Fix deletion guard for Gateway TargetGroupConfigurations still referenced by TCPRoutes #2713
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Dependency Review" | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'release-*' | |
| pull_request: | |
| workflow_dispatch: | |
| inputs: | |
| head_ref: | |
| description: 'HEAD git reference (tag/branch/commit) to analyze' | |
| required: true | |
| default: 'main' | |
| type: string | |
| base_ref: | |
| description: 'Base git reference (tag/branch/commit) to compare against head_ref' | |
| required: true | |
| default: 'main' | |
| type: string | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: "Checkout Repository" | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| show-progress: false | |
| - name: "Dependency Review" | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 | |
| with: | |
| base-ref: ${{ inputs.base_ref || github.event.pull_request.base.sha || 'main' }} | |
| head-ref: ${{ inputs.head_ref || github.event.pull_request.head.sha || github.ref }} | |
| govulncheck: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: "Checkout Repository" | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd | |
| with: | |
| show-progress: false | |
| - name: Setup Go Version | |
| run: echo "GO_VERSION=$(cat .go-version)" >> $GITHUB_ENV | |
| - name: Setup Go | |
| uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| - name: Run govulncheck | |
| run: | | |
| set -euo pipefail | |
| # govulncheck has no native suppression, so we filter its JSON output: fail on | |
| # any "called" vuln not in IGNORE. | |
| # | |
| # IGNORE: containerd CRI checkpoint/restore advisories. Fix exists only in the | |
| # containerd v2 module; we get v1.7.x transitively via the Helm SDK (e2e tests | |
| # only, not linked into the controller binary), so it shows "Fixed in: N/A" and | |
| # can't be bumped until Helm moves to containerd/v2. Remove once that happens. | |
| # GO-2026-5338 https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574 | |
| # GO-2026-5064 https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc | |
| # GO-2026-5622 https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388 | |
| # | |
| # GO-2026-5932: golang.org/x/crypto/openpgp is deprecated with no fixed version. | |
| # Pulled transitively via helm.sh/helm/v3 (pkg/provenance). Helm v4 migrated to | |
| # github.com/ProtonMail/go-crypto but no v3 release includes it. Remove once we | |
| # upgrade to Helm v4. | |
| # GO-2026-5932 https://pkg.go.dev/vuln/GO-2026-5932 | |
| IGNORE="GO-2026-5338 GO-2026-5064 GO-2026-5622 GO-2026-5932" | |
| govulncheck -format json ./... > govulncheck.json | |
| # "called" vulns are findings whose leading trace frame resolves to a function. | |
| called="$(jq -r 'select(.finding != null) | .finding | select(.trace[0].function != null) | .osv' govulncheck.json | sort -u)" | |
| unexpected="" | |
| for id in ${called}; do | |
| case " ${IGNORE} " in | |
| *" ${id} "*) ;; | |
| *) unexpected="${unexpected} ${id}" ;; | |
| esac | |
| done | |
| if [ -n "${unexpected}" ]; then | |
| echo "::error::govulncheck found vulnerabilities not in the ignore list:${unexpected}" | |
| govulncheck ./... || true | |
| exit 1 | |
| fi | |
| echo "govulncheck OK. Ignored (no fix available) called vulns: ${called:-none}" |