Update dependencies, move to Go 1.27.1, add GitHub Actions CI - #823
Merged
Conversation
Refresh every direct and indirect module to its newest release and re-vendor the tree. The Docker client dependency moved from the single moby/moby/v2 module to the split moby/moby/api and moby/moby/client modules, which supersedes the open Dependabot pull request for that bump. Several of the new modules require a newer language version, so the go directive moves up with them, to 1.27.1.
The fs plugin's restore loop returned on end of file, so the summary line that counts the restored files could never run. Break out of the loop instead, and the count prints as it was meant to. The tenant tests assigned AdminUser and OtherUser to themselves right after building them, which does nothing; drop both lines.
Match the toolchain the module now requires.
Both apt-get lines pulled in recommended packages along with the ones they asked for, which grows the image with software SHIELD never calls. Ask for the named packages alone.
The Concourse pipeline this repository used has been dark for a while, and its stuck status check was the reason recent dependency pull requests sat unmerged. Replace it with a workflow that runs on the FiveTwenty self-hosted runners, in a golang container, the way the graft and ocfp repositories already do. Five jobs run on every push and pull request: gofmt and go vet, the unit suite under the race detector, a vendored build of every binary and plugin, the plugin suite, and a security scan that pairs govulncheck with trivy. The plugin suite reports without blocking, because eight of its specs already fail on develop against help text the plugin framework no longer prints. Trivy suppressions and the reasons we accept them live in .trivyignore.
Weekly pull requests for Go modules, workflow actions, and the base images. Patch and minor Go bumps travel together in one pull request so the small runner pool is not swamped; major bumps stay on their own, since those want reading. The github-actions ecosystem is what keeps the workflow's commit-SHA action pins from going stale.
Travis last built this repository against Go 1.8 and has not run in years. Remove the config and its helper script, and point the README badge at the new workflow.
This was referenced Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merges the open Dependabot work, refreshes every dependency, moves the toolchain to Go 1.27.1, and replaces the dark Concourse pipeline with a GitHub Actions workflow that runs on the FiveTwenty lab runners.
Dependencies
Four Dependabot pull requests (#816, #818, #820, #821) are already merged into develop. The fifth, #819, bumped
github.com/moby/moby/v2; the Docker client has since split intomoby/moby/apiandmoby/moby/client, so that module is gone fromgo.modentirely and the pull request is superseded.On top of those merges, every direct and indirect module moves to its latest release and the vendor tree is rebuilt. The go directive moves to 1.27.1, and the Dockerfile builds with the same toolchain.
Continuous integration
There were no workflows in this repository. The new
.github/workflows/ci.ymlruns five jobs on every push and pull request against develop and main, each in agolang:1.27.1container on aself-hostedrunner:gofmtover the tracked sources andgo vet ./...make go-tests, which builds the binaries the agent suite shells out to and then runs the suite under the race detectorgo mod verify, a vendored build of every package, andmake buildmake plugin-tests, reporting without blocking (see below)govulncheckplus atrivyfilesystem scan gated at HIGH and CRITICALActions are pinned to full commit SHAs at their current releases:
actions/checkoutv7.0.1,actions/setup-gov7.0.0, andtrivyv0.74.0. A new.github/dependabot.ymlkeeps those pins, the Go modules, and the base images current on a weekly schedule.Everything the workflow gates on was run locally against this branch and passes:
gofmtis clean,go vetis clean, the race suite is green across all nine packages, the vendored build succeeds,govulncheckfinds nothing reachable, andtrivyexits zero. The image builds andshieldd --versionruns out of it.Two things worth reading
The plugin suite is not a gate yet. Eight of the 134 specs in
t/pluginsfail on develop today, and they failed before this branch too. They assert the compactUSAGE: ...help that the plugin framework printed for-hbefore it was changed to print the long help for both flags. Deciding whether the framework or the expectations should move is a separate change, so the job runs withcontinue-on-errorand the comment above it says to drop that once the eight are settled.Two small code fixes ride along, because the Lint job gates on
go vetandgo vetreported two things. The fs plugin's restore loop returned on end of file, so the line that reports how many files it restored could never run; it now breaks out of the loop. The tenant tests assigned two variables to themselves; those lines are gone.The API suite (
t/api) is not wired up. It downloads Vault 1.9.0 from the web and spins up a daemon, and that wants its own decision about which Vault the tests should run against.