From 18909e1dcd30ffe5e916725c18164e432f5a034c Mon Sep 17 00:00:00 2001 From: Artur Reznikov Date: Mon, 26 Oct 2026 14:49:23 -0700 Subject: [PATCH 1/2] fix(api/misc): address info misc Signed-off-by: Artur Reznikov --- .github/workflows/flow-build-application.yaml | 8 ++++++++ .../workflows/flow-pull-request-checks.yaml | 17 ++++++++++++++++ .github/workflows/zxc-compile-code.yaml | 9 +++++++++ .golangci.yml | 20 +++++++++++++++++++ Taskfile.yml | 13 ++++++++++++ .../networkupgradeprepare_controller.go | 2 +- internal/uc/cr_store.go | 2 +- internal/uc/log_monitor.go | 2 +- 8 files changed, 70 insertions(+), 3 deletions(-) diff --git a/.github/workflows/flow-build-application.yaml b/.github/workflows/flow-build-application.yaml index 625ceec1a..0a4f7c32a 100644 --- a/.github/workflows/flow-build-application.yaml +++ b/.github/workflows/flow-build-application.yaml @@ -29,6 +29,14 @@ defaults: run: shell: bash +permissions: + id-token: write + contents: read + actions: read + pull-requests: write + checks: write + statuses: write + jobs: code: name: Code diff --git a/.github/workflows/flow-pull-request-checks.yaml b/.github/workflows/flow-pull-request-checks.yaml index 1a4a45708..680dc4d81 100644 --- a/.github/workflows/flow-pull-request-checks.yaml +++ b/.github/workflows/flow-pull-request-checks.yaml @@ -18,6 +18,14 @@ concurrency: group: pr-checks-${{ github.workflow }}-${{ github.head_ref || github.run_id }} cancel-in-progress: true +permissions: + id-token: write + contents: read + actions: read + pull-requests: write + checks: write + statuses: write + jobs: build: name: Code @@ -32,6 +40,15 @@ jobs: custom-job-label: Check enable-lint-check: true + vuln-check: + name: Vulnerability Check + uses: ./.github/workflows/zxc-compile-code.yaml + needs: + - build + with: + custom-job-label: Govulncheck + enable-vuln-check: true + unit-tests: name: Unit Tests uses: ./.github/workflows/zxc-compile-code.yaml diff --git a/.github/workflows/zxc-compile-code.yaml b/.github/workflows/zxc-compile-code.yaml index 5dc7d1772..1ca6167cd 100644 --- a/.github/workflows/zxc-compile-code.yaml +++ b/.github/workflows/zxc-compile-code.yaml @@ -25,6 +25,11 @@ on: type: boolean required: false default: false + enable-vuln-check: + description: "Go Vulnerability Check Enabled" + type: boolean + required: false + default: false enable-docker-build: description: "Docker Build Enabled" type: boolean @@ -93,6 +98,10 @@ jobs: if: ${{ inputs.enable-lint-check && !cancelled() && !failure() }} run: task lint + - name: Vulnerability Check + if: ${{ inputs.enable-vuln-check && !cancelled() && !failure() }} + run: task vuln + - name: Unit Tests if: ${{ inputs.enable-unit-tests && !cancelled() && !failure() }} run: task test:unit diff --git a/.golangci.yml b/.golangci.yml index 729264773..4afb2e8c5 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -16,12 +16,32 @@ linters: - misspell - unconvert - gocritic + - gosec exclusions: rules: - path: _test\.go linters: - errcheck - unused + - gosec + - path: ^test/ + linters: + - gosec + # Operator-supplied CLI/config paths; UC reads are O_NOFOLLOW-hardened + - path: ^internal/(beacon|uc)/ + linters: + - gosec + text: "G304" + # math/rand only orders registry candidates + - path: ^internal/controller/ + linters: + - gosec + text: "G404" + # Reason code name, not a credential + - path: ^internal/registry/reasons\.go + linters: + - gosec + text: "G101" # Ignore deprecated Requeue field - it's still commonly used in controller-runtime - linters: - staticcheck diff --git a/Taskfile.yml b/Taskfile.yml index 3d5c1c7b2..cbf6e7fbd 100644 --- a/Taskfile.yml +++ b/Taskfile.yml @@ -162,6 +162,12 @@ tasks: cmds: - golangci-lint run --timeout=5m + vuln: + desc: Scan for reachable Go vulnerabilities (govulncheck) + deps: [ tools:govulncheck ] + cmds: + - govulncheck ./... + lint:fix: desc: Run linters and fix issues deps: [ tools:golangci-lint ] @@ -522,6 +528,7 @@ tasks: - task: tools:controller-gen - task: tools:setup-envtest - task: tools:golangci-lint + - task: tools:govulncheck - task: tools:yq # Pinned (not @latest): controller-gen output must be deterministic so @@ -546,6 +553,12 @@ tasks: - task: tools:install vars: { BIN: golangci-lint, PKG: github.com/golangci/golangci-lint/v2/cmd/golangci-lint, MOD: github.com/golangci/golangci-lint/v2, VER: v2.14.0 } + tools:govulncheck: + internal: true + cmds: + - task: tools:install + vars: { BIN: govulncheck, PKG: golang.org/x/vuln/cmd/govulncheck, MOD: golang.org/x/vuln, VER: v1.9.0 } + tools:yq: internal: true cmds: diff --git a/internal/controller/networkupgradeprepare_controller.go b/internal/controller/networkupgradeprepare_controller.go index aa60677eb..0769a5390 100644 --- a/internal/controller/networkupgradeprepare_controller.go +++ b/internal/controller/networkupgradeprepare_controller.go @@ -561,7 +561,7 @@ func (r *NetworkUpgradePrepareReconciler) targetsBySelector( common.Debug(ctx, operatorv1alpha1.ReasonPrefetchCreated). Msg("Using pod-node targeting: consensus nodeSelector matched no nodes") return nil, false - case int32(len(candidateNodes)) > maxNodes: + case len(candidateNodes) > int(maxNodes): // Genuine degradation: the matched pool is larger than the cap, so we // cannot cache on every node the pod could reschedule onto. Surface it. common.Warn(ctx, operatorv1alpha1.ReasonPrefetchCreated). diff --git a/internal/uc/cr_store.go b/internal/uc/cr_store.go index 2aa02bff4..d92627da5 100644 --- a/internal/uc/cr_store.go +++ b/internal/uc/cr_store.go @@ -91,7 +91,7 @@ func (s *CRStore) Persist(operationID, step string, cr *unstructured.Unstructure // Write atomically: write a temp file then rename, so a crash mid-write can // never leave a truncated CR on disk that recovery would try to re-send. tmp := path + ".tmp" - if err := os.WriteFile(tmp, data, 0o640); err != nil { + if err := os.WriteFile(tmp, data, 0o600); err != nil { return "", errx.WithHints( errx.WithReason(errPersist.Wrap(err, "write CR %s", tmp), ReasonCRPersistWriteFailed), "Confirm --cr-persist-path is on a writable volume with free space", diff --git a/internal/uc/log_monitor.go b/internal/uc/log_monitor.go index 84d0d5354..e028e0799 100644 --- a/internal/uc/log_monitor.go +++ b/internal/uc/log_monitor.go @@ -279,7 +279,7 @@ func (m *LogMonitor) persist(code int32, name string) { if err != nil { return } - _ = os.WriteFile(m.persistPath, data, 0o644) + _ = os.WriteFile(m.persistPath, data, 0o600) } // LogFileMtime returns the mtime of the configured consensus log file in unix From 89eb521463efeaa93737e885dcdca4516d35e5a9 Mon Sep 17 00:00:00 2001 From: Artur Reznikov Date: Tue, 27 Oct 2026 11:34:08 -0700 Subject: [PATCH 2/2] fix(github/workflow): rm write token perm Signed-off-by: Artur Reznikov --- .github/workflows/flow-build-application.yaml | 4 ---- .github/workflows/flow-pull-request-checks.yaml | 4 ---- .github/workflows/zxc-code-analysis.yaml | 3 --- .github/workflows/zxc-compile-code.yaml | 4 ---- 4 files changed, 15 deletions(-) diff --git a/.github/workflows/flow-build-application.yaml b/.github/workflows/flow-build-application.yaml index 0a4f7c32a..341b536a1 100644 --- a/.github/workflows/flow-build-application.yaml +++ b/.github/workflows/flow-build-application.yaml @@ -30,12 +30,8 @@ defaults: shell: bash permissions: - id-token: write contents: read actions: read - pull-requests: write - checks: write - statuses: write jobs: code: diff --git a/.github/workflows/flow-pull-request-checks.yaml b/.github/workflows/flow-pull-request-checks.yaml index 680dc4d81..49e387ffe 100644 --- a/.github/workflows/flow-pull-request-checks.yaml +++ b/.github/workflows/flow-pull-request-checks.yaml @@ -19,12 +19,8 @@ concurrency: cancel-in-progress: true permissions: - id-token: write contents: read actions: read - pull-requests: write - checks: write - statuses: write jobs: build: diff --git a/.github/workflows/zxc-code-analysis.yaml b/.github/workflows/zxc-code-analysis.yaml index 859bc5f79..160f07db9 100644 --- a/.github/workflows/zxc-code-analysis.yaml +++ b/.github/workflows/zxc-code-analysis.yaml @@ -55,9 +55,6 @@ defaults: permissions: contents: read actions: read - pull-requests: write - checks: write - statuses: write jobs: analyze: diff --git a/.github/workflows/zxc-compile-code.yaml b/.github/workflows/zxc-compile-code.yaml index 1ca6167cd..728b74f51 100644 --- a/.github/workflows/zxc-compile-code.yaml +++ b/.github/workflows/zxc-compile-code.yaml @@ -46,12 +46,8 @@ defaults: shell: bash permissions: - id-token: write contents: read actions: read - pull-requests: write - checks: write - statuses: write env: KIND_NODE_IMAGE: kindest/node:v1.32.2@sha256:142f543559cc55d64e1ab9341df08e5ced84bd2e893736da8f51320f26f5950b