mozillazg / ptcpdump / 37632153983

72%

Build Type

push

github

Committed by web-flow

Commit Message

chore(deps): update docker base images to latest (#408)

* chore(deps): update docker base images to latest

- Dockerfile: quay.io/ptcpdump/develop to 20261003.144200, busybox:latest digest
- .github/build.Dockerfile: golang:1.27.1-bookworm digest

* add `-scan symbol` when run govulncheck

* ci: run govulncheck module and symbol scans separately

govulncheck's -scan flag stores a single value, so '-scan module -scan symbol'
only ran the symbol scan. Split them into separate invocations (with ./... for
the source-mode symbol scan) and fail the job only when both scans fail.

* fix(deps): migrate containerd to v2 to fix govulncheck

govulncheck reports reachable vulnerabilities in
github.com/containerd/containerd v1.7.36 (GO-2026-5622, GO-2026-5338,
GO-2026-5064) and github.com/klauspost/compress v1.16.7 (GO-2026-5841).
The containerd advisories are only fixed on the v2 line, so migrate the
containerd metadata integration to github.com/containerd/containerd/v2
and let the required transitive dependency updates (including
klauspost/compress v1.20.0) come along.

A source module scan now reports no vulnerabilities.

* ci: install libpcap build deps for govulncheck source scan

The source-mode symbol scan needs to compile the cgo packages
(gopacket/pcap, elibpcap), which requires libpcap headers on the runner.
Without them the scan fails with 'pcap.h: No such file or directory'.

* Skip e2e tests for go tls keylog

Skipped e2e tests for go tls keylog in CircleCI config.

Coverage Stats

4 of 4 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

4412 of 6157 relevant lines covered (71.66%)

0.72 hits per line