oidc-service-slug: 'ga-kolide-launcher' | |
| - name: Configure GOPROXY | |
| # We don't distribute the results of running table specs here, but we use Cloudsmith where we can (main and tags) nonetheless. | |
| # cloudsmith-cli-action should mask the API key, but we add additional masks just to be safe. | |
| if: github.ref == 'refs/heads/main' || github.ref_type == 'tag' | |
| shell: bash | |
| run: | | |
| echo "::add-mask::${CLOUDSMITH_API_KEY}" | |
| [ -z "${CLOUDSMITH_API_KEY:-}" ] && exit 1 | |
| goproxy="https://token:${CLOUDSMITH_API_KEY}@go.pkg.1infra.dev/op-golang/" | |
| echo "::add-mask::$goproxy" | |
| echo "GOPROXY=$goproxy" >> "$GITHUB_ENV" | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: './go.mod' | |
| check-latest: true | |
| cache: false | |
| - run: make deps | |
| - name: Build launcher | |
| run: go build -o ./build/launcher ./cmd/launcher | |
| - name: Check table specs | |
| run: ./build/launcher specs --required description --required name --quiet | |
| # This job is here as a github status check -- it allows us to move | |
| # the merge dependency from being on all the jobs to this single | |
| # one. | |
| lint_mergeable: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit # Audit network and disk activity | |
| - run: true | |
| needs: | |
| - golangci | |
| - govulncheck | |
| - table_specs |