OpenCHAMI / coresmd / 38425776134
65%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 25
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 64.599% (-1.0%) from 65.554%
38425776134

push

github

web-flow 
build(deps): upgrade Go to 1.27.2, fix HTTP/2 vulnerabilities, pin container image (#98)

* fix(deps): update go modules (minor/patch)

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

* fix(deps): upgrade golang.org/x/net to v0.60.0

Upgrade golang.org/x/net from v0.59.0 to v0.60.0 and update
the corresponding go.sum checksums.

Resolve five HTTP/2 vulnerabilities reported by govulncheck:
- GO-2026-6617: server crash due to an HPACK encoder race
- GO-2026-6612: double flow control refund on server streams
- GO-2026-6611: excessive CPU consumption from window changes
- GO-2026-6610: acceptance of malformed framing-related headers
- GO-2026-6603: server memory exhaustion from Trailer headers

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

* build(deps): synchronize Docker and module Go versions

Pin the multi-stage builder image to golang:1.27.2-alpine so its
Go version matches go.mod. Set GOTOOLCHAIN=local to prevent the
build from downloading and selecting a different toolchain.

Add a Renovate package rule that groups the go.mod directive and
Dockerfile.build image updates into a single Go toolchain PR.
Require both updates to be available and apply a seven-day
minimum release age, following the approach used in ochami.

This makes the Go toolchain selection reproducible while keeping
future version updates coordinated.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

* build(deps): pin Wolfi runtime image and track digest updates

Pin wolfi-base in Dockerfile to its current multi-platform digest
so runtime builds use a fixed base image.

Add a Renovate rule scoped to Dockerfile to maintain the digest
pin and propose updates when the latest image changes. Document
that the image has no version label.

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>

---------

Signed-off-by: Devon Bautista <17506592+synackd@users.noreply.github.com>
Co-authored... (continued)

1489 of 2305 relevant lines covered (64.6%)

4.7 hits per line

Coverage Regressions

Lines Coverage ∆ File
3
34.07
-2.14% plugin/coredhcp/coresmd/main.go
1
78.46
1.12% internal/rule/rule.go
1
32.81
-1.35% plugin/coredhcp/bootloop/main.go
Jobs
ID Job ID Ran Files Coverage
1 38425776134.1 25
64.6
GitHub Action Run
Source Files on build 38425776134