containerd/.github/workflows/nightly.yml
Sebastiaan van Stijn b947a6f528
update go to go1.20.4, go1.19.9
go1.20.4 (released 2023-05-02) includes three security fixes to the html/template
package, as well as bug fixes to the compiler, the runtime, and the crypto/subtle,
crypto/tls, net/http, and syscall packages. See the Go 1.20.4 milestone on our
issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.4+label%3ACherryPickApproved

release notes: https://go.dev/doc/devel/release#go1.20.4
full diff: https://github.com/golang/go/compare/go1.20.3...go1.20.4

from the announcement:

> These minor releases include 3 security fixes following the security policy:
>
> - html/template: improper sanitization of CSS values
>
>   Angle brackets (`<>`) were not considered dangerous characters when inserted
>   into CSS contexts. Templates containing multiple actions separated by a '/'
>   character could result in unexpectedly closing the CSS context and allowing
>   for injection of unexpected HMTL, if executed with untrusted input.
>
>   Thanks to Juho Nurminen of Mattermost for reporting this issue.
>
>   This is CVE-2023-24539 and Go issue https://go.dev/issue/59720.
>
> - html/template: improper handling of JavaScript whitespace
>
>   Not all valid JavaScript whitespace characters were considered to be
>   whitespace. Templates containing whitespace characters outside of the character
>   set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain
>   actions may not be properly sanitized during execution.
>
>   Thanks to Juho Nurminen of Mattermost for reporting this issue.
>
>   This is CVE-2023-24540 and Go issue https://go.dev/issue/59721.
>
> - html/template: improper handling of empty HTML attributes
>
>   Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}")
>   executed with empty input could result in output that would have unexpected
>   results when parsed due to HTML normalization rules. This may allow injection
>   of arbitrary attributes into tags.
>
>   Thanks to Juho Nurminen of Mattermost for reporting this issue.
>
>   This is CVE-2023-29400 and Go issue https://go.dev/issue/59722.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-05-03 20:38:00 +02:00

185 lines
4.6 KiB
YAML

name: Nightly
on:
schedule:
- cron: "0 0 * * *" # Every day at midnight
pull_request:
paths:
- ".github/workflows/nightly.yml"
env:
GO_VERSION: "1.20.4"
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
linux:
name: Linux
runs-on: ubuntu-latest
timeout-minutes: 30
defaults:
run:
working-directory: src/github.com/containerd/containerd
steps:
- uses: actions/setup-go@v3
with:
go-version: ${{ env.GO_VERSION }}
- uses: actions/checkout@v3
with:
path: src/github.com/containerd/containerd
- name: Set env
shell: bash
run: |
echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
#
# Build
#
- name: Install dependencies
run: |
sudo add-apt-repository -y "deb [arch=arm64,s390x,ppc64el,riscv64] http://ports.ubuntu.com/ubuntu-ports/ $(lsb_release -sc) main" || true
sudo add-apt-repository -y "deb [arch=arm64,s390x,ppc64el,riscv64] http://ports.ubuntu.com/ubuntu-ports/ $(lsb_release -sc)-updates main" || true
sudo dpkg --add-architecture arm64
sudo dpkg --add-architecture s390x
sudo dpkg --add-architecture ppc64el
sudo dpkg --add-architecture riscv64
sudo apt-get update || true
sudo apt-get install -y \
crossbuild-essential-arm64 \
crossbuild-essential-s390x \
crossbuild-essential-ppc64el \
crossbuild-essential-riscv64 \
libseccomp-dev:amd64 \
libseccomp-dev:arm64 \
libseccomp-dev:s390x \
libseccomp-dev:ppc64el \
libseccomp-dev:riscv64
- name: Build amd64
env:
GOOS: linux
GOARCH: amd64
run: |
make binaries
mv bin bin_amd64
- name: Build arm64
env:
GOOS: linux
GOARCH: arm64
CC: aarch64-linux-gnu-gcc
CGO_ENABLED: 1
run: |
make binaries
mv bin bin_arm64
- name: Build s390x
env:
GOOS: linux
GOARCH: s390x
CGO_ENABLED: 1
CC: s390x-linux-gnu-gcc
run: |
make binaries
mv bin bin_s390x
- name: Build ppc64le
env:
GOOS: linux
GOARCH: ppc64le
CGO_ENABLED: 1
CC: powerpc64le-linux-gnu-gcc
run: |
make binaries
mv bin bin_ppc64le
- name: Build riscv64
env:
GOOS: linux
GOARCH: riscv64
CGO_ENABLED: 1
CC: riscv64-linux-gnu-gcc
run: |
make binaries
mv bin bin_riscv64
#
# Upload
#
- name: Upload artifacts (linux_amd64)
uses: actions/upload-artifact@v1
with:
name: linux_amd64
path: src/github.com/containerd/containerd/bin_amd64
- name: Upload artifacts (linux_arm64)
uses: actions/upload-artifact@v1
with:
name: linux_arm64
path: src/github.com/containerd/containerd/bin_arm64
- name: Upload artifacts (linux_s390x)
uses: actions/upload-artifact@v1
with:
name: linux_s390x
path: src/github.com/containerd/containerd/bin_s390x
- name: Upload artifacts (linux_ppc64le)
uses: actions/upload-artifact@v1
with:
name: linux_ppc64le
path: src/github.com/containerd/containerd/bin_ppc64le
- name: Upload artifacts (linux_riscv64)
uses: actions/upload-artifact@v1
with:
name: linux_riscv64
path: src/github.com/containerd/containerd/bin_riscv64
windows:
name: Windows
runs-on: windows-latest
timeout-minutes: 30
defaults:
run:
working-directory: src/github.com/containerd/containerd
steps:
- uses: actions/setup-go@v3
with:
go-version: ${{ env.GO_VERSION }}
- uses: actions/checkout@v3
with:
path: src/github.com/containerd/containerd
- name: Set env
shell: bash
run: |
echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
- name: Build amd64
env:
GOOS: windows
GOARCH: amd64
run: |
make binaries
- name: Upload artifacts (windows_amd64)
uses: actions/upload-artifact@v1
with:
name: windows_amd64
path: src/github.com/containerd/containerd/bin/