From 09280a73bd9ab988d0488b793263881f90d2ce22 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 10:32:37 -0400 Subject: [PATCH 1/3] CP-47356: Build on Go 1.26.7 to clear stdlib CVEs Clears six high-severity Go standard library advisories carried by every binary this repository builds. Repinning the bundled Alloy fixes only the binary that comes from elsewhere; the nine agent binaries and prometheus-config-reloader are compiled here, so they keep whatever standard library their build image provides until it moves. The stdlib version baked into a binary comes from the toolchain that built it, so the Dockerfiles are where this takes effect. The go directives move with them because scripts/ci-checks.sh treats the version in go.mod as the single source of truth and requires every Dockerfile and every module to agree, which keeps the toolchain from drifting apart across the four modules and three images. Co-Authored-By: Claude Opus 5 (1M context) --- .tools/go.mod | 2 +- docker/Dockerfile | 2 +- go.mod | 2 +- tests/docker/Dockerfile.smoke-tests | 2 +- tests/go.mod | 2 +- tests/integration/test_server/Dockerfile | 2 +- tests/integration/test_server/go.mod | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.tools/go.mod b/.tools/go.mod index 82350a9d9..70ab7a487 100644 --- a/.tools/go.mod +++ b/.tools/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent/.tools -go 1.26.5 +go 1.26.7 require ( github.com/homeport/dyff v1.12.0 diff --git a/docker/Dockerfile b/docker/Dockerfile index 1ef47e278..1334c5d69 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -14,7 +14,7 @@ ARG RELOADER_VERSION=v0.91.0 # 7. final: Minimal runtime image with compiled binaries # Stage 1: Base tools installation -FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS base-tools +FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine AS base-tools ARG TARGETPLATFORM ARG TARGETOS TARGETARCH diff --git a/go.mod b/go.mod index 1bf3fe05e..1e4c6668d 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent -go 1.26.5 +go 1.26.7 require ( github.com/google/go-cmp v0.7.0 diff --git a/tests/docker/Dockerfile.smoke-tests b/tests/docker/Dockerfile.smoke-tests index c94fbd515..850e745b2 100644 --- a/tests/docker/Dockerfile.smoke-tests +++ b/tests/docker/Dockerfile.smoke-tests @@ -8,7 +8,7 @@ # components, avoiding the need to build and coordinate multiple images. # Stage 1: Base tools installation -FROM golang:1.26.5-alpine AS base-tools +FROM golang:1.26.7-alpine AS base-tools WORKDIR /app # Install system packages needed for building diff --git a/tests/go.mod b/tests/go.mod index ed5a6605b..e149b25ba 100644 --- a/tests/go.mod +++ b/tests/go.mod @@ -1,6 +1,6 @@ module github.com/cloudzero/cloudzero-agent/tests -go 1.26.5 +go 1.26.7 require ( github.com/andybalholm/brotli v1.2.2 diff --git a/tests/integration/test_server/Dockerfile b/tests/integration/test_server/Dockerfile index c17823fbe..3a1c083cd 100644 --- a/tests/integration/test_server/Dockerfile +++ b/tests/integration/test_server/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.5 +FROM golang:1.26.7 WORKDIR /app diff --git a/tests/integration/test_server/go.mod b/tests/integration/test_server/go.mod index 8c652bf2d..f74579297 100644 --- a/tests/integration/test_server/go.mod +++ b/tests/integration/test_server/go.mod @@ -1,5 +1,5 @@ module main -go 1.26.5 +go 1.26.7 require github.com/golang/snappy v1.0.0 From a07584e2650c040b05b9068fcab7bdbb1d288675 Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:24:19 -0400 Subject: [PATCH 2/3] CP-47362: Report grype findings in the CI log Makes a failing image scan say what it found. The scan action defaults to writing SARIF to a temporary file and printing nothing, so a failure reports only that findings exist at or above the threshold. The file is discarded when the runner is torn down, leaving no way to learn which package or advisory tripped the gate short of reproducing the scan locally against a private registry. Nothing in either workflow consumes the SARIF, so the format is switched to the table, which the action writes to the step log. Applied to the pull request gate and the scheduled image scan, which had the same default. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/docker-build.yml | 4 ++++ .github/workflows/scan-images.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index bee3fbd54..ca007708e 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -302,6 +302,10 @@ jobs: image: ${{ env.REGISTRY_PROD_ADDR }}/${{ env.UNTESTED_IMAGE_NAME }}:${{ steps.meta.outputs.version }} fail-build: true severity-cutoff: high + # Print findings to the log. The action otherwise defaults to + # SARIF written to a temp file nothing here reads, so a failure + # says findings exist without saying what they are. + output-format: table k8s-version-matrix-tests: # These should match the permissions in the called workflow. diff --git a/.github/workflows/scan-images.yml b/.github/workflows/scan-images.yml index 89d6d8849..6c12caf84 100644 --- a/.github/workflows/scan-images.yml +++ b/.github/workflows/scan-images.yml @@ -47,3 +47,7 @@ jobs: image: ${{ env.REGISTRY }}:${{ matrix.tag }} fail-build: true severity-cutoff: high + # Print findings to the log. The action otherwise defaults to + # SARIF written to a temp file nothing here reads, so a failure + # says findings exist without saying what they are. + output-format: table From 871ac69d17e203b1d1db763d4cf2b8ce0266a9df Mon Sep 17 00:00:00 2001 From: Evan Nemerson Date: Fri, 4 Sep 2026 12:37:42 -0400 Subject: [PATCH 3/3] CP-47363: Upgrade prometheus-config-reloader to v0.93.1 Brings the bundled config reloader up two minor versions, from v0.91.0, picking up upstream's own dependency work and clearing the three high-severity x/crypto findings that were blocking the image scan. This binary is built from upstream prometheus-operator source, so its dependency versions are upstream's rather than this repository's, and the build carries go get overrides for the ones upstream has not caught up on. Those overrides name exact versions, so each goes stale as new advisories land against the version it names. That had already happened: the override named x/crypto v0.53.0, which has since had three advisories filed against it, so the line written to clear findings had become the reason for them. Upgrading lets two of the three surviving overrides go. Upstream now ships x/net v0.57.0 and x/text v0.40.0, both ahead of what the old pins asked for, so keeping those would have downgraded them. Only x/crypto still needs raising. No etcd override is added. The image scan reports an etcd advisory, but that dependency reaches the image through the bundled Alloy binary rather than this one, so an override here cannot affect it. Co-Authored-By: Claude Opus 5 (1M context) --- docker/Dockerfile | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 1334c5d69..2b1d270df 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -2,7 +2,7 @@ ARG DEPLOY_IMAGE=scratch # prometheus-config-reloader version, built from source in the "reloader" stage. # Git tag — Dependabot can't track it, so bump by hand (see DEVELOPMENT.md). -ARG RELOADER_VERSION=v0.91.0 +ARG RELOADER_VERSION=v0.93.1 # Multi-stage Docker build with platform-specific cache optimization: # 1. base-tools: Install system packages and tools (cached per platform) @@ -90,9 +90,12 @@ WORKDIR /reloader-src RUN git clone --depth 1 --branch "${RELOADER_VERSION}" \ https://github.com/prometheus-operator/prometheus-operator.git . -# Bump vulnerable deps ahead of upstream's pins so the scan passes; drop when upstream catches up. +# Upstream still ships x/crypto v0.54.0, which has GO-2026-6303, GO-2026-6354 +# and GO-2026-6355 open against it. This is an exact version and so downgrades +# as readily as it upgrades: check what upstream resolves before touching it, +# and delete it once upstream passes it rather than bumping it forever. RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ - go get golang.org/x/crypto@v0.53.0 golang.org/x/net@v0.56.0 golang.org/x/text@v0.39.0 + go get golang.org/x/crypto@v0.56.0 RUN --mount=type=cache,target=/go/pkg/mod,id=gomod-reloader-$TARGETPLATFORM \ --mount=type=cache,target=/root/.cache/go-build,id=gobuild-reloader-$TARGETPLATFORM \