Rewrite python legacy APIs in golang #4931
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| name: "CodeQL Config for EasyCLA Go Backend" | ||
|
|
||
| # Additional queries for Go security analysis | ||
| queries: | ||
| - uses: security-and-quality | ||
|
|
||
| # Custom rules for Go backend | ||
| disable-default-queries: false | ||
|
|
||
| # Paths to analyze | ||
| paths: | ||
| - cla-backend-legacy/ | ||
|
|
||
| # Paths to ignore | ||
| paths-ignore: | ||
| - cla-backend-legacy/resources/ | ||
| - cla-backend-legacy/bin/ | ||
| - cla-backend-legacy/vendor/ | ||
| - cla-backend-legacy/.github/ | ||
|
|
||
| # Query filters - exclude certain warnings for legacy compatibility | ||
| query-filters: | ||
| - exclude: | ||
| id: go/log-injection | ||
| reason: "Legacy logging maintains Python compatibility with proper sanitization" | ||
| - exclude: | ||
| id: go/uncontrolled-data-in-network-request | ||
| reason: "Proper URL validation with allowlisting for legacy API compatibility" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| name: "CodeQL Config" | ||
|
|
||
| disable-default-queries: false | ||
|
|
||
| queries: | ||
| - uses: security-and-quality | ||
|
|
||
| query-filters: | ||
| - exclude: | ||
| id: go/log-injection | ||
| - exclude: | ||
| id: go/request-forgery |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,61 +1,50 @@ | ||
| version: 2 | ||
| updates: | ||
| # Enable version updates for npm (existing) | ||
| - package-ecosystem: "npm" | ||
| directory: "/" | ||
| schedule: | ||
| interval: "monthly" | ||
| open-pull-requests-limit: 3 | ||
|
|
||
| # Enable version updates for npm in cla-frontend-project-console | ||
| - package-ecosystem: "npm" | ||
| directory: "/cla-frontend-project-console" | ||
| schedule: | ||
| interval: "monthly" | ||
| open-pull-requests-limit: 3 | ||
|
|
||
| # Enable version updates for npm in cla-frontend-corporate-console | ||
| - package-ecosystem: "npm" | ||
| directory: "/cla-frontend-corporate-console" | ||
| schedule: | ||
| interval: "monthly" | ||
| open-pull-requests-limit: 3 | ||
|
|
||
| # Enable version updates for npm in cla-frontend-contributor-console | ||
| - package-ecosystem: "npm" | ||
| directory: "/cla-frontend-contributor-console" | ||
| schedule: | ||
| interval: "monthly" | ||
| open-pull-requests-limit: 3 | ||
|
|
||
|
|
||
| # Enable version updates for Go dependencies in cla-backend-go | ||
| - package-ecosystem: "gomod" | ||
| directory: "/cla-backend-go" | ||
| schedule: | ||
| interval: "monthly" | ||
| open-pull-requests-limit: 3 | ||
|
|
||
| # NEW: Enable version updates for Go dependencies in cla-backend-legacy | ||
| - package-ecosystem: "gomod" | ||
| directory: "/cla-backend-legacy" | ||
| schedule: | ||
| interval: "monthly" | ||
| open-pull-requests-limit: 3 | ||
| reviewers: | ||
| - "lukaszgryglicki" | ||
| commit-message: | ||
| prefix: "deps" | ||
| include: "scope" | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| {{- range . }} | ||
| Package: {{ .Name }} | ||
| License: {{ .LicenseName }} | ||
| License URL: {{ .LicenseURL }} | ||
| --- | ||
| {{- end }} |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| --- | ||
| # Copyright The Linux Foundation and each contributor to CommunityBridge. | ||
| # SPDX-License-Identifier: MIT | ||
|
|
||
| name: "CodeQL Analysis - Go Backend" | ||
| on: | ||
| push: | ||
| branches: [main, dev] | ||
| paths: | ||
| - 'cla-backend-legacy/**' | ||
| pull_request: | ||
| branches: [main, dev] | ||
| paths: | ||
| - 'cla-backend-legacy/**' | ||
| schedule: | ||
| - cron: '0 6 * * 1' # Weekly on Mondays | ||
|
|
||
| permissions: | ||
| security-events: write | ||
| contents: read | ||
| actions: read | ||
|
|
||
| jobs: | ||
| analyze: | ||
| name: Analyze Go Backend | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| language: ['go'] | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Go | ||
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: '1.25' | ||
|
|
||
| # Initialize CodeQL with legacy-specific config | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@v3 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| config-file: ./.github/codeql/codeql-config.yml | ||
|
|
||
| # Build Go backend | ||
| - name: Build Go backend | ||
| working-directory: ./cla-backend-legacy | ||
| run: | | ||
| go mod download | ||
| go build ./... | ||
|
|
||
| - name: Perform CodeQL Analysis | ||
| uses: github/codeql-action/analyze@v3 | ||
| with: | ||
| category: "/language:${{matrix.language}}" | ||
|
Comment on lines
+42
to
+58
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result:
Sources: [1] [2] [3] Upgrade CodeQL Action v2 was retired on January 10, 2025, and is no longer supported. This workflow will fail with v2. Update both action invocations (Lines 43 and 57) to Suggested update- uses: github/codeql-action/init@v2
+ uses: github/codeql-action/init@v4
...
- uses: github/codeql-action/analyze@v2
+ uses: github/codeql-action/analyze@v4🧰 Tools🪛 actionlint (1.7.11)[error] 43-43: the runner of "github/codeql-action/init@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) [error] 57-57: the runner of "github/codeql-action/analyze@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||
| fail-on-error: false # Don't fail CI on legacy security warnings | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
Repository: linuxfoundation/easycla
Length of output: 49
🏁 Script executed:
Repository: linuxfoundation/easycla
Length of output: 97
🏁 Script executed:
Repository: linuxfoundation/easycla
Length of output: 779
🌐 Web query:
go mod tidy rewrite go.mod go.sum behavior💡 Result:
go mod tidyis expected to rewrite bothgo.modandgo.sumbecause its job is to make the module metadata match what your module actually needs to build and test.What it does to
go.modrequires for any module that provides a package needed by your module (including test imports), using the latest version that satisfies the query when a requirement is missing. (go.dev)requires that don’t provide any relevant packages. (go.dev)// indirectmarkers and (with newergoversions) may reorganize/split direct vs indirect requirements (this can create diffs even if you didn’t “change deps” manually). (go.dev)-go=version, it will update thegodirective and adjust requirements accordingly (pruning/lazy-loading behavior changes across Go versions). (go.dev)What it does to
go.sumgo.modfiles.Why it can change when your code didn’t
tidyloads a broad set: all packages in your module + tests (including tests in other modules), and it behaves as if all build tags are enabled (exceptignore). (go.dev)goline, because module graph loading and checksum retention rules vary by version. (go.dev)Useful flags
go mod tidy -diff: show what it would change without rewriting files. (go.dev)-compat=version: control the compatibility check baseline. (go.dev)If you paste the diffs (or your
goversion + thego.modheader), I can explain exactly why each line changed.Citations:
🌐 Web query:
go test mod=readonly GOFLAGS prevent rewrite💡 Result:
To make
go testfail instead of rewritinggo.mod(and to apply it everywhere), set-mod=readonlyviaGOFLAGS:In Go 1.16+, build/test commands already behave as if
-mod=readonlyis set by default, meaning they should error with “updates to go.mod needed” rather than silently changing it. [1][2]If you still see rewrites, it’s usually because something is explicitly enabling module updates (for example
-mod=mod,go get,go mod tidy, or a wrapper tool/CI step that runs those). The typical CI guardrails are:go mod tidy -diffis specifically designed to not modifygo.mod/go.sumbut show what would change. [1][2]Sources: Go modules reference and
cmd/godocs. [1][2][1] (go.dev)
[2] (pkg.go.dev)
Citations:
🌐 Web query:
go mod download go mod verify difference💡 Result:
go mod downloadvsgo mod verifygo mod download: downloads the specified modules (or, with no args, the main module’s dependencies) into the module cache. It’s mainly useful to pre-fill the cache (e.g., in CI or Docker layers) becausego build/testwill download modules automatically when needed. [1]go mod verify: does not download missing modules. It checks integrity of what’s already in the module cache by verifying that the module.zipfiles and extracted directories still match the hashes recorded in the cache when they were first downloaded. It’s for detecting tampering/corruption in the cache. [1]go.sumto verify module content; it verifies against hashes stored in the module cache. However, it may downloadgo.modfiles for minimal version selection and will use/updatego.sumfor thosego.modhashes. [1]Typical CI usage
go mod download(populate cache) →go mod verify(sanity-check cache) →go test ./...[1]Sources: Go Modules Reference (
go mod download,go mod verify). [1]🏁 Script executed:
cat -n cla-backend-legacy/go.mod | head -5Repository: linuxfoundation/easycla
Length of output: 184
🏁 Script executed:
Repository: linuxfoundation/easycla
Length of output: 395
Make the legacy Go steps fail on dependency drift instead of repairing it.
Line 117 runs
go mod tidy, which rewrites bothgo.modandgo.sum. This means the workflow can pass with uncommitted dependency changes instead of surfacing the problem.🛡️ Proposed fix
- name: Go Setup CLA Legacy Backend working-directory: cla-backend-legacy run: | - go mod tidy + go mod download + go mod verify - name: Go Build CLA Legacy Backend working-directory: cla-backend-legacy + env: + GOFLAGS: -mod=readonly run: | make lambdas - name: Go Test CLA Legacy Backend working-directory: cla-backend-legacy - run: go test ./... + env: + GOFLAGS: -mod=readonly + run: go test ./...🤖 Prompt for AI Agents