Skip to content

Commit 2d4ddda

Browse files
parttimenerdparttimenerd
committed
fix: bump vulnerable deps and extend PR validation CI
deps: - golang.org/x/crypto v0.52.0 → v0.56.0 (fixes GO-2026-6303/6354/6355) - golang.org/x/text v0.37.0 → v0.41.0 (fixes GO-2026-5970) - golang.org/x/sys/term bumped transitively ci (pr-validation.yml): - add explicit `go test -v -race ./...` step to the validate job - split off a `build` job (matrix: ubuntu/macos/windows) that runs after validate passes; each OS runs `go test -race`, builds the plugin with build.py, and uploads artifacts so colleagues can download and test the binaries directly from the Actions run page
1 parent 08f904e commit 2d4ddda

3 files changed

Lines changed: 68 additions & 54 deletions

File tree

‎.github/workflows/pr-validation.yml‎

Lines changed: 53 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ permissions:
1010
contents: read
1111

1212
jobs:
13-
validate-pr:
14-
name: Validate Pull Request
13+
validate:
14+
name: Lint & Test
1515
runs-on: ubuntu-latest
1616

1717
steps:
@@ -52,9 +52,6 @@ jobs:
5252
- name: Run govulncheck
5353
run: |
5454
go install golang.org/x/vuln/cmd/govulncheck@latest
55-
# Run in JSON mode and emit GitHub Actions warning annotations for each finding.
56-
# govulncheck outputs multi-line JSON objects (not line-delimited), so we use
57-
# raw_decode to parse successive top-level objects from the output stream.
5855
govulncheck -json . 2>/dev/null | python3 -c "
5956
import sys, json
6057
decoder = json.JSONDecoder()
@@ -90,15 +87,16 @@ jobs:
9087
- name: Lint Go code
9188
run: ./scripts/lint-go.sh ci
9289

90+
- name: Run Go tests
91+
run: go test -v -race ./...
92+
9393
- name: Check Python test suite
9494
id: check-python
9595
run: |
9696
if [ -f "test/requirements.txt" ] && [ -f "test/setup.sh" ]; then
9797
echo "python_tests_exist=true" >> $GITHUB_OUTPUT
98-
echo "✅ Python test suite found"
9998
else
10099
echo "python_tests_exist=false" >> $GITHUB_OUTPUT
101-
echo "⚠️ Python test suite not found - skipping Python validation"
102100
fi
103101
104102
- name: Setup Python environment
@@ -117,48 +115,54 @@ jobs:
117115
- name: Lint Markdown files
118116
run: ./scripts/lint-markdown.sh ci
119117

120-
# TODO: Re-enable Python tests when ready
121-
# - name: Run Python tests
122-
# if: steps.check-python.outputs.python_tests_exist == 'true'
123-
# run: |
124-
# cd test
125-
# source venv/bin/activate
126-
# echo "🧪 Running Python tests..."
127-
# if ! pytest -v --tb=short; then
128-
# echo "❌ Python tests failed."
129-
# exit 1
130-
# fi
131-
# echo "✅ Python tests passed!"
132-
# env:
133-
# CF_API: ${{ secrets.CF_API }}
134-
# CF_USERNAME: ${{ secrets.CF_USERNAME }}
135-
# CF_PASSWORD: ${{ secrets.CF_PASSWORD }}
136-
# CF_ORG: ${{ secrets.CF_ORG }}
137-
# CF_SPACE: ${{ secrets.CF_SPACE }}
118+
build:
119+
name: Build (${{ matrix.os }})
120+
needs: validate
121+
runs-on: ${{ matrix.os }}
122+
strategy:
123+
matrix:
124+
os: [ubuntu-latest, macos-latest, windows-latest]
138125

139-
- name: Build plugin
140-
run: |
141-
echo "🔨 Building plugin..."
142-
if ! python3 .github/workflows/build.py; then
143-
echo "❌ Build failed."
144-
exit 1
145-
fi
146-
echo "✅ Build successful!"
126+
steps:
127+
- name: Checkout code
128+
uses: actions/checkout@v6
129+
130+
- name: Set up Go
131+
uses: actions/setup-go@v6
132+
with:
133+
go-version: ">=1.23.5"
134+
135+
- name: Set up Python
136+
uses: actions/setup-python@v6
137+
with:
138+
python-version: "3.11"
147139

148-
- name: Validation Summary
140+
- name: Download JStall minimal JAR for go:embed
141+
shell: bash
149142
run: |
150-
echo ""
151-
echo "🎉 Pull Request Validation Summary"
152-
echo "=================================="
153-
echo "✅ Go code formatting and linting"
154-
echo "✅ Go tests"
155-
echo "✅ Markdown formatting and linting"
156-
if [ "${{ steps.check-python.outputs.python_tests_exist }}" == "true" ]; then
157-
echo "✅ Python code quality checks"
158-
echo "✅ Python tests"
159-
else
160-
echo "⚠️ Python tests skipped (not found)"
161-
fi
162-
echo "✅ Plugin build"
163-
echo ""
164-
echo "🚀 Ready for merge!"
143+
mkdir -p dist
144+
curl -fsSL -o dist/jstall-minimal.jar https://github.com/parttimenerd/jstall/releases/latest/download/jstall-minimal.jar
145+
146+
- name: Download hprof-redact binaries for go:embed
147+
shell: bash
148+
run: python3 .github/workflows/build.py --deps-only
149+
150+
- name: Install Go dependencies
151+
run: go mod tidy -e || true
152+
153+
- name: Run Go tests
154+
shell: bash
155+
run: go test -race ./...
156+
157+
- name: Build plugin
158+
shell: bash
159+
run: python3 .github/workflows/build.py
160+
161+
- name: Upload artifacts
162+
uses: actions/upload-artifact@v4
163+
with:
164+
name: cf-cli-java-plugin-${{ matrix.os }}
165+
path: |
166+
dist/*
167+
!dist/jstall-minimal.jar
168+
!dist/hprof-redact-*

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module cf.plugin.ref/requires
22

3-
go 1.25.0
3+
go 1.26.0
44

55
require (
66
code.cloudfoundry.org/cli v0.0.0-20250623142502-fb19e7a825ee
@@ -33,10 +33,10 @@ require (
3333
github.com/sirupsen/logrus v1.9.3 // indirect
3434
github.com/stretchr/testify v1.10.0 // indirect
3535
github.com/vito/go-interact v0.0.0-20171111012221-fa338ed9e9ec // indirect
36-
golang.org/x/crypto v0.52.0 // indirect
37-
golang.org/x/sys v0.45.0 // indirect
38-
golang.org/x/term v0.43.0 // indirect
39-
golang.org/x/text v0.37.0 // indirect
36+
golang.org/x/crypto v0.56.0 // indirect
37+
golang.org/x/sys v0.47.0 // indirect
38+
golang.org/x/term v0.45.0 // indirect
39+
golang.org/x/text v0.41.0 // indirect
4040
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
4141
gopkg.in/cheggaaa/pb.v1 v1.0.28 // indirect
4242
gopkg.in/yaml.v2 v2.4.0 // indirect

‎go.sum‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -192,6 +192,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
192192
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
193193
golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
194194
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
195+
golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=
196+
golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I=
195197
golang.org/x/exp/typeparams v0.0.0-20220218215828-6cf2b201936e/go.mod h1:AbB0pIl9nAr9wVwH+Z2ZpaocVmF5I4GyWCDIsVjR0bk=
196198
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
197199
golang.org/x/mod v0.6.0-dev.0.20220106191415-9b9b3d81d5e3/go.mod h1:3p9vT2HGsQu2K1YbXdKPJLVgG5VJdoTa1poYQBtP1AY=
@@ -211,6 +213,7 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
211213
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
212214
golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
213215
golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
216+
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
214217
golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
215218
golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
216219
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -243,11 +246,15 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
243246
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
244247
golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
245248
golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
249+
golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
250+
golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
246251
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
247252
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
248253
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
249254
golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
250255
golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
256+
golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
257+
golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
251258
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
252259
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
253260
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -256,6 +263,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
256263
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
257264
golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
258265
golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
266+
golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
267+
golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
259268
golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
260269
golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
261270
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -267,6 +276,7 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
267276
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
268277
golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
269278
golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
279+
golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
270280
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
271281
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
272282
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

0 commit comments

Comments
 (0)