Skip to content

Commit 2c49f50

Browse files
uditgauravuditgaurav
authored
Fix the promql-cli vulnerabilities (#1)
Signed-off-by: uditgaurav <udit@chaosnative.com>
1 parent 6e3cd4d commit 2c49f50

6 files changed

Lines changed: 112 additions & 68 deletions

File tree

‎.github/workflows/build-image.yml‎

Lines changed: 43 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,43 @@
1-
name: build-and-push-image
2-
on:
3-
push:
4-
branches:
5-
- main
6-
- master
7-
tags:
8-
- "v*.*.*"
9-
jobs:
10-
build_and_push:
11-
runs-on: ubuntu-latest
12-
steps:
13-
- name: Checkout
14-
uses: actions/checkout@v2
15-
- name: Get tag metadata
16-
id: meta
17-
uses: docker/metadata-action@v3
18-
with:
19-
images: |
20-
ghcr.io/nalbury/promql-cli
21-
tags: |
22-
type=ref,event=branch
23-
type=semver,pattern={{version}}
24-
- name: Set up QEMU
25-
uses: docker/setup-qemu-action@v1
26-
- name: Set up Docker Buildx
27-
uses: docker/setup-buildx-action@v1
28-
- name: Login to GitHub Container Registry
29-
uses: docker/login-action@v1
30-
with:
31-
registry: ghcr.io
32-
username: ${{ github.repository_owner }}
33-
password: ${{ secrets.GITHUB_TOKEN }}
34-
- name: Build and Push
35-
uses: docker/build-push-action@v2
36-
with:
37-
context: .
38-
platforms: linux/amd64,linux/arm64
39-
tags: ${{ steps.meta.outputs.tags }}
40-
labels: ${{ steps.meta.outputs.labels }}
41-
push: true
1+
## NOTE: To build the image please uncomment the workflow
2+
3+
# name: build-and-push-image
4+
# on:
5+
# push:
6+
# branches:
7+
# - main
8+
# - master
9+
# tags:
10+
# - "v*.*.*"
11+
# jobs:
12+
# build_and_push:
13+
# runs-on: ubuntu-latest
14+
# steps:
15+
# - name: Checkout
16+
# uses: actions/checkout@v2
17+
# - name: Get tag metadata
18+
# id: meta
19+
# uses: docker/metadata-action@v3
20+
# with:
21+
# images: |
22+
# ghcr.io/nalbury/promql-cli
23+
# tags: |
24+
# type=ref,event=branch
25+
# type=semver,pattern={{version}}
26+
# - name: Set up QEMU
27+
# uses: docker/setup-qemu-action@v1
28+
# - name: Set up Docker Buildx
29+
# uses: docker/setup-buildx-action@v1
30+
# - name: Login to GitHub Container Registry
31+
# uses: docker/login-action@v1
32+
# with:
33+
# registry: ghcr.io
34+
# username: ${{ github.repository_owner }}
35+
# password: ${{ secrets.GITHUB_TOKEN }}
36+
# - name: Build and Push
37+
# uses: docker/build-push-action@v2
38+
# with:
39+
# context: .
40+
# platforms: linux/amd64,linux/arm64
41+
# tags: ${{ steps.meta.outputs.tags }}
42+
# labels: ${{ steps.meta.outputs.labels }}
43+
# push: true

‎.github/workflows/release.yml‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,38 @@
11
name: Release
22
on:
3-
push:
4-
tags:
5-
- 'v*'
3+
workflow_dispatch:
4+
inputs:
5+
release_tag:
6+
description: 'release tag'
7+
required: true
8+
release_title:
9+
description: 'release title'
10+
required: false
11+
release_notes:
12+
description: 'release notes'
13+
required: false
14+
default: ''
615
jobs:
716
release:
8-
runs-on: ubuntu-20.04
17+
runs-on: ubuntu-latest
918
steps:
1019
- name: Install Go
1120
uses: actions/setup-go@v2
1221
with:
13-
go-version: 1.16.x
22+
go-version: 1.17.x
1423
- name: Checkout code
1524
uses: actions/checkout@v2
25+
1626
- name: Create release artifacts
17-
run: VERSION=$(awk -F '/' '{print $3}'<<< "$GITHUB_REF") make release
18-
- name: Create release
19-
env:
20-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2127
run: |
22-
VERSION=$(awk -F '/' '{print $3}'<<< "$GITHUB_REF")
23-
for f in ./build/artifacts/*
24-
do
25-
[ -f "$f" ] && assets+=(-a "$f")
26-
done
27-
hub release create -m "Release ${VERSION}" \
28-
"${assets[@]}" "${VERSION}"
28+
OS="linux" ARCH="amd64" make build
29+
OS="linux" ARCH="arm64" make build
30+
31+
- name: create release along with artifact
32+
uses: ncipollo/release-action@v1
33+
with:
34+
artifacts: "./build/bin/*"
35+
body: "${{ github.event.inputs.release_notes }}"
36+
token: ${{ secrets.GITHUB_TOKEN }}
37+
name: "${{ github.event.inputs.release_title }}"
38+
tag: ${{ github.event.inputs.release_tag }}

‎LICENSE‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
Apache License
32
Version 2.0, January 2004
43
http://www.apache.org/licenses/

‎Makefile‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,10 @@ GOARCH = $(strip $(ARCH))
88
V = $(strip $(VERSION))
99
P = $(strip $(INSTALL_PATH))
1010

11-
BUILD_PATH = ./build/bin/$(GOOS)/$(GOARCH)
11+
BUILD_PATH = ./build/bin
1212
ARTIFACT_PATH = ./build/artifacts
1313

14-
export GO_BUILD=GOOS=$(GOOS) GOARCH=$(GOARCH) go build -o $(BUILD_PATH)/promql ./
14+
export GO_BUILD=GOOS=$(GOOS) GOARCH=$(GOARCH) go build -o $(BUILD_PATH)/promql_$(GOOS)_$(GOARCH) ./
1515
export TAR=tar -czvf $(ARTIFACT_PATH)/promql-$(V)-$(GOOS)-$(GOARCH).tar.gz -C $(BUILD_PATH) promql
1616

1717
build: setup ## Build promql binary
@@ -30,7 +30,6 @@ build-all: ## Build binaries for linux and macOS
3030

3131
build-artifact: setup ## Build binary and create release artifact
3232
$(GO_BUILD)
33-
$(TAR)
3433

3534
release: ## Build binaries and create release artifacts for both linux and macOS
3635
OS="darwin" ARCH="amd64" make build-artifact
@@ -52,4 +51,4 @@ help: ## Print Makefile help
5251
@echo "#### Environment Variables ####"
5352
@awk '$$4 == "##" {gsub(/\?=./, "", $$0); $$2="(default: "$$2")"; printf "-- %s \n", $$0}' Makefile
5453
@echo "#### Targets ####"
55-
@awk '$$1 ~ /^.*:$$/ {gsub(":", "", $$1);printf "-- %s \n", $$0}' Makefile
54+
@awk '$$1 ~ /^.*:$$/ {gsub(":", "", $$1);printf "-- %s \n", $$0}' Makefile

‎go.mod‎

Lines changed: 38 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,50 @@
11
module github.com/nalbury/promql-cli
22

3-
go 1.16
3+
go 1.17
44

55
require (
66
github.com/guptarohit/asciigraph v0.4.2-0.20191006150553-f9506970428c
7-
github.com/kr/pretty v0.2.1 // indirect
87
github.com/mitchellh/go-homedir v1.1.0
98
github.com/prometheus/client_golang v1.10.0
109
github.com/prometheus/common v0.18.0
1110
github.com/spf13/cobra v1.1.3
1211
github.com/spf13/viper v1.7.0
1312
github.com/stretchr/testify v1.6.1
1413
)
14+
15+
require (
16+
github.com/beorn7/perks v1.0.1 // indirect
17+
github.com/cespare/xxhash/v2 v2.1.1 // indirect
18+
github.com/davecgh/go-spew v1.1.1 // indirect
19+
github.com/fsnotify/fsnotify v1.4.7 // indirect
20+
github.com/golang/protobuf v1.4.3 // indirect
21+
github.com/hashicorp/hcl v1.0.0 // indirect
22+
github.com/inconshreveable/mousetrap v1.0.0 // indirect
23+
github.com/jpillora/backoff v1.0.0 // indirect
24+
github.com/json-iterator/go v1.1.10 // indirect
25+
github.com/kr/pretty v0.2.1 // indirect
26+
github.com/magiconair/properties v1.8.1 // indirect
27+
github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
28+
github.com/mitchellh/mapstructure v1.1.2 // indirect
29+
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
30+
github.com/modern-go/reflect2 v1.0.1 // indirect
31+
github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f // indirect
32+
github.com/pelletier/go-toml v1.2.0 // indirect
33+
github.com/pmezard/go-difflib v1.0.0 // indirect
34+
github.com/prometheus/client_model v0.2.0 // indirect
35+
github.com/prometheus/procfs v0.6.0 // indirect
36+
github.com/spf13/afero v1.1.2 // indirect
37+
github.com/spf13/cast v1.3.0 // indirect
38+
github.com/spf13/jwalterweatherman v1.0.0 // indirect
39+
github.com/spf13/pflag v1.0.5 // indirect
40+
github.com/subosito/gotenv v1.2.0 // indirect
41+
golang.org/x/net v0.0.0-20200625001655-4c5254603344 // indirect
42+
golang.org/x/sys v0.0.0-20210309074719-68d13333faf2 // indirect
43+
golang.org/x/text v0.3.2 // indirect
44+
google.golang.org/protobuf v1.23.0 // indirect
45+
gopkg.in/ini.v1 v1.51.0 // indirect
46+
gopkg.in/yaml.v2 v2.4.0 // indirect
47+
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c // indirect
48+
)
49+
50+
replace golang.org/x/text => golang.org/x/text v0.3.3

‎go.sum‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -447,10 +447,8 @@ golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7w
447447
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
448448
golang.org/x/sys v0.0.0-20210309074719-68d13333faf2 h1:46ULzRKLh1CwgRq2dC5SlBzEqqNCi8rreOZnNrbqcIY=
449449
golang.org/x/sys v0.0.0-20210309074719-68d13333faf2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
450-
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
451-
golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
452-
golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
453-
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
450+
golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
451+
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
454452
golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
455453
golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
456454
golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=

0 commit comments

Comments
 (0)