From 130b2983165025edfc6b0bc4ba21d11cccb21d99 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 10:32:25 -0400 Subject: [PATCH 1/6] CP-47350: Repin bundled Alloy to v1.19.2-patch-1 Restores the ability to merge anything into this repository. The image vulnerability gate fails on every pull request, and every finding it reports comes from the Alloy binary bundled into the agent image rather than from code built here: six Go standard library advisories, one in Apache Thrift, and one in gRPC, all rated high. Nothing in this repository introduced them. The advisories were published after the pinned image was built, and the scanner refreshes its database daily, so the gate began failing on its own. The build this pin now selects carries none of them. Scanning it reports no vulnerabilities at any severity. Co-Authored-By: Claude Opus 5 (1M context) --- docker/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index a137a25b..1ef47e27 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -76,7 +76,7 @@ RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-$TARGETPLATFORM \ FROM gcr.io/distroless/static-debian12:debug@sha256:e60a053e6dd251ece065cc35e08c28f4ed55c559eeeb9102553bb09d5c0b0ad1 AS certs # Stage 5: Extract Alloy binary from CloudZero Alloy image -FROM ghcr.io/cloudzero/alloy:v1.18.1 AS alloy +FROM ghcr.io/cloudzero/alloy:v1.19.2-patch-1 AS alloy # Stage 6: Build prometheus-config-reloader from upstream source. We build it # (not copy the prebuilt image) to control the toolchain and bump vulnerable From cdd6e0c2f40f2d159d7730e84599af8e7418dff1 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 14:41:36 -0400 Subject: [PATCH 2/6] CP-47350: rebuild against re-tagged Alloy image The v1.19.2-patch-1 tag now points at a build carrying etcd v3.6.14, which clears GO-2026-6107. No content change; this exists only to retrigger the image build so the scan runs against the new image. Co-Authored-By: Claude Opus 5 (1M context) From a64f760cf910a5287ea8774283d730f4db1fe109 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 16:53:43 -0400 Subject: [PATCH 3/6] CP-47350: rebuild against the corrected Alloy image v1.19.2-patch-1 now points at a build whose OpenTelemetry modules agree on one semantic-convention schema. The previous image passed the vulnerability scan but could not start in clustered mode: the tracer failed to build on conflicting schema URLs and the container crash-looped. No content change; this retriggers the image build so the scan and the version matrix run against the corrected Alloy. Co-Authored-By: Claude Opus 5 (1M context) From f5a5d5ef7ecc4c1aebad75fe12b5ea95c0d45802 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 10:32:37 -0400 Subject: [PATCH 4/6] CP-47356: Build on Go 1.26.7 to clear stdlib CVEs Clears six high-severity Go standard library advisories carried by every binary this repository builds. Repinning the bundled Alloy fixes only the binary that comes from elsewhere; the nine agent binaries and prometheus-config-reloader are compiled here, so they keep whatever standard library their build image provides until it moves. The stdlib version baked into a binary comes from the toolchain that built it, so the Dockerfiles are where this takes effect. The go directives move with them because scripts/ci-checks.sh treats the version in go.mod as the single source of truth and requires every Dockerfile and every module to agree, which keeps the toolchain from drifting apart across the four modules and three images. Co-Authored-By: Claude Opus 5 (1M context) --- .tools/go.mod | 2 +- docker/Dockerfile | 2 +- go.mod | 2 +- tests/docker/Dockerfile.smoke-tests | 2 +- tests/go.mod | 2 +- tests/integration/test_server/Dockerfile | 2 +- tests/integration/test_server/go.mod | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.tools/go.mod b/.tools/go.mod index 82350a9d..70ab7a48 100644 --- a/.tools/go.mod +++ b/.tools/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent/.tools -go 1.26.5 +go 1.26.7 require ( github.com/homeport/dyff v1.12.0 diff --git a/docker/Dockerfile b/docker/Dockerfile index 1ef47e27..1334c5d6 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -14,7 +14,7 @@ ARG RELOADER_VERSION=v0.91.0 # 7. final: Minimal runtime image with compiled binaries # Stage 1: Base tools installation -FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS base-tools +FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS base-tools ARG TARGETPLATFORM ARG TARGETOS TARGETARCH diff --git a/go.mod b/go.mod index 1bf3fe05..1e4c6668 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent -go 1.26.5 +go 1.26.7 require ( github.com/google/go-cmp v0.7.0 diff --git a/tests/docker/Dockerfile.smoke-tests b/tests/docker/Dockerfile.smoke-tests index c94fbd51..850e745b 100644 --- a/tests/docker/Dockerfile.smoke-tests +++ b/tests/docker/Dockerfile.smoke-tests @@ -8,7 +8,7 @@ # components, avoiding the need to build and coordinate multiple images. # Stage 1: Base tools installation -FROM golang:1.26.5-alpine AS base-tools +FROM golang:1.26.7-alpine AS base-tools WORKDIR /app # Install system packages needed for building diff --git a/tests/go.mod b/tests/go.mod index ed5a6605..e149b25b 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent/tests -go 1.26.5 +go 1.26.7 require ( github.com/andybalholm/brotli v1.2.2 diff --git a/tests/integration/test_server/Dockerfile b/tests/integration/test_server/Dockerfile index c17823fb..3a1c083c 100644 --- a/tests/integration/test_server/Dockerfile +++ b/tests/integration/test_server/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5 +FROM golang:1.26.7 WORKDIR /app diff --git a/tests/integration/test_server/go.mod b/tests/integration/test_server/go.mod index 8c652bf2..f7457929 100644 --- a/tests/integration/test_server/go.mod +++ b/tests/integration/test_server/go.mod @@ -1,5 +1,5 @@ module main -go 1.26.5 +go 1.26.7 require github.com/golang/snappy v1.0.0 From f7d5c69170ea4e6fc97c8795f57901dcfe7e6a06 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:24:19 -0400 Subject: [PATCH 5/6] CP-47362: Report grype findings in the CI log Makes a failing image scan say what it found. The scan action defaults to writing SARIF to a temporary file and printing nothing, so a failure reports only that findings exist at or above the threshold. The file is discarded when the runner is torn down, leaving no way to learn which package or advisory tripped the gate short of reproducing the scan locally against a private registry. Nothing in either workflow consumes the SARIF, so the format is switched to the table, which the action writes to the step log. Applied to the pull request gate and the scheduled image scan, which had the same default. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/docker-build.yml | 4 ++++ .github/workflows/scan-images.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index bee3fbd5..ca007708 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -302,6 +302,10 @@ jobs: image: ${{ env.REGISTRY_PROD_ADDR }}/${{ env.UNTESTED_IMAGE_NAME }}:${{ steps.meta.outputs.version }} fail-build: true severity-cutoff: high + # Print findings to the log. The action otherwise defaults to + # SARIF written to a temp file nothing here reads, so a failure + # says findings exist without saying what they are. + output-format: table k8s-version-matrix-tests: # These should match the permissions in the called workflow. diff --git a/.github/workflows/scan-images.yml b/.github/workflows/scan-images.yml index 89d6d884..6c12caf8 100644 --- a/.github/workflows/scan-images.yml +++ b/.github/workflows/scan-images.yml @@ -47,3 +47,7 @@ jobs: image: ${{ env.REGISTRY }}:${{ matrix.tag }} fail-build: true severity-cutoff: high + # Print findings to the log. The action otherwise defaults to + # SARIF written to a temp file nothing here reads, so a failure + # says findings exist without saying what they are. + output-format: table From f1cc7c54ee3be0ec2a29609e63967eb288b1da8e Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:37:42 -0400 Subject: [PATCH 6/6] CP-47363: Upgrade prometheus-config-reloader to v0.93.1 Brings the bundled config reloader up two minor versions, from v0.91.0, picking up upstream's own dependency work and clearing the three high-severity x/crypto findings that were blocking the image scan. This binary is built from upstream prometheus-operator source, so its dependency versions are upstream's rather than this repository's, and the build carries go get overrides for the ones upstream has not caught up on. Those overrides name exact versions, so each goes stale as new advisories land against the version it names. That had already happened: the override named x/crypto v0.53.0, which has since had three advisories filed against it, so the line written to clear findings had become the reason for them. Upgrading lets two of the three surviving overrides go. Upstream now ships x/net v0.57.0 and x/text v0.40.0, both ahead of what the old pins asked for, so keeping those would have downgraded them. Only x/crypto still needs raising. No etcd override is added. The image scan reports an etcd advisory, but that dependency reaches the image through the bundled Alloy binary rather than this one, so an override here cannot affect it. Co-Authored-By: Claude Opus 5 (1M context) --- docker/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 1334c5d6..2b1d270d 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch # prometheus-config-reloader version, built from source in the "reloader" stage. # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md). -ARG RELOADER_VERSION=v0.91.0 +ARG RELOADER_VERSION=v0.93.1 # Multi-stage Docker build with platform-specific cache optimization: # 1. base-tools: Install system packages and tools (cached per platform) @@ -90,9 +90,12 @@ WORKDIR /reloader-src RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \ https://github.com/prometheus-operator/prometheus-operator.git . -# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up. +# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354 +# and GO-2026-6355 open against it. This is an exact version and so downgrades +# as readily as it upgrades: check what upstream resolves before touching it, +# and delete it once upstream passes it rather than bumping it forever. RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ - go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 + go get golang.org/x/crypto@v0.56.0 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \