fix: critical and high vulnerabilities (Cr 24607 sync v1.9.2)

.github/workflows/changelog.yaml

@@ -26,7 +26,7 @@ jobs:
       - run: git tag -l 'v*'
       # avoid invoking `make` to reduce the risk of a Makefile bug failing this workflow
       - run: ./hack/changelog.sh > CHANGELOG.md
-      - uses: peter-evans/create-pull-request@v5
+      - uses: peter-evans/create-pull-request@v6
         with:
           title: 'docs: updated CHANGELOG.md'
           commit-message: 'docs: updated CHANGELOG.md'

.github/workflows/ci.yaml

@@ -21,11 +21,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v4.1.0
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: "1.21"
       - name: Restore go build cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cache/go-build
@@ -36,9 +36,9 @@ jobs:
       - name: Install protoc
         run: |
           set -eux -o pipefail
-          PROTOC_VERSION=3.11.1
+          PROTOC_VERSION=3.19.4
           PROTOC_ZIP=protoc-$PROTOC_VERSION-linux-x86_64.zip
-          curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.11.1/$PROTOC_ZIP
+          curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v$PROTOC_VERSION/$PROTOC_ZIP
           sudo unzip -o $PROTOC_ZIP -d /usr/local bin/protoc
           sudo unzip -o $PROTOC_ZIP -d /usr/local 'include/*'
           sudo chmod +x /usr/local/bin/protoc
@@ -70,11 +70,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v4.1.0
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: "1.21"
       - name: Restore go build cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cache/go-build
@@ -97,11 +97,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v4.1.0
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: "1.21"
       - name: Restore go build cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cache/go-build
@@ -130,11 +130,11 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v4.1.0
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: "1.21"
       - name: Restore go build cache
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cache/go-build

.github/workflows/dependabot-reviewer.yml

@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.6.0
+        uses: dependabot/fetch-metadata@v2.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Approve PR

.github/workflows/gh-pages.yaml

@@ -17,19 +17,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Setup Python
-        uses: actions/setup-python@v5.0.0
+        uses: actions/setup-python@v5
         with:
           python-version: 3.9
       - name: Setup Golang
-        uses: actions/setup-go@v4.1.0
+        uses: actions/setup-go@v5
         with:
-          go-version: '1.20'
+          go-version: '1.21'
       - name: build
         run: |
           pip install mkdocs==1.3.0 mkdocs_material==8.2.9
           mkdocs build
       - name: deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./site

.github/workflows/release.yml

@@ -24,9 +24,9 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Setup Go
-        uses: actions/setup-go@v4.1.0
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: "1.21"
 
       - name: Build binaries
         run: |
@@ -95,9 +95,9 @@ jobs:
           else
             echo "VERSION=${GITHUB_REF##*/}" >> $GITHUB_OUTPUT
           fi
-      - uses: actions/setup-go@v4.1.0
+      - uses: actions/setup-go@v5
         with:
-          go-version: "1.20"
+          go-version: "1.21"
       - uses: actions/checkout@v4
       - run: go install sigs.k8s.io/bom/cmd/[email protected]
       - run: go install github.com/spdx/spdx-sbom-generator/cmd/[email protected]
@@ -152,7 +152,7 @@ jobs:
           password: ${{ secrets.QUAYIO_PASSWORD }}
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1
+        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
         with:
           cosign-release: 'v2.1.1'
 
@@ -175,7 +175,7 @@ jobs:
           cosign sign-blob -y /tmp/sbom.tar.gz > /tmp/sbom.tar.gz.sig
 
       - name: Release binaries
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         if: startsWith(github.ref, 'refs/tags/')
         with:
           files: |

.golangci.yml

@@ -9,7 +9,7 @@ run:
 linters:
   enable:
     - deadcode
-    - depguard
+   # - depguard
     - dogsled
     - goconst
     - gocritic
@@ -23,7 +23,7 @@ linters:
     - nakedret
     - rowserrcheck
     - staticcheck
-    - structcheck
+   # - structcheck
     - typecheck
     - unconvert
     - unused

Dockerfile

@@ -8,7 +8,7 @@ RUN apk update && apk upgrade && \
     apk add ca-certificates && \
     apk --no-cache add tzdata
 
-ENV ARGO_VERSION=v3.4.8
+ENV ARGO_VERSION=v3.5.4
 
 RUN wget -q https://github.com/argoproj/argo-workflows/releases/download/${ARGO_VERSION}/argo-linux-${ARCH}.gz
 RUN gunzip -f argo-linux-${ARCH}.gz

Makefile

@@ -16,8 +16,8 @@ EXECUTABLES = curl docker gzip go
 #  docker image publishing options
 DOCKER_PUSH?=false
 IMAGE_NAMESPACE?=quay.io/codefresh
-VERSION?=v1.9.0-cap-CR-22221
-BASE_VERSION:=v1.9.0-cap-CR-22221
+VERSION?=v1.9.2-cap-CR-24607
+BASE_VERSION:=v1.9.2-cap-CR-24607
 
 override LDFLAGS += \
   -X ${PACKAGE}.version=${VERSION} \
@@ -155,12 +155,12 @@ start: image
 	kubectl -n argo-events wait --for=condition=Ready --timeout 60s pod --all
 
 $(GOPATH)/bin/golangci-lint:
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b `go env GOPATH`/bin v1.52.1
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b `go env GOPATH`/bin v1.54.1
 
 .PHONY: lint
 lint: $(GOPATH)/bin/golangci-lint
 	go mod tidy
-	golangci-lint run --fix --verbose --concurrency 4 --timeout 10m
+	golangci-lint run --fix --verbose --concurrency 4 --timeout 5m --enable goimports
 
 # release - targets only available on release branch
 ifneq ($(findstring release,$(GIT_BRANCH)),)
@@ -193,6 +193,10 @@ update-manifests-version:
 	mv /tmp/wh_kustomization.yaml manifests/extensions/validating-webhook/kustomization.yaml
 	cat Makefile | sed 's/^VERSION?=.*/VERSION?=$(VERSION)/' | sed 's/^BASE_VERSION:=.*/BASE_VERSION:=$(VERSION)/' > /tmp/ae_makefile
 	mv /tmp/ae_makefile Makefile
+	find ./manifests -type f -name "*.yaml" -exec \
+      sed -i.bak \
+        -e "s|quay\.io/codefresh/argo-events:[^ ]*|quay.io/codefresh/argo-events:$(VERSION)|g" \
+        {} +
 
 .PHONY: checksums
 checksums:

USERS.md

@@ -52,3 +52,4 @@ Organizations below are **officially** using Argo Events. Please send a PR with
 1. [Yubo](https://www.yubo.live/)
 1. [WooliesX](https://wooliesx.com.au/)
 1. [Woolworths Group](https://www.woolworthsgroup.com.au/)
+1. [Zillow Group](https://www.zillow.com)