chore: close the known risks left open after the review (#49)

* chore(ci): update every remaining action to its current major

The release, helm publish, scheduled sync, and Azure DevOps extension
workflows were still on actions targeting Node 20, which GitHub force
migrates to Node 24 today and will stop supporting. They were left behind
earlier because no pull request exercises them; that reasoning holds for
proving them, not for leaving them broken, so they are updated now and the
next tag exercises the release and helm paths for real.

goreleaser is pinned to its v2 major rather than latest. The action warned
that latest is ambiguous and locks to ~> v2 regardless, and a release is
not where a new major should first run.

* chore(deps): clear the two remaining advisories

golang.org/x/text carried an infinite loop on invalid input (GO-2026-5970)
and klauspost/compress an out of bounds read in s2 (GO-2026-5841). Neither
was reachable from SyncerD's own code, which is why they were tolerated,
but both are transitive dependencies that a later change could easily start
calling, and both had a published fix. govulncheck now reports nothing at
all rather than nothing reachable.

* test: prove SyncerD against a real provider

Everything in this repository was checked against fakes written by the same
hand as the code, and three defects that made pull request mirroring
inoperable survived a green suite, a passing verification gate, and a
review of their own change, because every fake agreed with the mistake.

Adds a live suite behind the "live" build tag: it creates two throwaway
private repositories, seeds one, opens a pull request, mirrors branches and
then objects, and asserts what actually landed. It covers exactly the
ground the fakes could not: that the destination repository path is the one
the API accepts, that a pull request is findable by its head branch after
state is lost, that a mirrored comment appears once rather than on every
run, that mentions do not survive into the destination, and that closing
the source closes the mirror. Then it deletes both repositories.

It is inert without credentials and excluded from an ordinary go test, so
CI is unchanged. make test-live runs it, and the runbook says when to.

* docs: record the risk work in the changelog

* fix(github): send an empty label array rather than null

Once the mirror owns labels, a source pull request with none produced a nil
slice, which marshals to null, and GitHub answers 422: the field has to be
an array. Clearing labels is a legitimate and common request, so this broke
the update of nearly every mirrored pull request, and the label failure was
wrapped in a way that failed the whole pull request rather than just its
labels.

Found by the live suite on its first real run against GitHub, in the first
minute it existed. No fake had an opinion about null.

---------

Co-authored-by: Anmol Nagpal <ianmolnagpal@gmail.com>

Author: clouddrove-ci

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
         with:
           version: "v3.14.0"
 

.github/workflows/helm-release.yml

@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
         with:
           version: "v3.14.0"
 
@@ -64,7 +64,7 @@ jobs:
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@v4
 
       - name: Log in to GHCR (cosign)
         run: |
@@ -79,7 +79,7 @@ jobs:
             "ghcr.io/clouddrove/charts/syncerd@${{ steps.push.outputs.digest }}"
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@v2
 
       - name: Log in to GHCR (ORAS)
         run: |

.github/workflows/publish-azure-devops-extension.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Validate secret
         shell: bash
@@ -71,7 +71,7 @@ jobs:
           echo "path=azure-devops-extension/$vsix" >> "$GITHUB_OUTPUT"
 
       - name: Upload VSIX artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: syncerd-azure-pipelines-vsix
           path: ${{ steps.vsix.outputs.path }}

.github/workflows/release.yml

@@ -14,20 +14,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: "1.26"
           cache: true
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
         with:
-          version: latest
+          # Pinned to the major rather than latest: the action warns that
+          # "latest" is ambiguous and silently locks to ~> v2 anyway, and a
+          # release should not be the place a new major first runs.
+          version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -37,24 +40,24 @@ jobs:
     needs: goreleaser
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           # Publish to the canonical image name (Marketplace action uses this).
           images: ghcr.io/clouddrove/syncerd
@@ -70,7 +73,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./Dockerfile

.github/workflows/syncerd.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version: '1.26'
           cache: false
@@ -37,15 +37,15 @@ jobs:
       # Keep only the login steps for the registries you actually use.
 
       - name: Login to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Configure AWS credentials (ECR)
         continue-on-error: true
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: Azure login (ACR)
         continue-on-error: true
-        uses: azure/login@v1
+        uses: azure/login@v3
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
@@ -71,13 +71,13 @@ jobs:
 
       - name: Authenticate to Google Cloud (GCR)
         continue-on-error: true
-        uses: google-github-actions/auth@v2
+        uses: google-github-actions/auth@v3
         with:
           credentials_json: ${{ secrets.GCP_SA_KEY }}
 
       - name: Set up gcloud (GCR)
         continue-on-error: true
-        uses: google-github-actions/setup-gcloud@v2
+        uses: google-github-actions/setup-gcloud@v3
 
       - name: Configure Docker for GCR
         continue-on-error: true

CHANGELOG.md

@@ -21,7 +21,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A failed state save on the fail-fast path was silent, so everything copied before the abort was copied again on the next run with no explanation
 - `git-sync` could not authenticate to Azure DevOps over git in `pat` mode, fixed in v0.2.1 and described there
 
+### Fixed
+- A mirrored pull request with no labels failed to update, taking the whole pull request with it. Once the mirror owned labels, an empty set was sent as null rather than as an empty array, and GitHub rejects that with 422. Most pull requests carry no labels, so this affected most of them. Found by the live suite on its first real run
+
+### Added
+- A live provider test suite behind the `live` build tag, run with `make test-live`. It creates two throwaway repositories against a real GitHub account, mirrors a pull request between them, and checks what actually landed, then deletes them. Every other test in the repository checks SyncerD against fakes written alongside the code, which is how three defects that made pull request mirroring inoperable passed a green suite and a review
+
 ### Security
+- Cleared two advisories in transitive Go modules, an infinite loop in `golang.org/x/text` and an out of bounds read in `klauspost/compress`. Neither was reachable from SyncerD's own code, but both had fixes and a later change could have started calling them
 - Patched a high severity advisory in `brace-expansion`, which the Azure DevOps extension pinned to exactly the affected version through an `overrides` entry
 
 ## [0.2.1] - 2026-08-19

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test clean install lint
+.PHONY: build test test-live clean install lint
 
 # Version info injected at build time
 VERSION ?= $(shell git describe --tags --abbrev=0 2>/dev/null | sed 's/^v//' || echo dev)
@@ -13,6 +13,17 @@ build:
 test:
 	go test -v ./...
 
+# Run the live provider tests. These talk to a real GitHub account, create
+# two throwaway repositories, use them, and delete them again. They are the
+# only tests that prove a real API call works: everything else is checked
+# against fakes written by the same hand as the code.
+#
+#   SYNCERD_LIVE_GITHUB_TOKEN=ghp_...   token with repo scope
+#   SYNCERD_LIVE_GITHUB_OWNER=acme      account or org to create under
+#   SYNCERD_LIVE_KEEP=1                 optional, skip cleanup to inspect
+test-live:
+	go test -tags live -v -timeout 15m ./internal/livetest/
+
 # Clean build artifacts
 clean:
 	rm -f syncerd

docs/git-sync-runbook.md

@@ -740,6 +740,34 @@ Only GitHub sources can list pull requests today. A mirror that enables
 
 ---
 
+## Live provider tests
+
+Every other test in this repository checks SyncerD against fakes written by
+whoever wrote the code, and that has already proved insufficient: three
+defects that made pull request mirroring inoperable survived a green suite,
+a passing verification run, and a review of their own change, because the
+fakes agreed with the mistake. A real API does not.
+
+```bash
+export SYNCERD_LIVE_GITHUB_TOKEN=ghp_...   # repo scope
+export SYNCERD_LIVE_GITHUB_OWNER=your-account
+make test-live
+```
+
+It creates two throwaway private repositories named `syncerd-live-*`, seeds
+one with a branch, opens a pull request, mirrors the branches and then the
+pull request to the other, and checks what actually landed: that the
+destination pull request exists and is findable by its head branch, that
+the body carries the marker and no live mention, that a second run changes
+nothing, that a comment mirrors exactly once, and that closing the source
+closes the mirror. Then it deletes both repositories. Set
+`SYNCERD_LIVE_KEEP=1` to leave them behind and look.
+
+Run it before a release that touches provider code. It is the only check
+that would have caught the defects above.
+
+---
+
 ## Cleanup
 
 ```bash

go.mod

@@ -34,7 +34,7 @@ require (
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/klauspost/compress v1.17.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@@ -53,8 +53,8 @@ require (
 	go.uber.org/atomic v1.9.0 // indirect
 	go.uber.org/multierr v1.9.0 // indirect
 	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
-	golang.org/x/sync v0.5.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
+	golang.org/x/sync v0.21.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -57,8 +57,8 @@ github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
 github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
-github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -125,14 +125,14 @@ go.uber.org/multierr v1.9.0 h1:7fIwc/ZtS0q++VgcfqFDxSBZVv/Xo49/SYnDFupUwlI=
 go.uber.org/multierr v1.9.0/go.mod h1:X2jQV1h+kxSjClGpnseKVIxpmcjrj7MNnI0bnlfKTVQ=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g=
 golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k=
-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
-golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220906165534-d0df966e6959/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=