build: upgrade to Go 1.26.5 #1290
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,67 +1 @@ | ||
| ignored-vulnerabilities: [] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,102 @@ | ||
| # Host Operator | ||
|
|
||
| [](https://goreportcard.com/report/github.com/codeready-toolchain/host-operator) | ||
| [](https://godoc.org/github.com/codeready-toolchain/host-operator) | ||
| [](https://codecov.io/gh/codeready-toolchain/host-operator) | ||
| [](https://github.com/codeready-toolchain/host-operator/actions/workflows/operator-cd.yml) | ||
| [](https://quay.io/repository/codeready-toolchain/host-operator) | ||
|
|
||
| This is the CodeReady Toolchain Host Operator repository. It contains the OpenShift Operator that is deployed on the "host" cluster in the SaaS. | ||
|
|
||
| ## Build | ||
|
|
||
| Requires Go version 1.26.x (1.26.5 or higher) - download for your development environment [here](https://golang.org/dl/). | ||
|
|
||
| This repository uses [Go modules](https://github.com/golang/go/wiki/Modules). | ||
|
|
||
| ## Development | ||
|
|
||
| The dev.mk targets in the toolchain-e2e repository can be used to build and deploy the host and member operators for development, or use the [guide](https://github.com/codeready-toolchain/toolchain-e2e/blob/master/dev_install.adoc). | ||
|
|
||
| ## Releasing operator | ||
|
|
||
| The releases of the operator are automatically managed via GitHub Actions workflow defined in this repository. | ||
|
|
||
| ### Broken release | ||
|
|
||
| If there is any broken release that cannot be built & pushed through the pipeline - for example because of this error: | ||
| ``` | ||
| Invalid bundle toolchain-host-operator.v0.0.321-147-commit-477c4b7-5e49228, bundle specifies a non-existent replacement toolchain-host-operator.v0.0.320-146-commit-f46a8aa-8f94bc0 | ||
| ``` | ||
| then the release has to be fixed manually. In such a case, please follow these steps: | ||
|
|
||
| > **Note:** If the problem occurred when releasing registration-service, then don't do anything in the host-operator, but follow the steps in registration-service repo. | ||
|
|
||
| 1. Log in to quay.io using an account that has the write permissions in quay.io/codeready-toolchain/host-operator repo. | ||
| 2. Checkout to the problematic (missing) commit that failed in the pipeline and that has to be manually released. | ||
| 3. Run `make podman-push QUAY_NAMESPACE=codeready-toolchain` | ||
| 4. Run `make push-to-quay-staging QUAY_NAMESPACE=codeready-toolchain` | ||
|
|
||
| ### End-to-End tests | ||
|
|
||
| #### Background & pairing | ||
|
|
||
| E2E tests are not located in this repository - all e2e tests are in [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo, however, it's still possible to run them locally from this repo - see [Running End-to-End Tests](#running-end-to-end-tests). | ||
|
|
||
| When there is a change introduced in this repository that should be either covered by e2e tests or requires changes in the already existing tests, then all needed changes should go into the [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo. | ||
| The logic that executes tests in openshift-ci automatically tries to pair PR opened for this (host-operator) repository with a branch that potentially exists in the developer's fork of the [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo. This pairing is based on a branch name. | ||
|
|
||
| For example, if a developer with GH account `cooljohn` opens a PR (for host-operator repo) from a branch `fix-reconcile`, then the logic checks if there is a branch `fix-reconcile` also in the `cooljohn/toolchain-e2e` fork. | ||
| If there is, then the logic: | ||
|
|
||
| 1. clones latest changes from [codeready-toolchain/toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) | ||
| 2. fetches the `fix-reconcile` branch from `cooljohn/toolchain-e2e` fork | ||
| 3. merges `master` branch with the changes from `fix-reconcile` branch | ||
| 4. clones latest changes from [member-operator](https://github.com/codeready-toolchain/member-operator) repo and builds & deploys the `member-operator` image out of it | ||
| 5. builds & deploys the `host-operator` image from the code that is in the PR | ||
| 6. runs e2e tests against both operators from the merged branch of the `toolchain-e2e` repo | ||
|
|
||
| If the branch with the same name does not exist, then it only clones the latest changes from [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) and runs e2e tests from the `master`. | ||
|
|
||
| If you still don't know what to do with e2e tests in some use-cases, go to [What to do](#what-to-do) section where all use-cases are covered. | ||
|
|
||
| #### Prerequisites if running locally | ||
|
|
||
| * Make sure you have set the `QUAY_NAMESPACE` variable: `export QUAY_NAMESPACE=<quay-username>` | ||
| * Log in to the target OpenShift cluster with cluster admin privileges | ||
| * The visibility of `host-operator` repository in quay is set to public (`https://quay.io/repository/<your-username>/host-operator?tab=settings`) | ||
|
Comment on lines
+65
to
+67
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- README context ---'
sed -n '1,120p' README.md
printf '%s\n' '--- relevant files ---'
git ls-files | rg '(^|/)(Makefile|Dockerfile|.*e2e.*|.*rbac.*|.*role.*|.*clusterrole.*|.*quay.*|.*deploy.*|.*config.*|.*test.*)' | head -200
printf '%s\n' '--- privilege and image references ---'
rg -n -i 'cluster-admin|clusterrole|rolebinding|serviceaccount|quay|image:|imagePull|pull-secret|e2e|oc adm policy|kubectl auth' --glob '!vendor/**' --glob '!**/go.sum' . | head -400Repository: codeready-toolchain/host-operator Length of output: 50391 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- E2E entry points and setup references ---'
rg -n -i 'test-e2e|dev_install|cluster-admin|clusterrole|rolebinding|imagePull|pull-secret|quay|HOST_NS|MEMBER_NS|oc |kubectl ' \
--glob '!vendor/**' --glob '!**/go.sum' . | head -500
printf '%s\n' '--- candidate Makefiles and manifests ---'
git ls-files | rg '(^|/)(Makefile|.*\.mk|.*\.yaml|.*\.yml|.*\.adoc|.*\.sh)$' | \
rg -i 'make|e2e|dev|deploy|rbac|role|cluster|quay|registry' | head -300Repository: codeready-toolchain/toolchain-e2e Length of output: 50389 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- host Makefile E2E target ---'
sed -n '65,135p' make/test.mk
printf '%s\n' '--- generated host RBAC declarations ---'
sed -n '1,130p' config/rbac/role_binding.yaml
sed -n '1,180p' config/rbac/kustomization.yaml
sed -n '80,115p' cmd/main.go
printf '%s\n' '--- host deployment image and service account ---'
sed -n '1,115p' config/manager/manager.yamlRepository: codeready-toolchain/host-operator Length of output: 8783 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- E2E setup and deployment commands ---'
sed -n '270,470p' make/test.mk
printf '%s\n' '--- E2E RBAC and cluster-scoped resources ---'
rg -n -i '^(kind: (ClusterRole|ClusterRoleBinding|CustomResourceDefinition|Namespace|PriorityClass|MutatingWebhookConfiguration|ValidatingWebhookConfiguration)|apiVersion:|resources:|verbs:|roleRef:|subjects:)' \
deploy setup --glob '*.yaml' --glob '*.yml' | head -500
printf '%s\n' '--- operator installation and image pull configuration ---'
sed -n '1,290p' scripts/ci/manage-operator.sh
sed -n '1,150p' scripts/ci/manage-host-operator.sh
sed -n '1,140p' scripts/ci/manage-member-operator.sh
sed -n '1,90p' quay.adocRepository: codeready-toolchain/toolchain-e2e Length of output: 40375 🏁 Script executed: #!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
root = Path(".")
files = list(root.glob("make/*.mk")) + list(root.glob("scripts/ci/*.sh"))
patterns = {
"cluster_scope_commands": re.compile(
r"\boc\s+(?:apply|create|delete|patch|get|wait|adm)\b[^\n]*"
r"(?:--all-namespaces|ClusterRole|ClusterRoleBinding|crd|crds|projects|"
r"PriorityClass|Webhook|oauths\.config|ingress\.config|must-gather)",
re.I,
),
"namespace_commands": re.compile(
r"\boc\s+(?:new-project|project|apply|create|delete|patch|get|wait)\b[^\n]*"
r"(?:-n\s+|\-\-namespace|PROJECT_NAME|HOST_NS|MEMBER_NS)",
re.I,
),
"pull_secret_configuration": re.compile(
r"(?:imagePullSecrets|dockerconfigjson|pull-secret|secret\s+generic|"
r"registry.*secret|oc\s+create\s+secret)",
re.I,
),
}
for name, pattern in patterns.items():
print(f"--- {name} ---")
for path in files:
try:
text = path.read_text()
except UnicodeDecodeError:
continue
for line_no, line in enumerate(text.splitlines(), 1):
if pattern.search(line):
print(f"{path}:{line_no}:{line.strip()}")
PYRepository: codeready-toolchain/toolchain-e2e Length of output: 14251 Security Misconfiguration (CWE-250) Exploitability: Theoretical Restrict local E2E tests to disposable clusters. The workflow creates CRDs, projects, OLM resources, and cluster-scoped RBAC, and its cleanup removes cluster-scoped resources. Keep 🤖 Prompt for AI AgentsSource: Path instructions |
||
|
|
||
| #### Running End-to-End Tests | ||
|
|
||
| Although the e2e tests are in the separated repository, it's still possible to run them from this repo (host-operator) and also against the current code that is at HEAD. | ||
| There are two Makefile targets that will execute the e2e tests: | ||
|
|
||
| * `make test-e2e` - this target clones latest changes from [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) and runs e2e tests for both operators from the master. As deployment for `host-operator` it uses the current code that is at HEAD. | ||
| * `make test-e2e-local` - this target doesn't clone anything, but it runs run e2e tests for both operators from the directory `../toolchain-e2e`. As deployment for `host-operator` it uses the current code that is at HEAD. | ||
|
|
||
| The tests executed within [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo will take care of creating all needed namespaces with random names (or see below for enforcing some specific namespace names). | ||
| It will also create all required CRDs, role and role bindings for the service accounts, build the images for both operators and push them to the image registry. Finally, it will deploy the operators and run the tests. | ||
|
|
||
| > **Note:** you can override the default namespace names where the end-to-end tests are going to be executed - eg.: `make test-e2e HOST_NS=my-host MEMBER_NS=my-member` | ||
|
|
||
| ##### What to do | ||
|
|
||
| If you are still confused by the e2e location, execution and branch pairing, see the following cases and needed steps: | ||
|
|
||
| * **Working locally:** | ||
| * **Need to test your code using the latest version of e2e tests from [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo:** | ||
| * execute `make test-e2e` | ||
| * **Need to test your code using e2e tests located in `../toolchain-e2e` repo:** | ||
| * `make test-e2e-local` | ||
|
|
||
| * **Creating a PR:** | ||
| * **Your PR doesn't need any changes in [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo:** | ||
| 1. check the name of a branch you are going to create a PR for | ||
| 2. make sure that your fork of [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo doesn't contain branch with the same name | ||
| 3. create a PR | ||
| * **Your PR requires changes in [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo:** | ||
| 1. check the name of a branch you are going to create a PR for | ||
| 2. create a branch with the same name within your fork of [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) repo and put all necessary changes there | ||
| 3. push all changes into both forks of the repositories [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) and [host-operator](https://github.com/codeready-toolchain/host-operator) | ||
| 4. create a PR for [host-operator](https://github.com/codeready-toolchain/host-operator) | ||
| 5. create a PR for [toolchain-e2e](https://github.com/codeready-toolchain/toolchain-e2e) | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 3960
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 182
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 300
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 2318
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 171
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 171
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 310
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 208
🏁 Script executed:
Repository: codeready-toolchain/toolchain-e2e
Length of output: 171
🏁 Script executed:
Repository: codeready-toolchain/toolchain-e2e
Length of output: 171
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 1005
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 1814
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 585
🏁 Script executed:
Repository: codeready-toolchain/toolchain-e2e
Length of output: 2131
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 5542
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 8118
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 263
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 4089
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 176
🏁 Script executed:
Repository: codeready-toolchain/host-operator
Length of output: 590
Security (CWE-494): Download of Code Without Integrity Check
Reachability: External · Exploitability: Moderate
Address unpinned dependencies and unverified fork code in E2E pairing.
The E2E pairing logic in
make/test.mkfetches and merges code from a developer's fork without commit pinning or signature verification. The workflow usespull_request_targetto run with repository credentials, though it publishes to a segregated test namespace (codeready-toolchain-test) via an explicitTEST_QUAY_TOKEN.Add commit pinning for the cloned repositories (official toolchain-e2e and member-operator). If the developer's fork branch cannot be verified, document the trust boundary explicitly or require an approval step before merging unverified fork code. For local runs, document the commits that will be used before the merge step executes.
🤖 Prompt for AI Agents
Source: Path instructions