chore: Update deps#193
Merged
Merged
Conversation
|
Caution Review failedPull request was closed or merged during review Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (7)
WalkthroughBumps Go toolchain and many modules; pins and upgrades GitHub Actions and Go matrices; updates Docker base images and docker‑compose service pins; replaces test Testcontainers Postgres image and maps ports via int(port.Num()); consolidates Sentry API-error fields into one context map. ChangesRepository upgrades & infra
Tests & runtime helpers
Sentry instrumentation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates several golang.org/x/ dependencies, including crypto, image, term, text, sys, and net. A review comment suggests running go mod tidy to consolidate the require blocks and ensure the go.mod and go.sum files are in a consistent, idiomatic state.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 20-23: The go.mod x/* deps are resolvable and safe but the scanner
flagged SSH advisories likely due to version/range mismatch; update
golang.org/x/crypto to v0.52.0 (keeping golang.org/x/image, x/term, x/text at
latest), run go mod tidy and go mod vendor (or go get
golang.org/x/crypto@v0.52.0) to pin the newer version, re-run the OSV/SSH
scanner, and confirm there are no imports of golang.org/x/crypto/ssh (search the
repo) and that referenced APIs like bcrypt.GenerateFromPassword /
bcrypt.CompareHashAndPassword, draw.CatmullRom / (*Kernel).Scale, cases.Lower,
and language.English still resolve correctly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 0a905ad2-925a-4bf3-b823-e5471c204f52
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (1)
go.mod
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/base-images.yml:
- Line 15: The workflow uses mutable action tags (actions/checkout@v6 and
docker/setup-buildx-action@v4); replace each tag with the action's immutable
commit SHA (e.g., actions/checkout@<full-sha> and
docker/setup-buildx-action@<full-sha>) by looking up the official repository
commit that corresponds to the major version used and updating the references in
.github/workflows/base-images.yml so the workflow pins to those exact SHAs.
In @.github/workflows/deploy.yml:
- Line 31: Replace floating action tags with immutable commit SHAs for
supply-chain hardening: locate the workflow "uses" entries such as
actions/checkout@v6 and docker/setup-buildx-action@v4 (and any other floating
uses like actions/cache@v4, actions/setup-go@v6, docker/login-action@v3,
appleboy/ssh-action@v1.2.2) and change them to the corresponding GitHub Actions
repository pinned to a specific commit SHA (e.g., actions/checkout@<full-sha>);
obtain the correct commit SHAs from each action's GitHub repo (releases or
default branch commit) and update the workflow file, then test the workflow to
ensure compatibility.
In @.github/workflows/gofmt.yml:
- Line 21: Replace the floating action refs in the workflow (the `uses` entries
`actions/checkout@v6`, `actions/setup-go@v6`, and
`stefanzweifel/git-auto-commit-action@v7.1.0`) with their corresponding full
commit SHAs to pin to immutable versions; update each `uses:` value to the
repository@<full-commit-sha> form and verify that if you change checkout auth
settings (e.g., `persist-credentials` on the `actions/checkout` step) you
preserve credentials so `stefanzweifel/git-auto-commit-action` still has
permission to push commits.
In @.github/workflows/tests.yml:
- Line 17: Replace floating action tags with pinned commit SHAs for
actions/setup-go@v6, actions/checkout@v6 and actions/cache@v4 in the workflow,
and add the checkout hardening option; specifically locate the workflow steps
that reference "actions/setup-go@v6", "actions/checkout@v6" and
"actions/cache@v4" and change each to the full commit SHA for the desired
release, and for the checkout step add the "with: persist-credentials: false"
configuration to disable credential persistence in PR runs.
- Line 21: The GitHub Actions checkout step uses actions/checkout@v6 without
disabling credential persistence; update the checkout step (actions/checkout@v6)
to include persist-credentials: false so the runner does not retain the
GITHUB_TOKEN in the workspace, i.e., add the persist-credentials: false key
under the checkout action configuration in .github/workflows/tests.yml.
In `@infra/makefile/build.mk`:
- Around line 8-9: The build.mk currently updates BASE_GO_IMAGE_DIGEST and
BASE_ALPINE_IMAGE_DIGEST without changing BASE_IMAGE_REVISION, which lets old
local images with the same BASE_IMAGE_VERSION be reused and skip a rebuild; fix
by ensuring BASE_IMAGE_REVISION changes whenever either BASE_GO_IMAGE_DIGEST or
BASE_ALPINE_IMAGE_DIGEST changes — e.g. update your workflow to bump
BASE_IMAGE_REVISION when you change those digest pins, or derive
BASE_IMAGE_REVISION/BASE_IMAGE_VERSION from the digest(s) (for example include a
short digest suffix in BASE_IMAGE_VERSION) and update any rules that use
BASE_IMAGE_VERSION so a changed digest forces a rebuild.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: bc569256-d867-4341-a608-02d8715d0056
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (18)
.github/workflows/base-images.yml.github/workflows/deploy.yml.github/workflows/gofmt.yml.github/workflows/tests.ymldatabase/connection_test.godatabase/seeder/importer/runner_test.godatabase/seeder/seeds/seeder_test.godocker-compose.ymlgo.modinfra/docker/base-images/Dockerfile.builderinfra/docker/base-images/Dockerfile.runtimeinfra/docker/dockerfile-apiinfra/makefile/app.mkinfra/makefile/build.mkinfra/metrics/README.mdinternal/testutil/dbtest/helpers.gometal/cli/clitest/helpers.gopkg/endpoint/scope_api_error.go
Collaborator
Author
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
database/connection_test.go (1)
37-40: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winConsider updating test Postgres version to match docker-compose.yml.
Test files pin to
postgres:18.1-alpinewhilstdocker-compose.ymlnow usespostgres:18.4-alpine. Both cite the same CVEs (CVE-2025-12817/12818), so updating tests to 18.4 would improve consistency and ensure test environments match production more closely.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@database/connection_test.go` around lines 37 - 40, Update the pinned Postgres image used in the test to match docker-compose by changing the image string passed to postgres.Run from "postgres:18.1-alpine" to "postgres:18.4-alpine" in database/connection_test.go (where pg, err := postgres.Run(ctx, "postgres:18.1-alpine", ...) is called) so tests and docker-compose use the same Postgres version while retaining the same CVE mitigation.
♻️ Duplicate comments (6)
internal/testutil/dbtest/helpers.go (2)
342-342:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winVerify port API change for testcontainers-go v0.42.0.
Same port conversion pattern as in
database/connection_test.go. Confirm this is the correct API for the library version in use.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/testutil/dbtest/helpers.go` at line 342, The Port field uses int(port.Num()) which may not match the testcontainers-go v0.42.0 API; update to the same conversion used in database/connection_test.go (use int(port.Int()) or port.Int() as appropriate for that version) and ensure the variable name port and the Port field assignment in the helper function match that pattern; also confirm imports/types compile after switching to port.Int().
305-306: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winConsider updating test Postgres version to match docker-compose.yml.
Same version mismatch as
database/connection_test.go: tests usepostgres:18.1-alpinewhilst docker-compose usespostgres:18.4-alpine. Update to 18.4 for consistency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@internal/testutil/dbtest/helpers.go` around lines 305 - 306, Update the pinned Postgres image tag from "postgres:18.1-alpine" to "postgres:18.4-alpine": search for the literal "postgres:18.1-alpine" (e.g., the comment/constant in internal/testutil/dbtest/helpers.go and the usage in database/connection_test.go) and replace it with "postgres:18.4-alpine" so tests and docker-compose use the same Postgres version.database/seeder/seeds/seeder_test.go (2)
26-27: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winConsider updating test Postgres version to match docker-compose.yml.
Same version mismatch as
database/connection_test.go: tests usepostgres:18.1-alpinewhilst docker-compose usespostgres:18.4-alpine. Update to 18.4 for consistency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@database/seeder/seeds/seeder_test.go` around lines 26 - 27, Update the hardcoded Postgres image tag used in tests from "postgres:18.1-alpine" to "postgres:18.4-alpine" to match docker-compose; search for the string "postgres:18.1-alpine" in test files (e.g. the seeder tests and connection tests) and replace it with "postgres:18.4-alpine" so the Test setup (image name) is consistent across seeder_test.go and connection_test.go.
58-58:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winVerify port API change for testcontainers-go v0.42.0.
Same port conversion pattern as in
database/connection_test.go. Confirm this is the correct API for the library version in use.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@database/seeder/seeds/seeder_test.go` at line 58, The Port field is using int(port.Num()), which may not match testcontainers-go v0.42.0; update the conversion to match the pattern used in database/connection_test.go (replace int(port.Num()) with the same API call used there, e.g., port.Int() or the library's current port-to-int accessor) so the test uses the correct testcontainers port API for this version; locate the initializer that sets Port: int(port.Num()) in seeder_test.go and change it to the consistent accessor used in connection_test.go.database/seeder/importer/runner_test.go (2)
741-741:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winVerify port API change for testcontainers-go v0.42.0.
Same port conversion pattern as in
database/connection_test.go. Confirm this is the correct API for the library version in use.testcontainers-go v0.42.0 nat.Port Int() method deprecated or removed🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@database/seeder/importer/runner_test.go` at line 741, The test is using int(port.Num()) which relies on a removed/deprecated API; update the port conversion in runner_test.go to follow the same pattern used in database/connection_test.go: use the newer Port API (e.g., call the port.Int() accessor if available) or fall back to parsing the string representation (strconv.Atoi on port.Port()/port.Num() as used in connection_test.go) and assign that integer to Port; update the conversion where Port: int(port.Num()) is used so it compiles with testcontainers-go v0.42.0.
712-713: 🧹 Nitpick | 🔵 Trivial | ⚡ Quick winConsider updating test Postgres version to match docker-compose.yml.
Same version mismatch as
database/connection_test.go: tests usepostgres:18.1-alpinewhilst docker-compose usespostgres:18.4-alpine. Update to 18.4 for consistency.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@database/seeder/importer/runner_test.go` around lines 712 - 713, The test hardcodes the Postgres image version as "postgres:18.1-alpine" (see the comment line "Pinning to postgres:18.1-alpine...") which mismatches docker-compose; update the test to use "postgres:18.4-alpine" instead. Locate the image reference or comment in database/seeder/importer/runner_test.go (and mirror the same change in database/connection_test.go if present) and replace "18.1-alpine" with "18.4-alpine" so tests and docker-compose are consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/endpoint/scope_api_error.go`:
- Around line 55-104: The change groups API error details into a Sentry
structured context using sentry.Context and s.scope.SetContext("api_error",
context); ensure the code uses the sentry-go v0.46.2 API (verify go.mod), keep
using s.scope.SetContext rather than deprecated SetExtra/SetExtras, and retain
tags set via s.scope.SetTag (e.g., "http.request_id", "api.error.cause_type");
finally, update any external dashboards/alerts that referenced old extra.* keys
to instead read from contexts.api_error.* so monitoring continues to work.
---
Outside diff comments:
In `@database/connection_test.go`:
- Around line 37-40: Update the pinned Postgres image used in the test to match
docker-compose by changing the image string passed to postgres.Run from
"postgres:18.1-alpine" to "postgres:18.4-alpine" in database/connection_test.go
(where pg, err := postgres.Run(ctx, "postgres:18.1-alpine", ...) is called) so
tests and docker-compose use the same Postgres version while retaining the same
CVE mitigation.
---
Duplicate comments:
In `@database/seeder/importer/runner_test.go`:
- Line 741: The test is using int(port.Num()) which relies on a
removed/deprecated API; update the port conversion in runner_test.go to follow
the same pattern used in database/connection_test.go: use the newer Port API
(e.g., call the port.Int() accessor if available) or fall back to parsing the
string representation (strconv.Atoi on port.Port()/port.Num() as used in
connection_test.go) and assign that integer to Port; update the conversion where
Port: int(port.Num()) is used so it compiles with testcontainers-go v0.42.0.
- Around line 712-713: The test hardcodes the Postgres image version as
"postgres:18.1-alpine" (see the comment line "Pinning to
postgres:18.1-alpine...") which mismatches docker-compose; update the test to
use "postgres:18.4-alpine" instead. Locate the image reference or comment in
database/seeder/importer/runner_test.go (and mirror the same change in
database/connection_test.go if present) and replace "18.1-alpine" with
"18.4-alpine" so tests and docker-compose are consistent.
In `@database/seeder/seeds/seeder_test.go`:
- Around line 26-27: Update the hardcoded Postgres image tag used in tests from
"postgres:18.1-alpine" to "postgres:18.4-alpine" to match docker-compose; search
for the string "postgres:18.1-alpine" in test files (e.g. the seeder tests and
connection tests) and replace it with "postgres:18.4-alpine" so the Test setup
(image name) is consistent across seeder_test.go and connection_test.go.
- Line 58: The Port field is using int(port.Num()), which may not match
testcontainers-go v0.42.0; update the conversion to match the pattern used in
database/connection_test.go (replace int(port.Num()) with the same API call used
there, e.g., port.Int() or the library's current port-to-int accessor) so the
test uses the correct testcontainers port API for this version; locate the
initializer that sets Port: int(port.Num()) in seeder_test.go and change it to
the consistent accessor used in connection_test.go.
In `@internal/testutil/dbtest/helpers.go`:
- Line 342: The Port field uses int(port.Num()) which may not match the
testcontainers-go v0.42.0 API; update to the same conversion used in
database/connection_test.go (use int(port.Int()) or port.Int() as appropriate
for that version) and ensure the variable name port and the Port field
assignment in the helper function match that pattern; also confirm imports/types
compile after switching to port.Int().
- Around line 305-306: Update the pinned Postgres image tag from
"postgres:18.1-alpine" to "postgres:18.4-alpine": search for the literal
"postgres:18.1-alpine" (e.g., the comment/constant in
internal/testutil/dbtest/helpers.go and the usage in
database/connection_test.go) and replace it with "postgres:18.4-alpine" so tests
and docker-compose use the same Postgres version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 5baf93b3-a352-4316-a3d3-c0ecabf5520c
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (18)
.github/workflows/base-images.yml.github/workflows/deploy.yml.github/workflows/gofmt.yml.github/workflows/tests.ymldatabase/connection_test.godatabase/seeder/importer/runner_test.godatabase/seeder/seeds/seeder_test.godocker-compose.ymlgo.modinfra/docker/base-images/Dockerfile.builderinfra/docker/base-images/Dockerfile.runtimeinfra/docker/dockerfile-apiinfra/makefile/app.mkinfra/makefile/build.mkinfra/metrics/README.mdinternal/testutil/dbtest/helpers.gometal/cli/clitest/helpers.gopkg/endpoint/scope_api_error.go
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@database/connection_test.go`:
- Around line 37-40: The test uses an unpinned image tag in the postgres.Run
call; update the image argument passed to postgres.Run in
database/connection_test.go (the postgres.Run(ctx, "...") invocation) to the
digest-pinned image used in docker-compose.yml (replace "postgres:18.4-alpine"
with
"postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88")
and adjust the surrounding comment to note the digest pin for CI determinism.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 32c97281-b51c-4b97-8631-e3daaa37ff84
📒 Files selected for processing (7)
database/connection_test.godatabase/seeder/importer/runner_test.godatabase/seeder/seeds/seeder_test.gointernal/testutil/dbtest/helpers.gometal/cli/clitest/helpers.gopkg/middleware/token_middleware_additional_test.gopkg/middleware/token_middleware_test.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit