Repository navigation
fix(security): clear open Scorecard alerts - #113
Merged
Merged
Conversation
Clears the two OSV advisories reported by Scorecard on the current dependency graph: - GO-2026-6860 - GO-2026-6866 Both are fixed in golang.org/x/net v0.62.0. The bump pulls the matching x/sync, x/sys, x/term, x/text and x/tools releases, all required by it. No API change: `go build ./...` and the full test suite pass. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
Scorecard flags unpinned images because a mutable tag can be re-pointed to different content between builds. Pin both bases to the digest the tag resolves to today: golang:1.27.2-alpine3.23 -> sha256:9e45f0eb... gcr.io/distroless/static:nonroot -> sha256:25ac8f0c... Digests verified against registry-1.docker.io and gcr.io before pinning. Dependabot keeps bumping them. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
Scorecard reports no fuzzer integration. mutateContainers is pure and runs on every admitted pod, so it is the right entry point: the target asserts no panic and that every generated request stays inside [0, limit] for the ratios the OvercommitClass CRD admits (0.0001-1), plus the no-op cases (no limits, ratio 1). Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
- Pin checkout, cache and setup-go to commit SHAs (Scorecard PinnedDependencies on ci.yml). - Add a "Unit tests" job running `make test` on every PR. E2E alone meant the suite was only exercised on PRs that touch the webhook. - Add a "Fuzz tests" job running the new target for 60s. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
The availability gate only let CodeQL run when the repository variable DEVELOPMENT_FLOW was set, so most pushes and PRs skipped scanning and Scorecard reported SAST coverage of 16/30 commits. Treat an unset variable as trunk-based development, which is what this repo does (default branch main), and keep git-flow untouched. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
`go test -fuzz` still runs the package's regular tests, and TestAPIs starts envtest, which needs KUBEBUILDER_ASSETS. Restrict the run to the fuzz target so the job does not need the API server binaries. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
SonarCloud flagged FuzzMutateContainers with go:S3776 (complexity 40, limit 15) because the corpus, the domain checks, the container builder and the four assertions all lived in the fuzz closure. Split them into fuzzInput.inDomain/container and assertRequests/assertResource: same coverage, same seeds, no behaviour change. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
|
Contributor
Author
SonarCloud: the 3 remaining smells are deliberateThe first analysis flagged 4 new code smells. The The other three are
Digest-only would silence the rule and freeze the images. If you prefer the rule off instead, I can add a |
enriqueavindi
added a commit
that referenced
this pull request
Nov 5, 2026
* feat(olm): publish-ready metadata for OperatorHub The CSV was still the operator-sdk scaffold: placeholder link, scaffold maintainer, no category, no long description, and alm-examples with `spec: null` because the samples carried the TODO stub. - displayName, three-section description (what it does / features / prerequisites) and the short annotation the hub shows in listings. - links: docs pinned to the release tag, source code, blog post. The scaffold URL https://k8s-overcommit.domain is gone. - maintainers: real name, team alias as contact. provider: InditexTech with its URL, same shape as redkey-operator. - categories: OpenShift Optional; containerImage, repository, support and extra keywords added. - samples get valid specs, so alm-examples renders usable objects. - icon re-cut to a 700x700 square (it was 750x1000, the hub shows it in a square slot). Same artwork, only the viewBox changes. - cert-manager declared in bundle/metadata/dependencies.yaml as two olm.gvk entries (Certificate, Issuer). Not olm.package on purpose: any provider satisfies it, so clusters already running cert-manager outside OLM do not get a second one installed on top. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com> * chore(release): 1.3.5 Bump VERSION, chart appVersion, chart image tag and catalog source to 1.3.5 and regenerate the bundle, so the release workflow's four-way version check stays consistent. The bundle now carries the metadata from the previous commit plus the x/net bump from #113. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com> * style(chart): normalize whitespace in Helm template directives SonarCloud flags the `Consistency` rule on `{{...}}` and `{{ ...}}` in the chart templates. Whitespace inside a template directive is ignored by the Go template parser, so the rendered output is byte-identical: verified with `helm template` before and after the change. The generated copy under `deploy/chart/1.3.5/` is regenerated with `make bundle`. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com> * fix(olm): use the team contact email for maintainers Replaces the placeholder with the infrastructure team address that will receive OperatorHub notifications. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com> * feat(olm): declare OpenShift 4.15+ as the supported catalog range OCP 4.x ships Kubernetes 1.(x+13), so OCP 4.15 is the first release with Kubernetes 1.28, where `matchConditions` is enabled by default in the admissionregistration API. The generated MutatingWebhookConfiguration uses that field to honour `spec.excludedNamespaces`; on an older API server the field is pruned and the webhook would apply to every namespace, including kube-system and openshift-*. `minKubeVersion` is raised to 1.28.0 for the same reason: it is the claim OLM enforces before installing on a plain Kubernetes cluster. `operator-sdk generate bundle` does not carry the annotation from the CSV into `metadata/annotations.yaml` nor into `bundle.Dockerfile`, so `make bundle` injects it (idempotently) after generation. Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com> --------- Signed-off-by: Enrique Andrés Villar <enriqueavi@inditex.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
Scorecard reports 12 open code scanning alerts on
main. This PR clears the 10 that can be fixed in code, and documents the 2 that are not code at the bottom.golang.org/x/netv0.60.0 → v0.62.0, fixes GO-2026-6860 and GO-2026-6866Dockerfileandhack/tilt/Dockerfilecheckout,cacheandsetup-gopinned by commit SHA inci.ymlFuzzMutateContainersinpkg/overcommit/fuzz_test.go, plus a 60s fuzz jobDEVELOPMENT_FLOWto be set (it defaulted to "off" on a fresh repo)Details
Dependency bump.
mutateContainersand the webhook path are untouched; the only change isgo.mod/go.sum. The bump drags in the matchingx/sync,x/sys,x/term,x/textandx/toolsreleases, whichx/netv0.62.0 requires.Digests. Both digests were resolved from the registries before pinning, not copied from the Scorecard tip:
golang:1.27.2-alpine3.23→sha256:9e45f0eb…(registry-1.docker.io)gcr.io/distroless/static:nonroot→sha256:25ac8f0c…(gcr.io)Fuzz target.
mutateContainersis pure and runs on every admitted pod, so it is the right entry point. The target asserts no panic and that every generated request stays inside[0, limit]for the ratios theOvercommitClassCRD admits (0.0001–1), including the no-op paths (no limits, ratio 1). Inputs are restricted to the CRD-validated domain so the test is a regression net and not an overflow hunt.CodeQL gate. The
scanning-availabilityjob requiredvars.DEVELOPMENT_FLOW == 'trunk-based-development'; the variable is not set on this repository, so only the weekly schedule ran and Scorecard saw SAST on 16 of the last 30 commits. An unset variable is now treated as trunk-based (the flow this repo actually uses); thegit-flowbranch is unchanged.Verification
Not in this PR
mainneeds protection (required review, required status checks, no force-push, signed commits). Happy to paste thegh apicall if you want to apply it.Both remaining alerts will keep showing until those two actions happen. #24 counts the last 30 merged PRs, so it clears once enough PRs land with the new job; #15 needs the next push to
mainto run CodeQL.