mirror of
https://github.com/anchore/grype.git
synced 2026-10-28 08:24:36 +08:00
68afe99d5f
* feat: add containers-storage support for Podman and Buildah Enable containers-storage in Linux release builds, document usage, and add provider routing and end-to-end Podman/Buildah validation. Signed-off-by: Bruce Clark <bruce.clark@mandg.com> * chore: align containers-storage support with syft - containers-storage is meant to be used only when requested by name (`--from containers-storage`, the `containers-storage:` scheme, or `default-image-pull-source: containers-storage`). That gating lives in syft (anchore/syft#5368), so plain image references keep probing the local store until grype bumps syft. - set `containers_image_openpgp,exclude_graphdriver_btrfs` everywhere the linux build tag applies (goreleaser, unit, integration, race smoke, golangci-lint), so Go tooling compiles the provider that ships. The btrfs exclude avoids needing libbtrfs headers on cgo builds. - run the e2e through `make containers-storage-test BUILDER=podman|buildah`. It now covers `vfs` and `overlay` stores, runs rootless scans under `<builder> unshare`, asserts the image came out of the store, and checks that plain refs never touch it. - README documents explicit usage and `podman unshare` for rootless stores. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore(deps): bump syft to main for explicit-only containers-storage picks up anchore/syft#5368, which only uses the containers-storage provider when requested by name. This pins syft (and transitively stereoscope and go-rpmdb) to unreleased pseudo-versions; swap to the next syft release before merging. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * chore: tidy containers-storage CI and flag help - fold the Podman and Buildah jobs into one matrix job pinned to `ubuntu-24.04`. Check names are unchanged, and the job carries the release.yaml rename note. - list `containers-storage` in the `--from` flag help. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * test: drop provider config sources test covered by the containers-storage e2e Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ci: reference the bootstrap action with self-repository syntax zizmor's new `self-repository` audit flags `uses: ./...`. `uses: $/...` resolves from the workflow's own commit instead of the checked-out workspace, so a previous step can't swap the action on disk. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> * ci: revert self-repository syntax, disable the zizmor rule instead `uses: $/...` makes the runner download the repo as an action archive. Staging that archive fails because the archive omits submodules, so `test/quality/.yardstick/labels` (a symlink into the `vulnerability-match-labels` submodule) dangles. This goes back to `./...` and disables zizmor's `self-repository` audit with that reason. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Bruce Clark <bruce.clark@mandg.com> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Bruce Clark <bruce.clark@mandg.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
109 lines
3.6 KiB
YAML
109 lines
3.6 KiB
YAML
version: "2"
|
|
run:
|
|
# keep in sync with buildTags in .make/main.go
|
|
build-tags:
|
|
- containers_image_openpgp
|
|
- exclude_graphdriver_btrfs
|
|
linters:
|
|
# inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
|
|
default: none
|
|
enable:
|
|
- asciicheck
|
|
- bodyclose
|
|
- copyloopvar
|
|
- dogsled
|
|
- dupl
|
|
- errcheck
|
|
- funlen
|
|
- gocognit
|
|
- goconst
|
|
- gocritic
|
|
- gocyclo
|
|
- goprintffuncname
|
|
- gosec
|
|
- govet
|
|
- ineffassign
|
|
- misspell
|
|
- nakedret
|
|
- revive
|
|
- staticcheck
|
|
- unconvert
|
|
- unparam
|
|
- unused
|
|
- whitespace
|
|
settings:
|
|
funlen:
|
|
lines: 70
|
|
statements: 50
|
|
exclusions:
|
|
generated: lax
|
|
presets:
|
|
- comments
|
|
- common-false-positives
|
|
- legacy
|
|
- std-error-handling
|
|
rules:
|
|
# we have multiple packages in grype that might overlap with the stblib; their names reflect their purpose
|
|
- linters:
|
|
- revive
|
|
text: "var-naming: avoid package names that conflict"
|
|
|
|
paths:
|
|
- third_party$
|
|
- builtin$
|
|
- examples$
|
|
|
|
# do not enable...
|
|
# - deadcode # The owner seems to have abandoned the linter. Replaced by "unused".
|
|
# - depguard # we need to setup a configuration for this
|
|
# - goprintffuncname # does not catch all cases and there are exceptions
|
|
# - nakedret # does not catch all cases and should not fail a build
|
|
# - gochecknoglobals
|
|
# - gochecknoinits # this is too aggressive
|
|
# - rowserrcheck disabled per generics https://github.com/golangci/golangci-lint/issues/2649
|
|
# - godot
|
|
# - godox
|
|
# - goerr113
|
|
# - goimports # we're using gosimports now instead to account for extra whitespaces (see https://github.com/golang/go/issues/20818)
|
|
# - golint # deprecated
|
|
# - gomnd # this is too aggressive
|
|
# - interfacer # this is a good idea, but is no longer supported and is prone to false positives
|
|
# - lll # without a way to specify per-line exception cases, this is not usable
|
|
# - maligned # this is an excellent linter, but tricky to optimize and we are not sensitive to memory layout optimizations
|
|
# - nestif
|
|
# - nolintlint # as of go1.19 this conflicts with the behavior of gofmt, which is a deal-breaker (lint-fix will still fail when running lint)
|
|
# - prealloc # following this rule isn't consistently a good idea, as it sometimes forces unnecessary allocations that result in less idiomatic code
|
|
# - rowserrcheck # not in a repo with sql, so this is not useful
|
|
# - scopelint # deprecated
|
|
# - structcheck # The owner seems to have abandoned the linter. Replaced by "unused".
|
|
# - testpackage
|
|
# - varcheck # The owner seems to have abandoned the linter. Replaced by "unused".
|
|
# - wsl # this doens't have an auto-fixer yet and is pretty noisy (https://github.com/bombsimon/wsl/issues/90)
|
|
|
|
issues:
|
|
max-same-issues: 25
|
|
uniq-by-line: false
|
|
|
|
# TODO: enable this when we have coverage on docstring comments
|
|
# # The list of ids of default excludes to include or disable.
|
|
# include:
|
|
# - EXC0002 # disable excluding of issues about comments from golint
|
|
|
|
formatters:
|
|
enable:
|
|
- gci
|
|
- gofmt
|
|
settings:
|
|
gci:
|
|
# See https://golangci-lint.run/docs/formatters/configuration/#gci
|
|
sections:
|
|
- standard # Standard section: captures all standard packages.
|
|
- default # Default section: contains all imports that could not be matched to another section type.
|
|
- prefix(github.com/anchore)
|
|
exclusions:
|
|
generated: lax
|
|
paths:
|
|
- third_party$
|
|
- builtin$
|
|
- examples$
|