Skip to content

OAPE-836: V1.42.3 Rebase openshift/main with upstream v1.42.3 #82

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mytreya-rh wants to merge 22 commits into
base: main
Choose a base branch
from
Open

OAPE-836: V1.42.3 Rebase openshift/main with upstream v1.42.3 #82

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
37fd656
Bump pyasn1 from 0.6.2 to 0.6.3 in /images/ansible-operator (#208)
dependabot[bot] Mar 18, 2026
6e872a2
Bump google.golang.org/grpc from 1.75.1 to 1.79.3 (#209)
dependabot[bot] Mar 19, 2026
42d48f6
prepping for v1.42.2 release (#210)
acornett21 Mar 19, 2026
c733426
Bump requests from 2.32.5 to 2.33.0 in /images/ansible-operator (#214)
dependabot[bot] Mar 26, 2026
9e85212
Bump cryptography from 46.0.5 to 46.0.6 in /images/ansible-operator (…
dependabot[bot] Mar 30, 2026
18c9c89
Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#216)
dependabot[bot] Apr 8, 2026
5442b0b
Bump cryptography from 46.0.6 to 46.0.7 in /images/ansible-operator (…
dependabot[bot] Apr 9, 2026
72de1b2
Bump urllib3 from 2.6.3 to 2.7.0 in /images/ansible-operator (#219)
dependabot[bot] May 12, 2026
2394dcb
Bump idna from 3.11 to 3.15 in /images/ansible-operator (#220)
dependabot[bot] Jun 22, 2026
52a0510
Bump actions/checkout from 6 to 7 (#224)
dependabot[bot] Jun 22, 2026
b94aff5
Bump cryptography from 46.0.7 to 48.0.1 in /images/ansible-operator (…
dependabot[bot] Jun 22, 2026
75d7d15
updating ginko/gomega and counterfeiter to latest versions (#226)
acornett21 Jun 22, 2026
28041d1
update pip/pipenv to modern version, also remove them from final imag…
acornett21 Jun 23, 2026
8fc8c16
Bump ubi9/ubi-minimal from 9.7 to 9.8 in /images/ansible-operator (#221)
dependabot[bot] Jun 23, 2026
4ad0a4d
Update Go version from 1.25.7 to 1.26.3 to address CVEs (#228)
acornett21 Jun 23, 2026
292a56a
prepping for v1.42.3 release (#229)
acornett21 Jun 25, 2026
5c3c790
UPSTREAM: <carry>: automate hermetic build requirements generation
mytreya-rh May 7, 2026
1703a4c
UPSTREAM: <carry>: rebase_upstream.sh: allow reusing a pre-existing r…
mytreya-rh Jul 26, 2026
58828e7
Merge upstream tag v1.42.3
mytreya-rh Jul 26, 2026
6517d2a
UPSTREAM: <drop>: Update vendor directory
mytreya-rh Jul 26, 2026
befafa9
UPSTREAM: <carry>: Update ansible_collections directory
mytreya-rh Jul 26, 2026
d822aff
UPSTREAM: <carry>: Update downstream requirements
mytreya-rh Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@v6
uses: actions/checkout@v7

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf 'Occurrences of actions/checkout in workflow files:\n'
rg -n "actions/checkout@" .github/workflows

printf '\nRelevant file excerpts:\n'
for f in .github/workflows/release.yml .github/workflows/test-ansible.yml .github/workflows/test-sanity.yml .github/workflows/unit.yml; do
  echo "==== $f ===="
  nl -ba "$f" | sed -n '1,120p'
  echo
done

Repository: openshift/ansible-operator-plugins

Length of output: 736

Pin actions/checkout to full commit SHAs. @v7 is a mutable tag and leaves the workflow supply chain unpinned.

  • .github/workflows/release.yml (lines 28, 66)
  • .github/workflows/test-ansible.yml (lines 10, 23)
  • .github/workflows/test-sanity.yml (line 10)
  • .github/workflows/unit.yml (line 10)
📍 Affects 4 files
  • .github/workflows/release.yml#L28-L28 (this comment)
  • .github/workflows/release.yml#L66-L66
  • .github/workflows/test-ansible.yml#L10-L10
  • .github/workflows/test-ansible.yml#L23-L23
  • .github/workflows/test-sanity.yml#L10-L10
  • .github/workflows/unit.yml#L10-L10
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml at line 28, Pin every actions/checkout
invocation to a full immutable commit SHA instead of the mutable `@v7` tag: update
.github/workflows/release.yml at lines 28-28 and 66-66,
.github/workflows/test-ansible.yml at lines 10-10 and 23-23,
.github/workflows/test-sanity.yml at line 10, and .github/workflows/unit.yml at
line 10.

Source: Path instructions

with:
fetch-depth: 0

Expand Down Expand Up @@ -63,7 +63,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out code into the Go module directory
uses: actions/checkout@v6
uses: actions/checkout@v7
with:
fetch-depth: 0

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test-ansible.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ jobs:
name: e2e
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0
Comment on lines +10 to 12

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== Workflow files ==\n'
git ls-files .github/workflows/*.yml .github/workflows/*.yaml

printf '\n== Relevant checkout steps ==\n'
for f in .github/workflows/test-ansible.yml .github/workflows/test-sanity.yml .github/workflows/unit.yml; do
  echo "--- $f ---"
  nl -ba "$f" | sed -n '1,220p' | rg -n 'checkout|persist-credentials|fetch-depth|uses: actions/checkout'
done

Repository: openshift/ansible-operator-plugins

Length of output: 431

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in .github/workflows/test-ansible.yml .github/workflows/test-sanity.yml .github/workflows/unit.yml; do
  echo "--- $f ---"
  awk 'NR>=1 && NR<=220 { printf "%4d  %s\n", NR, $0 }' "$f" | sed -n '/actions\/checkout/,+6p'
done

Repository: openshift/ansible-operator-plugins

Length of output: 1217

🏁 Script executed:

#!/bin/bash
set -euo pipefail

for f in .github/workflows/test-ansible.yml .github/workflows/test-sanity.yml .github/workflows/unit.yml; do
  echo "--- $f ---"
  awk 'NR>=1 && NR<=120 { printf "%4d  %s\n", NR, $0 }' "$f" | sed -n '1,80p'
done

Repository: openshift/ansible-operator-plugins

Length of output: 2284

Disable persisted checkout credentials in these test jobs.

Add persist-credentials: false to each actions/checkout step in .github/workflows/test-ansible.yml (both jobs), .github/workflows/test-sanity.yml, and .github/workflows/unit.yml; they only run tests after checkout, so keeping GITHUB_TOKEN in .git/config is unnecessary exposure.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 10-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

📍 Affects 3 files
  • .github/workflows/test-ansible.yml#L10-L12 (this comment)
  • .github/workflows/test-ansible.yml#L23-L25
  • .github/workflows/test-sanity.yml#L10-L12
  • .github/workflows/unit.yml#L10-L12
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/test-ansible.yml around lines 10 - 12, Add
persist-credentials: false to every actions/checkout step in
.github/workflows/test-ansible.yml at lines 10-12 and 23-25,
.github/workflows/test-sanity.yml at lines 10-12, and .github/workflows/unit.yml
at lines 10-12; no other workflow behavior needs changing.

Source: Linters/SAST tools

- uses: actions/setup-go@v6
Expand All @@ -20,7 +20,7 @@ jobs:
name: e2e-molecule
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0
- uses: actions/setup-go@v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/test-sanity.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ jobs:
name: sanity
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0
- uses: actions/setup-go@v6
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/unit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ jobs:
name: unit
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
with:
fetch-depth: 0
- uses: actions/setup-go@v6
Expand Down
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ SHELL = /bin/bash
# This value must be updated to the release tag of the most recent release, a change that must
# occur in the release commit. IMAGE_VERSION will be removed once each subproject that uses this
# version is moved to a separate repo and release process.
export IMAGE_VERSION = v1.42.1
export IMAGE_VERSION = v1.42.3
# Build-time variables to inject into binaries
export SIMPLE_VERSION := $(shell (test "$(shell git describe --tags)" = "$(shell git describe --tags --abbrev=0)" && echo $(shell git describe --tags)) || echo $(shell git describe --tags --abbrev=0)+git)
export GIT_VERSION := $(shell git describe --dirty --tags --always)
Expand Down
44 changes: 22 additions & 22 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
module github.com/operator-framework/ansible-operator-plugins

go 1.25.7
go 1.26.3

require (
github.com/go-logr/logr v1.4.3
github.com/kr/text v0.2.0
github.com/maxbrunsfeld/counterfeiter/v6 v6.12.1
github.com/onsi/ginkgo/v2 v2.28.1
github.com/onsi/gomega v1.39.1
github.com/maxbrunsfeld/counterfeiter/v6 v6.12.2
github.com/onsi/ginkgo/v2 v2.32.0
github.com/onsi/gomega v1.42.0
github.com/operator-framework/operator-lib v0.19.0
github.com/operator-framework/operator-registry v1.59.0
github.com/prometheus/client_golang v1.23.2
Expand All @@ -18,7 +18,7 @@ require (
github.com/spf13/pflag v1.0.10
github.com/spf13/viper v1.21.0
github.com/stretchr/testify v1.11.1
golang.org/x/text v0.34.0
golang.org/x/text v0.38.0
k8s.io/api v0.33.9
k8s.io/apiextensions-apiserver v0.33.9
k8s.io/apimachinery v0.33.9
Expand All @@ -31,7 +31,7 @@ require (
)

require (
cel.dev/expr v0.24.0 // indirect
cel.dev/expr v0.25.1 // indirect
github.com/Masterminds/semver/v3 v3.4.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
Expand All @@ -57,7 +57,7 @@ require (
github.com/google/cel-go v0.26.0 // indirect
github.com/google/gnostic-models v0.6.9 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.0 // indirect
github.com/h2non/filetype v1.1.3 // indirect
Expand All @@ -84,31 +84,31 @@ require (
github.com/x448/float16 v0.8.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
go.opentelemetry.io/otel v1.40.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 // indirect
go.opentelemetry.io/otel/metric v1.40.0 // indirect
go.opentelemetry.io/otel/sdk v1.40.0 // indirect
go.opentelemetry.io/otel/trace v1.40.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go.yaml.in/yaml/v2 v2.4.2 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b // indirect
golang.org/x/mod v0.32.0 // indirect
golang.org/x/net v0.49.0 // indirect
golang.org/x/oauth2 v0.30.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.40.0 // indirect
golang.org/x/term v0.39.0 // indirect
golang.org/x/mod v0.36.0 // indirect
golang.org/x/net v0.54.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.21.0 // indirect
golang.org/x/sys v0.44.0 // indirect
golang.org/x/term v0.43.0 // indirect
golang.org/x/time v0.12.0 // indirect
golang.org/x/tools v0.41.0 // indirect
golang.org/x/tools v0.45.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
google.golang.org/grpc v1.75.1 // indirect
google.golang.org/protobuf v1.36.9 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
google.golang.org/grpc v1.79.3 // indirect

@coderabbitai coderabbitai Bot Jul 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🌐 Web query:

GHSA-hrxh-6v49-42gf google.golang.org/grpc v1.79.3 advisory fixed version

💡 Result:

The security advisory GHSA-hrxh-6v49-42gf affects the google.golang.org/grpc package and identifies the fixed version as v1.82.1 [1][2][3]. The package version v1.79.3 is considered affected by this advisory, as the vulnerability impacts all versions of gRPC-Go prior to v1.82.1 [1][3][4]. Users are advised to upgrade their dependency to v1.82.1 or later to remediate the identified xDS RBAC and HTTP/2 transport vulnerabilities [1][3].

Citations:

Upgrade google.golang.org/grpc to v1.82.1 or later. v1.79.3 is affected by GHSA-hrxh-6v49-42gf and should not remain in the module build list.

🧰 Tools
🪛 OSV Scanner (2.4.0)

[HIGH] 110-110: google.golang.org/grpc 1.79.3: gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

(GHSA-hrxh-6v49-42gf)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 110, Update the google.golang.org/grpc dependency in go.mod
from v1.79.3 to v1.82.1 or later, and synchronize related module checksums or
dependency metadata so the module build list no longer includes the vulnerable
version.

Source: Linters/SAST tools

google.golang.org/protobuf v1.36.10 // indirect
gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
Expand Down
Loading