feat: introduce cve scanners (#500)

ory · Jul 4, 2024 · d229e74 · d229e74
1 parent 1b46b29
commit d229e74
Show file tree

Hide file tree

Showing 181 changed files with 239 additions and 190 deletions.
diff --git a/.github/workflows/cve-scanner.yaml b/.github/workflows/cve-scanner.yaml
@@ -0,0 +1,44 @@
+name: Go Source Scanners
+on:
+  push:
+    branches:
+      - "master"
+      - "v*.*.*"
+      - "v*"
+    tags:
+      - "v*.*.*"
+  pull_request:
+    branches:
+      - "master"
+      - "v*.*.*"
+      - "v*"
+
+jobs:
+  scanners:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Env
+        id: vars
+        shell: bash
+        run: |
+          echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
+      - name: Run Gosec Security Scanner
+        continue-on-error: true
+        uses: securego/gosec@master
+        with:
+          args: ./...
+      - name: Run Govulncheck Scanner
+        continue-on-error: true
+        uses: golang/govulncheck-action@v1
+        with:
+          go-package: ./...
+          go-version-input: "1.22"
+      - name: Run Trivy vulnerability scanner in repo mode
+        continue-on-error: true
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: "fs"
+          ignore-unfixed: true
+          format: "json"
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.21"
+          go-version: 1.22
       - run: make format
       - name: Indicate formatting issues
         run: git diff HEAD --exit-code --color
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: "1.21"
+          go-version: "1.22"
       - run: make test
       - name: WriteGoList
         run: go list -json -deps ./... > go.list

diff --git a/docker/auth.go b/docker/auth.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2015 go-dockerclient authors. All rights reserved.

diff --git a/docker/change.go b/docker/change.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2014 go-dockerclient authors. All rights reserved.

diff --git a/docker/client.go b/docker/client.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2013 go-dockerclient authors. All rights reserved.

diff --git a/docker/client_unix.go b/docker/client_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2016 go-dockerclient authors. All rights reserved.

diff --git a/docker/client_windows.go b/docker/client_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2016 go-dockerclient authors. All rights reserved.

diff --git a/docker/container.go b/docker/container.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2013 go-dockerclient authors. All rights reserved.

diff --git a/docker/distribution.go b/docker/distribution.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2017 go-dockerclient authors. All rights reserved.

diff --git a/docker/env.go b/docker/env.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2014 Docker authors. All rights reserved.

diff --git a/docker/event.go b/docker/event.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2014 go-dockerclient authors. All rights reserved.

diff --git a/docker/exec.go b/docker/exec.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2014 go-dockerclient authors. All rights reserved.

diff --git a/docker/image.go b/docker/image.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2013 go-dockerclient authors. All rights reserved.

diff --git a/docker/misc.go b/docker/misc.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2013 go-dockerclient authors. All rights reserved.

diff --git a/docker/network.go b/docker/network.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 // Copyright 2015 go-dockerclient authors. All rights reserved.

diff --git a/docker/opts/env.go b/docker/opts/env.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/hosts.go b/docker/opts/hosts.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/hosts_unix.go b/docker/opts/hosts_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/opts/hosts_windows.go b/docker/opts/hosts_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/ip.go b/docker/opts/ip.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/opts.go b/docker/opts/opts.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/opts_unix.go b/docker/opts/opts_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/opts/opts_windows.go b/docker/opts/opts_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/quotedstring.go b/docker/opts/quotedstring.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/runtime.go b/docker/opts/runtime.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/opts/ulimit.go b/docker/opts/ulimit.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package opts

diff --git a/docker/pkg/archive/archive.go b/docker/pkg/archive/archive.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/archive_linux.go b/docker/pkg/archive/archive_linux.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/archive_other.go b/docker/pkg/archive/archive_other.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !linux

diff --git a/docker/pkg/archive/archive_unix.go b/docker/pkg/archive/archive_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/pkg/archive/archive_windows.go b/docker/pkg/archive/archive_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/changes.go b/docker/pkg/archive/changes.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/changes_linux.go b/docker/pkg/archive/changes_linux.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/changes_other.go b/docker/pkg/archive/changes_other.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !linux

diff --git a/docker/pkg/archive/changes_unix.go b/docker/pkg/archive/changes_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/pkg/archive/changes_windows.go b/docker/pkg/archive/changes_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/copy.go b/docker/pkg/archive/copy.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/copy_unix.go b/docker/pkg/archive/copy_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/pkg/archive/copy_windows.go b/docker/pkg/archive/copy_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/diff.go b/docker/pkg/archive/diff.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/example_changes.go b/docker/pkg/archive/example_changes.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build ignore

diff --git a/docker/pkg/archive/time_linux.go b/docker/pkg/archive/time_linux.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/time_unsupported.go b/docker/pkg/archive/time_unsupported.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !linux

diff --git a/docker/pkg/archive/whiteouts.go b/docker/pkg/archive/whiteouts.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/archive/wrap.go b/docker/pkg/archive/wrap.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package archive // import "github.com/ory/dockertest/v3/docker/pkg/archive"

diff --git a/docker/pkg/fileutils/fileutils.go b/docker/pkg/fileutils/fileutils.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package fileutils // import "github.com/ory/dockertest/v3/docker/pkg/fileutils"

diff --git a/docker/pkg/fileutils/fileutils_darwin.go b/docker/pkg/fileutils/fileutils_darwin.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package fileutils // import "github.com/ory/dockertest/v3/docker/pkg/fileutils"

diff --git a/docker/pkg/fileutils/fileutils_unix.go b/docker/pkg/fileutils/fileutils_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build linux || freebsd

diff --git a/docker/pkg/fileutils/fileutils_windows.go b/docker/pkg/fileutils/fileutils_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package fileutils // import "github.com/ory/dockertest/v3/docker/pkg/fileutils"

diff --git a/docker/pkg/homedir/homedir_linux.go b/docker/pkg/homedir/homedir_linux.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package homedir // import "github.com/ory/dockertest/v3/docker/pkg/homedir"

diff --git a/docker/pkg/homedir/homedir_others.go b/docker/pkg/homedir/homedir_others.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !linux

diff --git a/docker/pkg/homedir/homedir_unix.go b/docker/pkg/homedir/homedir_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/pkg/homedir/homedir_windows.go b/docker/pkg/homedir/homedir_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package homedir // import "github.com/ory/dockertest/v3/docker/pkg/homedir"

diff --git a/docker/pkg/idtools/idtools.go b/docker/pkg/idtools/idtools.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package idtools // import "github.com/ory/dockertest/v3/docker/pkg/idtools"

diff --git a/docker/pkg/idtools/idtools_unix.go b/docker/pkg/idtools/idtools_unix.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !windows

diff --git a/docker/pkg/idtools/idtools_windows.go b/docker/pkg/idtools/idtools_windows.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package idtools // import "github.com/ory/dockertest/v3/docker/pkg/idtools"

diff --git a/docker/pkg/idtools/usergroupadd_linux.go b/docker/pkg/idtools/usergroupadd_linux.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 package idtools // import "github.com/ory/dockertest/v3/docker/pkg/idtools"

diff --git a/docker/pkg/idtools/usergroupadd_unsupported.go b/docker/pkg/idtools/usergroupadd_unsupported.go
@@ -1,4 +1,4 @@
-// Copyright © 2023 Ory Corp
+// Copyright © 2024 Ory Corp
 // SPDX-License-Identifier: Apache-2.0
 
 //go:build !linux