update to go 1.21 to fix CVE-2023-44487

.github/workflows/ci.yml

@@ -7,34 +7,46 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       -
         name: Setup Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v4
         with:
-          version: 1.14
+          go-version: 1.21
       -
         name: Download Go tools
         run: |
-          curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.25.0
-          go get golang.org/x/tools/cmd/goimports
+          go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.56.2
+          go install golang.org/x/tools/cmd/goimports@latest
+          echo "PATH=$PATH:$(go env GOPATH)/bin" >> $GITHUB_ENV
       -
         name: Run lint
         run: |
-          export PATH=$PATH:$(go env GOPATH)/bin
           make lint
       -
-        name: Setup OpenShift
-        uses: manusa/actions-setup-openshift@v1.1.2
-        with:
-          oc version: 'v3.11.0'
-          enable: 'centos-imagestreams,persistent-volumes,registry,router'
-          github token: ${{ secrets.GITHUB_TOKEN }}
-      -
-        name: Run tests
+        name: Download OpenShift client
         run: |
-          export PATH=$PATH:$(go env GOPATH)/bin
-          sudo chown -R runner:docker openshift.local.clusterup/
-          make test
+          mkdir -p ~/oc
+          cd ~/oc
+          curl -L https://mirror.openshift.com/pub/openshift-v4/clients/ocp/latest/openshift-client-linux.tar.gz -o oc.tar.gz
+          tar -xzf oc.tar.gz
+          echo "$HOME/oc" >> $GITHUB_PATH
+      -
+        name: Run Unit tests (cannot run openshift tests due to requiring Github runner with ubuntu 20.04)
+        run: make test-unit
+
+      # -
+      #   name: Setup OpenShift
+      #   uses: manusa/actions-setup-openshift@v1.1.4
+      #   timeout-minutes: 15
+      #   with:
+      #     oc version: 'v3.11.0'
+      #     enable: 'centos-imagestreams,persistent-volumes,registry,router'
+      #     github token: ${{ secrets.GITHUB_TOKEN }}
+      # -
+      #   name: Run tests
+      #   run: |
+      #     sudo chown -R runner:docker openshift.local.clusterup/
+      #     make test

.github/workflows/codeql-analysis.yml

@@ -13,7 +13,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         # We must fetch at least the immediate parents so that if this is
         # a pull request then we can checkout the head.
@@ -26,15 +26,15 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
+      uses: github/codeql-action/init@v3
       # Override language selection by uncommenting this and choosing your languages
       # with:
       #   languages: go, javascript, csharp, python, cpp, java
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -48,4 +48,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      uses: github/codeql-action/analyze@v3

go.mod

@@ -2,20 +2,23 @@ module github.com/opendevstack/tailor
 
 require (
 	github.com/alecthomas/kingpin v2.2.6+incompatible
-	github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc // indirect
-	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf // indirect
 	github.com/fatih/color v1.7.0
 	github.com/ghodss/yaml v1.0.0
 	github.com/google/go-cmp v0.3.1
-	github.com/mattn/go-colorable v0.0.9 // indirect
-	github.com/mattn/go-isatty v0.0.3 // indirect
 	github.com/pmezard/go-difflib v1.0.0
-	github.com/stretchr/testify v1.3.0 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f
 	golang.org/x/crypto v0.0.0-20180820150726-614d502a4dac
 	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208
+)
+
+require (
+	github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc // indirect
+	github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf // indirect
+	github.com/mattn/go-colorable v0.0.9 // indirect
+	github.com/mattn/go-isatty v0.0.3 // indirect
+	github.com/stretchr/testify v1.3.0 // indirect
 	golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3 // indirect
 	gopkg.in/yaml.v2 v2.2.1 // indirect
 )
 
-go 1.14
+go 1.21

internal/test/e2e/e2e_test.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"strings"
@@ -79,11 +78,11 @@ func exportInitialState(t *testing.T, testProjectName string, tailorBinary strin
 	if exportErr != nil {
 		t.Fatalf("Could not export initial state: %s\n%s", exportErr, exportStderr)
 	}
-	tempDir, tempDirErr := ioutil.TempDir("..", "initial-export-")
+	tempDir, tempDirErr := os.MkdirTemp("..", "initial-export-")
 	if tempDirErr != nil {
 		t.Fatalf("Could not create temp dir: %s", tempDirErr)
 	}
-	writeErr := ioutil.WriteFile(tempDir+"/template.yml", exportStdout, 0644)
+	writeErr := os.WriteFile(tempDir+"/template.yml", exportStdout, 0644)
 	if writeErr != nil {
 		t.Logf("Failed to write file template.yml into %s", tempDir)
 		os.RemoveAll(tempDir)
@@ -93,7 +92,7 @@ func exportInitialState(t *testing.T, testProjectName string, tailorBinary strin
 }
 
 func walkSubdirs(t *testing.T, dir string, fun func(subdir string)) {
-	files, err := ioutil.ReadDir(dir)
+	files, err := os.ReadDir(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -262,7 +261,7 @@ func runCmd(executable string, args []string) (outBytes, errBytes []byte, err er
 }
 
 func readTestCaseSteps(folder string) (testCaseSteps, error) {
-	content, err := ioutil.ReadFile(folder + "/steps.json")
+	content, err := os.ReadFile(folder + "/steps.json")
 	if err != nil {
 		return nil, fmt.Errorf("Cannot read file: %w", err)
 	}

internal/test/helper/file.go

@@ -2,7 +2,6 @@ package helper
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path"
 	"runtime"
@@ -48,5 +47,5 @@ func readFile(name string) ([]byte, error) {
 		return []byte{}, fmt.Errorf("Could not get filename when looking for %s", name)
 	}
 	filepath := path.Join(path.Dir(filename), name)
-	return ioutil.ReadFile(filepath)
+	return os.ReadFile(filepath)
 }

pkg/cli/cli.go

@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"os/exec"
@@ -136,7 +135,7 @@ func AskForAction(question string, options []string, reader *bufio.Reader) strin
 
 // EditEnvFile opens content in EDITOR, and returns saved content.
 func EditEnvFile(content string) (string, error) {
-	err := ioutil.WriteFile(".ENV.DEC", []byte(content), 0644)
+	err := os.WriteFile(".ENV.DEC", []byte(content), 0644)
 	if err != nil {
 		return "", err
 	}
@@ -160,7 +159,7 @@ func EditEnvFile(content string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	data, err := ioutil.ReadFile(".ENV.DEC")
+	data, err := os.ReadFile(".ENV.DEC")
 	if err != nil {
 		return "", err
 	}

pkg/cli/options.go

@@ -3,7 +3,6 @@ package cli
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"strings"
@@ -619,7 +618,7 @@ func getFileFlags(filename string, verbose bool) (map[string]string, error) {
 		return fileFlags, err
 	}
 
-	b, err := ioutil.ReadFile(filename)
+	b, err := os.ReadFile(filename)
 	if err != nil {
 		return fileFlags, err
 	}

pkg/commands/diff.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
+	"os"
 	"regexp"
 
 	"github.com/opendevstack/tailor/pkg/cli"
@@ -198,7 +198,7 @@ func printUpdateChange(w io.Writer, change *openshift.Change, revealSecrets bool
 func assembleTemplateBasedResourceList(filter *openshift.ResourceFilter, compareOptions *cli.CompareOptions, ocClient cli.OcClientProcessor) (*openshift.ResourceList, error) {
 	var inputs [][]byte
 
-	files, err := ioutil.ReadDir(compareOptions.TemplateDir)
+	files, err := os.ReadDir(compareOptions.TemplateDir)
 	if err != nil {
 		return nil, fmt.Errorf("Cannot get files in template directory '%s': %s", compareOptions.TemplateDir, err)
 	}

pkg/commands/secrets.go

@@ -2,7 +2,6 @@ package commands
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"regexp"
 	"strings"
@@ -74,7 +73,7 @@ func ReEncrypt(secretsOptions *cli.SecretsOptions, filename string) error {
 		}
 	} else {
 		paramDir := secretsOptions.ParamDir
-		files, err := ioutil.ReadDir(paramDir)
+		files, err := os.ReadDir(paramDir)
 		if err != nil {
 			return err
 		}
@@ -171,7 +170,7 @@ func writeEncryptedContent(filename, newContent, previousContent, privateKey, pa
 		return fmt.Errorf("Could not encrypt content: %s", err)
 	}
 
-	err = ioutil.WriteFile(filename, []byte(updatedContent), 0644)
+	err = os.WriteFile(filename, []byte(updatedContent), 0644)
 	if err != nil {
 		return fmt.Errorf("Could not write file: %s", err)
 	}

pkg/openshift/params.go

@@ -3,7 +3,6 @@ package openshift
 import (
 	"encoding/base64"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"regexp"
 	"strings"
@@ -112,7 +111,7 @@ func newWriteConverter(previous, publicKeyDir, privateKey, passphrase string) (*
 
 	// Read public keys
 	cli.DebugMsg(fmt.Sprintf("Looking for public keys in '%s'", publicKeyDir))
-	files, err := ioutil.ReadDir(publicKeyDir)
+	files, err := os.ReadDir(publicKeyDir)
 	if err != nil {
 		return nil, err
 	}

pkg/openshift/params_test.go

@@ -1,7 +1,7 @@
 package openshift
 
 import (
-	"io/ioutil"
+	"os"
 	"strings"
 	"testing"
 )
@@ -63,7 +63,7 @@ func TestEncryptedParams(t *testing.T) {
 }
 
 func readFileContent(t *testing.T, filename string) string {
-	bytes, err := ioutil.ReadFile(filename)
+	bytes, err := os.ReadFile(filename)
 	if err != nil {
 		t.Error(err)
 	}

pkg/openshift/template.go

@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strings"
 
@@ -48,7 +47,7 @@ func ProcessTemplate(templateDir string, name string, paramDir string, compareOp
 			return []byte{}, err
 		}
 
-		tempParamFile, err := ioutil.TempFile("", ".combined.*.env")
+		tempParamFile, err := os.CreateTemp("", ".combined.*.env")
 		if err != nil {
 			return []byte{}, err
 		}
@@ -84,7 +83,7 @@ func ProcessTemplate(templateDir string, name string, paramDir string, compareOp
 
 // Returns true if template contains a param like "name: TAILOR_NAMESPACE"
 func templateContainsTailorNamespaceParam(filename string) (bool, error) {
-	b, err := ioutil.ReadFile(filename)
+	b, err := os.ReadFile(filename)
 	if err != nil {
 		return false, fmt.Errorf("Could not read file '%s': %s", filename, err)
 	}
@@ -159,7 +158,7 @@ func readParamFileBytes(paramFiles []string, privateKey string, passphrase strin
 	paramFileBytes := []byte{}
 	for _, f := range paramFiles {
 		cli.DebugMsg("Reading content of param file", f)
-		b, err := ioutil.ReadFile(f)
+		b, err := os.ReadFile(f)
 		if err != nil {
 			return []byte{}, err
 		}
@@ -173,7 +172,7 @@ func readParamFileBytes(paramFiles []string, privateKey string, passphrase strin
 		encFile := f + ".enc"
 		if _, err := os.Stat(encFile); err == nil {
 			cli.DebugMsg("Reading content of encrypted param file", encFile)
-			b, err := ioutil.ReadFile(encFile)
+			b, err := os.ReadFile(encFile)
 			if err != nil {
 				return []byte{}, err
 			}

pkg/utils/encryption.go

@@ -6,7 +6,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 
 	"golang.org/x/crypto/openpgp"
@@ -136,7 +135,7 @@ func Encrypt(secret string, entityList openpgp.EntityList) (string, error) {
 	}
 
 	// Return as base64 encoded string
-	bytes, err := ioutil.ReadAll(buf)
+	bytes, err := io.ReadAll(buf)
 	if err != nil {
 		return "", err
 	}
@@ -158,6 +157,6 @@ func Decrypt(encoded string, entityList openpgp.EntityList) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("Decrypting '%s' failed: %s", encoded, err)
 	}
-	bytes, err := ioutil.ReadAll(md.UnverifiedBody)
+	bytes, err := io.ReadAll(md.UnverifiedBody)
 	return string(bytes), err
 }

pkg/utils/file.go

@@ -1,7 +1,6 @@
 package utils
 
 import (
-	"io/ioutil"
 	"os"
 )
 
@@ -21,7 +20,7 @@ func ReadFile(filename string) (string, error) {
 	if _, err := os.Stat(filename); err != nil {
 		return "", err
 	}
-	bytes, err := ioutil.ReadFile(filename)
+	bytes, err := os.ReadFile(filename)
 	if err != nil {
 		return "", err
 	}