Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Cr 26082 sec v1.7.2 (security fixes) #316

Merged
merged 6 commits into from
Jan 30, 2025
Merged

chore: Cr 26082 sec v1.7.2 (security fixes) #316

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a7ec7c7
chore: security fix https://nvd.nist.gov/vuln/detail/CVE-2023-46402
kostis-codefresh Jan 28, 2025
5e18dd7
docs: GitHub notification reference
kostis-codefresh Jan 28, 2025
b30398c
chore(deps): bump google.golang.org/grpc from 1.62.1 to 1.63.0 (#3497)
dependabot[bot] Apr 5, 2024
6e3515a
chore: update codegen tools
kostis-codefresh Jan 28, 2025
201bbca
chore: security bump for https://osv.dev/vulnerability/GHSA-82m2-cv7p…
kostis-codefresh Jan 28, 2025
10ddc5a
chore: update version to Codefresh variant
kostis-codefresh Jan 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v1.7.1-CR-24605
v1.7.2-CR-26082
25 changes: 14 additions & 11 deletions docs/generated/notification-services/github.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,21 +4,21 @@

The GitHub notification service changes commit status using [GitHub Apps](https://docs.github.com/en/developers/apps) and requires specifying the following settings:

* `appID` - the app id
* `installationID` - the app installation id
* `privateKey` - the app private key
* `enterpriseBaseURL` - optional URL, e.g. https://git.example.com/
- `appID` - the app id
- `installationID` - the app installation id
- `privateKey` - the app private key
- `enterpriseBaseURL` - optional URL, e.g. https://git.example.com/

## Configuration

1. Create a GitHub Apps using https://github.com/settings/apps/new
2. Change repository permissions to enable write commit statuses and/or deployments and/or pull requests comments
![2](https://user-images.githubusercontent.com/18019529/108397381-3ca57980-725b-11eb-8d17-5b8992dc009e.png)
3. Generate a private key, and download it automatically
![3](https://user-images.githubusercontent.com/18019529/108397926-d4a36300-725b-11eb-83fe-74795c8c3e03.png)
4. Install app to account
5. Store privateKey in `argo-rollouts-notification-secret` Secret and configure GitHub integration
in `argo-rollouts-notification-configmap` ConfigMap
1. Change repository permissions to enable write commit statuses and/or deployments and/or pull requests comments
![2](https://user-images.githubusercontent.com/18019529/108397381-3ca57980-725b-11eb-8d17-5b8992dc009e.png)
1. Generate a private key, and download it automatically
![3](https://user-images.githubusercontent.com/18019529/108397926-d4a36300-725b-11eb-83fe-74795c8c3e03.png)
1. Install app to account
1. Store privateKey in `argo-rollouts-notification-secret` Secret and configure GitHub integration
in `argo-rollouts-notification-configmap` ConfigMap

```yaml
apiVersion: v1
Expand Down Expand Up @@ -77,16 +77,19 @@ template.app-deployed: |
requiredContexts: []
autoMerge: true
transientEnvironment: false
reference: v1.0.0
pullRequestComment:
content: |
Application {{.app.metadata.name}} is now running new version of deployments manifests.
See more here: {{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true
```

**Notes**:

- If the message is set to 140 characters or more, it will be truncated.
- If `github.repoURLPath` and `github.revisionPath` are same as above, they can be omitted.
- Automerge is optional and `true` by default for github deployments to ensure the requested ref is up to date with the default branch.
Setting this option to `false` is required if you would like to deploy older refs in your default branch.
For more information see the [GitHub Deployment API Docs](https://docs.github.com/en/rest/deployments/deployments?apiVersion=2022-11-28#create-a-deployment).
- If `github.pullRequestComment.content` is set to 65536 characters or more, it will be truncated.
- Reference is optional. When set, it will be used as the ref to deploy. If not set, the revision will be used as the ref to deploy.
139 changes: 74 additions & 65 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ toolchain go1.21.8

require (
github.com/antonmedv/expr v1.15.5
github.com/argoproj/notifications-engine v0.4.1-0.20240219110818-7a069766e954
github.com/argoproj/notifications-engine v0.4.1-0.20240403133627-f48567108f01
github.com/argoproj/pkg v0.13.6
github.com/aws/aws-sdk-go-v2 v1.26.1
github.com/aws/aws-sdk-go-v2/config v1.27.10
Expand Down Expand Up @@ -39,29 +39,29 @@ require (
github.com/stretchr/testify v1.9.0
github.com/tj/assert v0.0.3
github.com/valyala/fasttemplate v1.2.2
golang.org/x/oauth2 v0.18.0
google.golang.org/genproto/googleapis/api v0.0.0-20240123012728-ef4313101c80
google.golang.org/grpc v1.62.1
golang.org/x/oauth2 v0.19.0
google.golang.org/genproto/googleapis/api v0.0.0-20240227224415-6ceb2ff114de
google.golang.org/grpc v1.63.0
google.golang.org/protobuf v1.33.0
gopkg.in/yaml.v2 v2.4.0
k8s.io/api v0.29.3
k8s.io/api v0.29.7
k8s.io/apiextensions-apiserver v0.29.3
k8s.io/apimachinery v0.29.3
k8s.io/apiserver v0.29.3
k8s.io/cli-runtime v0.29.3
k8s.io/client-go v0.29.3
k8s.io/code-generator v0.29.3
k8s.io/component-base v0.29.3
k8s.io/apimachinery v0.29.7
k8s.io/apiserver v0.29.7
k8s.io/cli-runtime v0.29.7
k8s.io/client-go v0.29.7
k8s.io/code-generator v0.29.7
k8s.io/component-base v0.29.7
k8s.io/klog/v2 v2.110.1
k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00
k8s.io/kubectl v0.29.3
k8s.io/kubernetes v1.29.3
k8s.io/kubernetes v1.29.7
k8s.io/utils v0.0.0-20230726121419-3b25d923346b
sigs.k8s.io/yaml v1.4.0
)

require (
cloud.google.com/go/compute v1.23.3 // indirect
cloud.google.com/go/compute v1.24.0 // indirect
cloud.google.com/go/compute/metadata v0.2.3 // indirect
github.com/PagerDuty/go-pagerduty v1.7.0 // indirect
github.com/bradleyfalzon/ghinstallation/v2 v2.5.0 // indirect
Expand Down Expand Up @@ -99,6 +99,7 @@ require (
github.com/cenkalti/backoff/v4 v4.2.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chai2010/gettext-go v1.0.2 // indirect
github.com/chainguard-dev/git-urls v1.0.2 // indirect
github.com/cloudflare/circl v1.3.3 // indirect
github.com/coreos/go-semver v0.3.1 // indirect
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
Expand All @@ -108,11 +109,11 @@ require (
github.com/evanphx/json-patch v5.6.0+incompatible // indirect
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
github.com/fatih/color v1.7.0 // indirect
github.com/felixge/httpsnoop v1.0.3 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/ghodss/yaml v1.0.1-0.20190212211648-25d852aebe32 // indirect
github.com/go-errors/errors v1.4.2 // indirect
github.com/go-logr/logr v1.3.0 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
Expand Down Expand Up @@ -176,59 +177,57 @@ require (
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/shopspring/decimal v1.2.0 // indirect
github.com/slack-go/slack v0.12.2 // indirect
github.com/spf13/cast v1.5.1 // indirect
github.com/spf13/cast v1.6.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stoewer/go-strcase v1.2.0 // indirect
github.com/stretchr/objx v0.5.2 // indirect
github.com/tomnomnom/linkheader v0.0.0-20180905144013-02ca5825eb80 // indirect
github.com/valyala/bytebufferpool v1.0.0 // indirect
github.com/valyala/fastjson v1.6.3 // indirect
github.com/whilp/git-urls v0.0.0-20191001220047-6db9661140c0 // indirect
github.com/xlab/treeprint v1.2.0 // indirect
go.etcd.io/etcd/api/v3 v3.5.10 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.5.10 // indirect
go.etcd.io/etcd/client/v3 v3.5.10 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.42.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.44.0 // indirect
go.opentelemetry.io/otel v1.19.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.47.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.47.0 // indirect
go.opentelemetry.io/otel v1.22.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.19.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.19.0 // indirect
go.opentelemetry.io/otel/metric v1.19.0 // indirect
go.opentelemetry.io/otel/sdk v1.19.0 // indirect
go.opentelemetry.io/otel/trace v1.19.0 // indirect
go.opentelemetry.io/otel/metric v1.22.0 // indirect
go.opentelemetry.io/otel/sdk v1.21.0 // indirect
go.opentelemetry.io/otel/trace v1.22.0 // indirect
go.opentelemetry.io/proto/otlp v1.0.0 // indirect
go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
go.uber.org/atomic v1.10.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.19.0 // indirect
golang.org/x/crypto v0.21.0 // indirect
golang.org/x/exp v0.0.0-20220722155223-a9213eeb770e // indirect
golang.org/x/mod v0.14.0 // indirect
golang.org/x/net v0.22.0 // indirect
golang.org/x/sync v0.6.0 // indirect
golang.org/x/sys v0.18.0 // indirect
golang.org/x/term v0.18.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.16.1 // indirect
golang.org/x/crypto v0.31.0 // indirect
golang.org/x/exp v0.0.0-20220827204233-334a2380cb91 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/net v0.33.0 // indirect
golang.org/x/sync v0.10.0 // indirect
golang.org/x/sys v0.28.0 // indirect
golang.org/x/term v0.27.0 // indirect
golang.org/x/text v0.21.0 // indirect
golang.org/x/time v0.5.0 // indirect
golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
gomodules.xyz/envconfig v1.3.1-0.20190308184047-426f31af0d45 // indirect
gomodules.xyz/notify v0.1.1 // indirect
google.golang.org/api v0.149.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto v0.0.0-20240123012728-ef4313101c80 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240123012728-ef4313101c80 // indirect
google.golang.org/api v0.162.0 // indirect
google.golang.org/genproto v0.0.0-20240227224415-6ceb2ff114de // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240227224415-6ceb2ff114de // indirect
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/cloud-provider v0.0.0 // indirect
k8s.io/cluster-bootstrap v0.25.8 // indirect
k8s.io/component-helpers v0.29.3 // indirect
k8s.io/controller-manager v0.29.3 // indirect
k8s.io/component-helpers v0.29.7 // indirect
k8s.io/controller-manager v0.29.7 // indirect
k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01 // indirect
k8s.io/kms v0.29.3 // indirect
k8s.io/kms v0.29.7 // indirect
k8s.io/kubelet v0.0.0 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.28.0 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
Expand All @@ -240,29 +239,39 @@ require (
replace (
github.com/go-check/check => github.com/go-check/check v0.0.0-20180628173108-788fd7840127
github.com/go-telegram-bot-api/telegram-bot-api/v5 => github.com/OvyFlash/telegram-bot-api/v5 v5.0.0-20240108230938-63e5c59035bf
k8s.io/api v0.0.0 => k8s.io/api v0.29.3
k8s.io/apiextensions-apiserver v0.0.0 => k8s.io/apiextensions-apiserver v0.29.3
k8s.io/apimachinery v0.0.0 => k8s.io/apimachinery v0.29.3
k8s.io/apiserver v0.0.0 => k8s.io/apiserver v0.29.3
k8s.io/cli-runtime v0.0.0 => k8s.io/cli-runtime v0.29.3
k8s.io/client-go v0.0.0 => k8s.io/client-go v0.29.3
k8s.io/cloud-provider v0.0.0 => k8s.io/cloud-provider v0.29.3
k8s.io/cluster-bootstrap v0.0.0 => k8s.io/cluster-bootstrap v0.29.3
k8s.io/code-generator v0.0.0 => k8s.io/code-generator v0.29.3
k8s.io/component-base v0.0.0 => k8s.io/component-base v0.29.3
k8s.io/component-helpers v0.0.0 => k8s.io/component-helpers v0.29.3
k8s.io/controller-manager v0.0.0 => k8s.io/controller-manager v0.29.3
k8s.io/cri-api v0.0.0 => k8s.io/cri-api v0.29.3
k8s.io/csi-translation-lib v0.0.0 => k8s.io/csi-translation-lib v0.29.3
k8s.io/kube-aggregator v0.0.0 => k8s.io/kube-aggregator v0.29.3
k8s.io/kube-controller-manager v0.0.0 => k8s.io/kube-controller-manager v0.29.3
k8s.io/kube-proxy v0.0.0 => k8s.io/kube-proxy v0.29.3
k8s.io/kube-scheduler v0.0.0 => k8s.io/kube-scheduler v0.29.3
k8s.io/kubectl v0.0.0 => k8s.io/kubectl v0.29.3
k8s.io/kubelet v0.0.0 => k8s.io/kubelet v0.29.3
k8s.io/legacy-cloud-providers v0.0.0 => k8s.io/legacy-cloud-providers v0.29.3
k8s.io/metrics v0.0.0 => k8s.io/metrics v0.29.3
k8s.io/mount-utils v0.0.0 => k8s.io/mount-utils v0.29.3
k8s.io/pod-security-admission v0.0.0 => k8s.io/pod-security-admission v0.29.3
k8s.io/sample-apiserver v0.0.0 => k8s.io/sample-apiserver v0.29.3
k8s.io/api => k8s.io/api v0.29.7
k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.29.7
k8s.io/apimachinery => k8s.io/apimachinery v0.29.13
k8s.io/apiserver => k8s.io/apiserver v0.29.7
k8s.io/cli-runtime => k8s.io/cli-runtime v0.29.7
k8s.io/client-go => k8s.io/client-go v0.29.7
k8s.io/cloud-provider => k8s.io/cloud-provider v0.29.7
k8s.io/cluster-bootstrap => k8s.io/cluster-bootstrap v0.29.7
k8s.io/code-generator => k8s.io/code-generator v0.29.13
k8s.io/component-base => k8s.io/component-base v0.29.7
k8s.io/component-helpers => k8s.io/component-helpers v0.29.7
k8s.io/controller-manager => k8s.io/controller-manager v0.29.7
k8s.io/cri-api => k8s.io/cri-api v0.29.13
k8s.io/csi-translation-lib => k8s.io/csi-translation-lib v0.29.7
k8s.io/kube-aggregator => k8s.io/kube-aggregator v0.29.7
k8s.io/kube-controller-manager => k8s.io/kube-controller-manager v0.29.7
k8s.io/kube-proxy => k8s.io/kube-proxy v0.29.7
k8s.io/kube-scheduler => k8s.io/kube-scheduler v0.29.7
k8s.io/kubectl => k8s.io/kubectl v0.29.7
k8s.io/kubelet => k8s.io/kubelet v0.29.7
k8s.io/legacy-cloud-providers => k8s.io/legacy-cloud-providers v0.29.7
k8s.io/metrics => k8s.io/metrics v0.29.7
k8s.io/mount-utils => k8s.io/mount-utils v0.29.7
k8s.io/pod-security-admission => k8s.io/pod-security-admission v0.29.7
k8s.io/sample-apiserver => k8s.io/sample-apiserver v0.29.7
)

replace k8s.io/dynamic-resource-allocation => k8s.io/dynamic-resource-allocation v0.29.7

replace k8s.io/endpointslice => k8s.io/endpointslice v0.29.7

replace k8s.io/kms => k8s.io/kms v0.29.7

replace k8s.io/sample-cli-plugin => k8s.io/sample-cli-plugin v0.29.7

replace k8s.io/sample-controller => k8s.io/sample-controller v0.29.7
Loading
Loading