umputun / spot

84%

master: 84%

LAST BUILD ON BRANCH fix/defensive-guards

branch: fix/defensive-guards

CHANGE BRANCH

x

Reset

Sync Branches

• fix/defensive-guards
• SPOT_TIMEOUT
• add-ansible-vault-secrets
• add-json-schema
• add-shell-completions
• add_option_forward_agent
• allow_user_in_target_address
• chmod-x
• ci/workflow-hardening
• cmd_unmarshal
• command_condition
• cusom_shell
• custom-tmp
• custom_shell
• custom_vars
• dependabot
• dependabot/github_actions/github-actions-updates-5714300483
• dependabot/github_actions/github-actions-updates-acdff8b645
• dependabot/github_actions/github-actions-updates-afd9e15987
• dependabot/github_actions/github-actions-updates-fcf4e41b5c
• dependabot/go_modules/filippo.io/edwards25519-1.1.1
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.29.14
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.29.15
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.29.16
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.29.17
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.17.67
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.17.68
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.17.69
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/credentials-1.17.70
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/secretsmanager-1.35.4
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/secretsmanager-1.35.5
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/secretsmanager-1.35.6
• dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/secretsmanager-1.35.7
• dependabot/go_modules/github.com/containerd/containerd-1.7.11
• dependabot/go_modules/github.com/containerd/containerd-1.7.27
• dependabot/go_modules/github.com/docker/docker-24.0.7incompatible
• dependabot/go_modules/github.com/docker/docker-24.0.9incompatible
• dependabot/go_modules/github.com/docker/docker-26.1.4incompatible
• dependabot/go_modules/github.com/docker/docker-26.1.5incompatible
• dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.1
• dependabot/go_modules/github.com/go-jose/go-jose/v3-3.0.3
• dependabot/go_modules/github.com/go-jose/go-jose/v4-4.1.4
• dependabot/go_modules/github.com/go-pkgz/fileutils-0.4.0
• dependabot/go_modules/github.com/go-pkgz/lgr-0.12.0
• dependabot/go_modules/github.com/go-pkgz/lgr-0.12.1
• dependabot/go_modules/github.com/go-sql-driver/mysql-1.9.2
• dependabot/go_modules/github.com/go-sql-driver/mysql-1.9.3
• dependabot/go_modules/github.com/hashicorp/go-retryablehttp-0.7.7
• dependabot/go_modules/github.com/hashicorp/vault/api-1.20.0
• dependabot/go_modules/github.com/opencontainers/runc-1.1.12
• dependabot/go_modules/github.com/pelletier/go-toml/v2-2.2.4
• dependabot/go_modules/github.com/pkg/sftp-1.13.9
• dependabot/go_modules/github.com/testcontainers/testcontainers-go-0.36.0
• dependabot/go_modules/github.com/testcontainers/testcontainers-go-0.37.0
• dependabot/go_modules/go-modules-updates-0b1b715552
• dependabot/go_modules/go-modules-updates-38676b66b8
• dependabot/go_modules/go-modules-updates-4132416c07
• dependabot/go_modules/go-modules-updates-7f184a08d6
• dependabot/go_modules/go-modules-updates-8f1b82aee4
• dependabot/go_modules/go-modules-updates-bbb8b02913
• dependabot/go_modules/go-modules-updates-cd95fe73d3
• dependabot/go_modules/go-modules-updates-df02f00acb
• dependabot/go_modules/go-modules-updates-f0b1c50809
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.40.0
• dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.43.0
• dependabot/go_modules/golang.org/x/crypto-0.17.0
• dependabot/go_modules/golang.org/x/crypto-0.31.0
• dependabot/go_modules/golang.org/x/crypto-0.37.0
• dependabot/go_modules/golang.org/x/crypto-0.38.0
• dependabot/go_modules/golang.org/x/crypto-0.39.0
• dependabot/go_modules/golang.org/x/crypto-0.45.0
• dependabot/go_modules/golang.org/x/net-0.17.0
• dependabot/go_modules/golang.org/x/net-0.23.0
• dependabot/go_modules/golang.org/x/net-0.36.0
• dependabot/go_modules/golang.org/x/net-0.55.0
• dependabot/go_modules/google.golang.org/grpc-1.57.1
• dependabot/go_modules/google.golang.org/protobuf-1.33.0
• disable-colors
• doc-yaml-multiline
• dry_run
• dynamic-register-vars
• dynamic_targets
• echo-condition
• echo_command
• enfoce-unix-slash
• env_file
• env_locality
• exclude-support-for-delete-copy
• exec_options
• expand-os-env
• feat-sudo-password-support
• feat/task-import
• feat/template-command
• feature/line-command-251
• feature/reverse-copy-download
• fix
• fix-custom-shell
• fix-env-var-expansion
• fix-missing-hostname
• fix-secrets-masking
• fix-simplified-example
• fix-single-export
• fix-single-quoted-vars
• fix-skip-short-flag
• fix-ssh-agent-override
• fix-temp-leftovers
• fix/config-parsing
• fix/docs-ci-hygiene
• fix/executor-correctness
• fix/line-append-sudo-permission
• fix/only-on-matching
• fix/rel-error-wrap
• fix/review-top-findings
• fix/wait-delete-exclude
• fixes-issue-313
• gen_template
• glob_support
• help
• hide-secrets
• if/fix-typo-docs
• invert_condition
• linux_separator
• local-dry
• local-mode
• local-shell
• log_script
• main
• maintenance/deps-and-linter-update
• master
• match-regex
• mode_copy_check
• multi_copy
• multi_delete
• multi_sync
• multiple-task-cli-option
• no_default_key
• on_exit
• onerror_extras
• onerror_vars
• only_on
• others_env
• paskal/dependabot-security-updates
• patch-1
• playbook
• rand_tmp
• redundant-code2
• refactot_main
• refs/tags/1.10.1
• refs/tags/v0.10.0
• refs/tags/v0.11.0
• refs/tags/v0.11.1
• refs/tags/v0.11.2
• refs/tags/v0.11.3
• refs/tags/v0.12.0
• refs/tags/v0.12.1
• refs/tags/v0.12.2
• refs/tags/v0.13.0
• refs/tags/v0.13.1
• refs/tags/v0.14.0
• refs/tags/v0.14.1
• refs/tags/v0.14.2
• refs/tags/v0.14.3
• refs/tags/v0.14.4
• refs/tags/v0.14.5
• refs/tags/v0.14.6
• refs/tags/v0.15.0
• refs/tags/v0.15.1
• refs/tags/v0.15.2
• refs/tags/v0.15.3
• refs/tags/v0.15.4
• refs/tags/v0.15.5
• refs/tags/v0.15.6
• refs/tags/v0.8.0
• refs/tags/v0.8.1
• refs/tags/v0.8.2
• refs/tags/v0.8.3
• refs/tags/v0.9.0
• refs/tags/v0.9.1
• refs/tags/v1.0.0
• refs/tags/v1.1.0
• refs/tags/v1.1.1
• refs/tags/v1.10.0
• refs/tags/v1.10.1
• refs/tags/v1.11.0
• refs/tags/v1.11.2
• refs/tags/v1.11.3
• refs/tags/v1.11.4
• refs/tags/v1.11.5
• refs/tags/v1.12.0
• refs/tags/v1.12.1
• refs/tags/v1.13.0
• refs/tags/v1.13.1
• refs/tags/v1.14.0
• refs/tags/v1.14.1
• refs/tags/v1.15.0
• refs/tags/v1.15.1
• refs/tags/v1.16.0
• refs/tags/v1.16.1
• refs/tags/v1.16.2
• refs/tags/v1.16.3
• refs/tags/v1.16.4
• refs/tags/v1.17.0
• refs/tags/v1.17.1
• refs/tags/v1.17.2
• refs/tags/v1.18.0
• refs/tags/v1.19.0
• refs/tags/v1.19.1
• refs/tags/v1.19.2
• refs/tags/v1.19.3
• refs/tags/v1.2.0
• refs/tags/v1.3.0
• refs/tags/v1.4.0
• refs/tags/v1.4.1
• refs/tags/v1.5.0
• refs/tags/v1.6.0
• refs/tags/v1.6.1
• refs/tags/v1.6.2
• refs/tags/v1.6.3
• refs/tags/v1.6.4
• refs/tags/v1.6.5
• refs/tags/v1.7.0
• refs/tags/v1.8.0
• refs/tags/v1.8.1
• refs/tags/v1.9.0
• refs/tags/v1.9.1
• refs/tags/v1.9.2
• register-across-tasks
• register-vars
• remote-addr-vars
• safe-script
• script_orig
• secrets_provider
• simple_playbook
• simple_playbook_no_inventory
• single_target
• site-improvements
• ssh_agent
• strict_yaml_parser
• sudo
• sudo-cond-fixes
• sudo_copy
• sudo_dbl_shell
• sync_exclude
• sync_remove_dirs
• tags
• target_names_type
• targets_refactor
• task-secret
• task-tagging-support
• task-user-fix
• task_hosts
• test-empty-groups-handling
• test/download-dir-exclude
• toml
• update-dependencies
• upgrade-go-1.24
• vebrose-levels

Build # 28754959250

Build Type

Pull #357

github

Committed by paskal

Commit Message

guards: decrypt length check, ssh user nil guard, command count across hosts

- decrypt now rejects ciphertext shorter than the 24-byte nonce plus
  16-byte salt with an error instead of panicking on the slice.
- sshUser had an inverted nil guard: when pbook was nil it still
  dereferenced pbook.User. Only use the playbook user when pbook is
  non-nil.
- ProcResp.Commands counted only host index 0, undercounting when that
  host skips or fails commands the others run. Report the max command
  count across hosts instead, tracked under the existing lock. A new
  two-host test (only_on skipping a command on the index-0 host) asserts
  the fuller host's count is reported.

Pull Request Pull Request #357: guards: decrypt length check, ssh user nil guard, command count across hosts

Coverage Stats

10 of 10 new or added lines in 3 files covered. (100.0%)

3195 of 3801 relevant lines covered (84.06%)

59.18 hits per line