Merge pull request #34 from inloco/sync/upstream_+_upgrade/security

ops: sync with upstream to solve security issues raised by dependabot

.github/dependabot.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 # To get started with Dependabot version updates, you'll need to specify which
 # package ecosystems to update and where the package manifests are located.
 # Please see the documentation for all configuration options:

.github/release.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 changelog:
   categories:
     - title: Breaking Changes 🛠

.github/workflows/actionlint.yml

@@ -0,0 +1,13 @@
+name: Lint GitHub Actions Workflows
+on:
+  push:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - name: "Check workflow files"
+        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint:latest

.github/workflows/go-test.yml

@@ -0,0 +1,151 @@
+name: go-test
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+env:
+  TEST_RESULTS_PATH: /tmp/test-results
+permissions:
+  contents: read
+jobs:
+  linux-tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go-version:
+          - '1.20'
+          - '1.21.x'
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Setup go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - name: Checkout code
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+
+      - name: Check that go.mod does not contain a replace
+        run: |
+          if grep -Eq "^\s*replace" <go.mod; then
+            echo "go.mod contains a replace but should not." >&2
+            false
+          fi
+
+      - name: Create test directory
+        run: |
+          mkdir -p ${{ env.TEST_RESULTS_PATH }}/packer-plugin-sdk
+
+      - name: Run gofmt
+        run: |
+            make fmt-check
+
+      - name: Run Go Generate Check
+        run: |
+            make generate-check
+
+      - name: Install gotestsum
+        run: go install gotest.tools/gotestsum@v1.8.2
+
+      # Required for passing tests as we need to have a replace in the go.mod
+      # otherwise we'll get compile-time errors when running them
+      - name: Fix gocty
+        run: |
+          make install-gen-deps
+          packer-sdc fix .
+          go mod tidy
+
+      - name: Run Go tests
+        run: |
+          PACKAGE_NAMES="$(go list ./...)"
+          echo "Running $(echo "$PACKAGE_NAMES" | wc -w) packages"
+          echo "$PACKAGE_NAMES"
+          echo "$PACKAGE_NAMES" | xargs -I {} gotestsum --format=short-verbose --junitfile "$TEST_RESULTS_PATH"/packer-plugin-sdk/gotestsum-report.xml -- -count 1 -p 2 {};
+
+  windows-tests:
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        go-version:
+          - '1.20'
+          - '1.21.x'
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Run git config #Windows-only
+        run: git config --global core.autocrlf false
+
+      - name: Setup Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - name: Checkout code
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+
+      - name: Install gotestsum
+        shell: bash
+        run: go install gotest.tools/gotestsum@v1.8.2
+
+      # Required for passing tests as we need to have a replace in the go.mod
+      # otherwise we'll get compile-time errors when running them
+      - name: Fix gocty
+        run: |
+          make install-gen-deps
+          packer-sdc fix .
+          go mod tidy
+
+      - name: Run Go tests
+        shell: bash
+        run: |
+          PACKAGE_NAMES="$(go list ./...)"
+          echo "Running $(echo "$PACKAGE_NAMES" | wc -w) packages"
+          echo "$PACKAGE_NAMES"
+          echo "$PACKAGE_NAMES" | xargs -I {} gotestsum --format=short-verbose --junitfile "$TEST_RESULTS_PATH"/packer-plugin-sdk/gotestsum-report.xml -- -count 1 -p 2 {};
+
+  darwin-tests:
+    runs-on: macos-latest
+    strategy:
+      matrix:
+        go-version:
+          - '1.20'
+          - '1.21.x'
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Setup go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version: ${{ matrix.go-version }}
+
+      - name: Checkout code
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+
+      - name: Create test directory
+        run: |
+          mkdir -p ${{ env.TEST_RESULTS_PATH }}/packer-plugin-sdk
+
+      - name: Install gotestsum
+        run: go install gotest.tools/gotestsum@v1.8.2
+
+      # Required for passing tests as we need to have a replace in the go.mod
+      # otherwise we'll get compile-time errors when running them
+      - name: Fix gocty
+        run: |
+          make install-gen-deps
+          packer-sdc fix .
+          go mod tidy
+
+      - name: Run Go tests
+        run: |
+          PACKAGE_NAMES="$(go list ./...)"
+          echo "Running $(echo "$PACKAGE_NAMES" | wc -w) packages"
+          echo "$PACKAGE_NAMES"
+          echo "$PACKAGE_NAMES" | xargs -I {} gotestsum --format=short-verbose --junitfile "$TEST_RESULTS_PATH"/packer-plugin-sdk/gotestsum-report.xml -- -count 1 -p 2 {};

.github/workflows/release.yml

@@ -14,9 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: GoReleaser
-        uses: goreleaser/goreleaser-action@v3.0.0
-        args: "release"
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
+        with: 
+          args: "release"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.goreleaser.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
 project_name: packer-plugin-sdk
 build:
   skip: true

CHANGELOG.md

@@ -1,4 +1,5 @@
- See [Releases](https://github.com/hashicorp/packer-plugin-sdk/releases) for latest CHANGELOG information.
+ # Latest Release
+ Please refer to [releases](https://github.com/hashicorp/packer-plugin-sdk/releases) for latest CHANGELOG information.
 
 ## 0.3.1 (July 28, 2022)
 

LICENSE

@@ -1,3 +1,5 @@
+Copyright (c) 2020 HashiCorp, Inc.
+
 Mozilla Public License Version 2.0
 ==================================
 

README.md

@@ -24,6 +24,11 @@ See the [Extending Packer](https://www.packer.io/docs/plugins/creation#extending
 
 See the [Extending Packer](https://www.packer.io/docs/plugins/creation#extending-packer) section on the Packer website.
 
+## Testing
+
+The SDK embeds tests to ensure we don't introduce a regression in the future. Up to version 0.5.0 of the SDK, tests would be runnable with `make test` on their own but since we removed the `replace` statement for `go-cty` tests won't work out-of-the-box. Users will need to  invoke `packer-sdc fix .` in order to fix the `go.mod` and `go.sum` files before running tests.
+Please do not commit these changes, as adding this `replace` section to the `go.mod` file will make it impossible for dependents to run `go install` for `packer-sdc` afterwards.
+
 ## Packer Scope (Plugins VS Core)
 
 ### Packer Core