Skip to content
Open
Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
90 changes: 56 additions & 34 deletions .github/workflows/go.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: Go

Check warning on line 1 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

go.yml:1: overly broad permissions: default permissions used due to no permissions: block

on:
push:
Expand All @@ -7,10 +7,10 @@
schedule:
- cron: "0 0 * * *"
jobs:
build:

Check warning on line 10 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

go.yml:10: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check failure on line 13 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 13 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:13: unpinned action reference: action is not pinned to a hash (required by blanket policy)
# Go & staticcheck build cache require a lot of disk space. Reclaim extra
# space for the container by removing unnecessary tooling.
- name: Free additional disk space
Expand All @@ -19,24 +19,20 @@
sudo rm -rf /usr/local/lib/android
sudo rm -rf /opt/hostedtoolcache/CodeQL
- name: Set up Go
uses: actions/setup-go@v5

Check failure on line 22 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 22 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:22: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
go-version-file: 'go.mod'
cache: true
- name: Move cache
run: |
sudo mv "${HOME}/.cache" /mnt/cache
ln -s /mnt/cache "${HOME}/.cache"
# Dependency for Go module github.com/google/gopacket
- name: Install libpcap-dev
run: sudo apt-get -y install libpcap-dev
- name: Build
run: go build -v ./...

test:

Check warning on line 32 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

go.yml:32: overly broad permissions: default permissions used due to no permissions: block
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check failure on line 35 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 35 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:35: unpinned action reference: action is not pinned to a hash (required by blanket policy)
# Go & staticcheck build cache require a lot of disk space. Reclaim extra
# space for the container by removing unnecessary tooling.
- name: Free additional disk space
Expand All @@ -45,14 +41,10 @@
sudo rm -rf /usr/local/lib/android
sudo rm -rf /opt/hostedtoolcache/CodeQL
- name: Set up Go
uses: actions/setup-go@v5

Check failure on line 44 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 44 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:44: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
go-version-file: 'go.mod'
cache: true
- name: Move cache
run: |
sudo mv "${HOME}/.cache" /mnt/cache
ln -s /mnt/cache "${HOME}/.cache"
# Dependency for Go module github.com/google/gopacket
- name: Install libpcap-dev
run: sudo apt-get -y install libpcap-dev
Expand All @@ -63,63 +55,93 @@
with:
path-to-profile: profile.cov

static_analysis:
name: Static Analysis
fast_analysis:

Check warning on line 58 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

go.yml:58: overly broad permissions: default permissions used due to no permissions: block
name: Fast Analysis
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check failure on line 62 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 62 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:62: unpinned action reference: action is not pinned to a hash (required by blanket policy)
- name: Free additional disk space
run: |
sudo rm -rf /usr/share/dotnet
sudo rm -rf /usr/local/lib/android
sudo rm -rf /opt/hostedtoolcache/CodeQL
- name: Set up Go
uses: actions/setup-go@v5

Check failure on line 69 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 69 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:69: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
go-version-file: 'go.mod'
cache: true
- name: Move cache
run: |
sudo mv "${HOME}/.cache" /mnt/cache
ln -s /mnt/cache "${HOME}/.cache"
# Dependency for Go module github.com/google/gopacket
- name: Install libpcap-dev
run: sudo apt-get -y install libpcap-dev

# === THIS IS THE ONLY CHANGE ===
- name: Clean Go build cache before analysis
run: go clean -cache
# ===============================

- name: Go vet
run: GOGC=30 go vet ./...
- name: Gofmt
run: |
# gofmt always returns true, so we use grep '^' which returns
# true on non-empty output, but will otherwise passthrough all
# output lines.
if gofmt -d -s . | grep '^'; then
# Use find to exclude generated pb.go files which take too long to parse
unformatted=$(find . -name "*.go" -type f | grep -v "pb.go$" | xargs gofmt -d -s)
if [ -n "$unformatted" ]; then
echo "$unformatted"
exit 1
fi
- name: Get goimports
run: go install golang.org/x/tools/cmd/goimports@latest
- name: Goimports
run: |
# goimports always returns true, so we use grep '^' which returns
# true on non-empty output, but will otherwise passthrough all
# output lines.
#
# goimports does not support "gofmt -s" so both goimports and gofmt are
# required.
find . -name "*.go" | egrep -v "pb.go$" | while read l; do
if goimports -d $l | grep '^'; then
exit 1;
fi;
done
# goimports does not support "gofmt -s" so both goimports and gofmt are required.
unformatted=$(find . -name "*.go" -type f | grep -v "pb.go$" | xargs goimports -l)
if [ -n "$unformatted" ]; then
echo "The following files have goimports formatting errors:"
echo "$unformatted"
exit 1
fi
- name: Get revive
run: go install github.com/mgechev/revive@v1.3.4
- name: Run revive
run: revive ./...

- name: Get changed Go directories
id: changed-dirs
if: github.event_name == 'pull_request'
uses: tj-actions/changed-files@v44

Check failure on line 106 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/unpinned-uses

unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 106 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/known-vulnerable-actions

action has a known vulnerability: GHSA-mrrh-fwg8-r2c3

Check failure on line 106 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:106: unpinned action reference: action is not pinned to a hash (required by blanket policy)

Check failure on line 106 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

known-vulnerable-actions

go.yml:106: action has a known vulnerability: GHSA-mrrh-fwg8-r2c3
with:
files: |
**/*.go
dir_names: true

- name: Get staticcheck
if: github.event_name == 'pull_request' && steps.changed-dirs.outputs.any_changed == 'true'
run: go install honnef.co/go/tools/cmd/staticcheck@latest

- name: Run staticcheck on changed packages
if: github.event_name == 'pull_request' && steps.changed-dirs.outputs.any_changed == 'true'
run: |
for dir in ${{ steps.changed-dirs.outputs.all_changed_files }}; do

Check failure on line 119 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

zizmor/template-injection

code injection via template expansion: may expand into attacker-controllable code
echo "Running staticcheck on ./$dir/..."
GOGC=30 staticcheck "./$dir/..."
done

deep_analysis:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Check warning on line 124 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

excessive-permissions

go.yml:124: overly broad permissions: default permissions used due to no permissions: block
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
name: Deep Analysis (Staticcheck)
# Only run on cron schedule or push to main, NOT on pull requests
if: github.event_name != 'pull_request'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check failure on line 130 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:130: unpinned action reference: action is not pinned to a hash (required by blanket policy)
- name: Free additional disk space
run: |
sudo rm -rf /usr/share/dotnet
sudo rm -rf /usr/local/lib/android
sudo rm -rf /opt/hostedtoolcache/CodeQL
- name: Set up Go
uses: actions/setup-go@v5

Check failure on line 137 in .github/workflows/go.yml

View workflow job for this annotation

GitHub Actions / zizmor-output

unpinned-uses

go.yml:137: unpinned action reference: action is not pinned to a hash (required by blanket policy)
with:
go-version-file: 'go.mod'
cache: true
# Dependency for Go module github.com/google/gopacket
- name: Install libpcap-dev
run: sudo apt-get -y install libpcap-dev

- name: Get staticcheck
run: go install honnef.co/go/tools/cmd/staticcheck@latest
- name: Run staticcheck
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,8 @@ func TestMain(m *testing.M) {

func verifyLaserBiasValue(t *testing.T, laserBiasValue float64) {
t.Helper()
if laserBiasValue <= 0 && laserBiasValue >= 131 {
t.Errorf("The laser bias value is not between 0 and 131")
if laserBiasValue < 0.0 || laserBiasValue > 131.0 {
t.Errorf("The laser bias value %f is not between 0 and 131", laserBiasValue)
}
}

Expand All @@ -67,7 +67,7 @@ func verifyLaserBiasCurrentAll(t *testing.T, p1Stream *samplestream.SampleStream
}
laserBiasInstant := laserBiasVal.GetInstant()
if reflect.TypeOf(laserBiasInstant).Kind() != reflect.Float64 {
t.Fatalf("Return value is not type string")
t.Fatalf("Return value is not type float64")
}
t.Logf("laserBias Instant value: %f", laserBiasInstant)
if deviations.MissingZROpticalChannelTunableParametersTelemetry(dut1) {
Expand All @@ -81,7 +81,7 @@ func verifyLaserBiasCurrentAll(t *testing.T, p1Stream *samplestream.SampleStream
t.Logf("laserBias Max value: %f", laserBiasMax)
laserBiasAvg := laserBiasVal.GetAvg()
verifyLaserBiasValue(t, laserBiasAvg)
t.Logf("laserBias Avg value: %f", laserBiasMin)
t.Logf("laserBias Avg value: %f", laserBiasAvg)
if laserBiasAvg >= laserBiasMin && laserBiasAvg <= laserBiasMax {
t.Logf("The average %f is between the maximum and minimum values", laserBiasAvg)
} else {
Expand Down Expand Up @@ -144,8 +144,8 @@ func TestZRLaserBiasCurrentStateInterfaceFlap(t *testing.T) {
// Wait 120 sec cooling-off period
gnmi.Await(t, dut1, gnmi.OC().Interface(dp1.Name()).OperStatus().State(), intUpdateTime, oc.Interface_OperStatus_DOWN)
t.Logf("%v operational status is: %v", dp1.Name(), gnmi.Get(t, dut1, gnmi.OC().Interface(dp1.Name()).OperStatus().State()))
t.Log("Wait to update telemetry")
time.Sleep(80 * time.Second)
t.Log("Wait for laser bias current to update to 0.0")
gnmi.Await(t, dut1, component.OpticalChannel().LaserBiasCurrent().Instant().State(), 2*time.Minute, 0.0)
Comment thread
RishabhAgarwal-2001 marked this conversation as resolved.
verifyLaserBiasCurrentAll(t, p1Stream, dut1)
// Enable interface
cfgplugins.ToggleInterface(t, dut1, dp1.Name(), true)
Expand Down
Loading