The get-helm-3 script queries get.helm.sh/helm3-latest-version to
determine the latest release. The CDN serving this file has no
Cache-Control header, so edge servers can serve stale cached
responses for hours after a new release.
This causes non-deterministic behavior: machines running get-helm-3
at the same time can install different versions depending on which
CDN edge node they hit.
Fix: Append a timestamp query string (?ts=1783837438) to bust CDN
caches, and add Cache-Control: no-cache header to both curl and wget
requests.
Fixes#32329
Signed-off-by: Solomon Wakhungu <65043605+1solomonwakhungu@users.noreply.github.com>
golang/govulncheck-action published v1.1.0 on 2026-07-10, tagging the
master commit (032d455) the govulncheck step was already pinned to.
Update the pin comment to # pin@v1.1.0 so it matches the repo's
pin@<tag> convention and Dependabot can track the action by semver
again.
The pinned SHA is unchanged; v1.1.0 points to that commit, so CI
behavior is identical and only the trailing comment changes.
Closes: #32301
Signed-off-by: thc1006 <84045975+thc1006@users.noreply.github.com>
The init and autobuild steps were bumped to 4.37.0 (#32313, #32305) but the analyze step remained at 4.36.2, causing CodeQL to fail on main with: "Loaded a configuration file for version '4.37.0', but running version '4.36.2'". Align analyze with the other codeql-action steps.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
x/crypto v0.54.0 raises golang.org/x/term to v0.45.0 and golang.org/x/sys to v0.47.0 via minimum version selection.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
The init and autobuild steps were bumped to 4.37.0 (#32313, #32305) but the analyze step remained at 4.36.2, causing CodeQL to fail on main with: "Loaded a configuration file for version '4.37.0', but running version '4.36.2'". Align analyze with the other codeql-action steps.
Signed-off-by: Terry Howe <terrylhowe@gmail.com>
The pinned v1.0.4 used actions/checkout@v4 and
actions/setup-go@v5 internally, both built on Node 20.
Latest main uses v6 of both, which run on Node 24.
Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Signed-off-by: kimsungmin1 <142377392+kimsungmin1@users.noreply.github.com>
- Use (*net.ListenConfig).Listen with the test context instead of
net.Listen (noctx).
- Use suite.NoError instead of suite.Nil for the error check
(testifylint).
- Drop the unnecessary leading blank lines in the scope test funcs
(whitespace).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
The scope test configured a TLS registry while advertising an http token
realm. oras refuses to send credentials to an http token realm when the
registry itself was contacted over https, so the auth server was never
reached and the test timed out ("timeout waiting for auth request").
Use a plain-http registry so the registry and token-realm schemes match;
the scope carried in the token request is what this test verifies, and
that is independent of TLS.
Also make the auth handler's channel send non-blocking so that a client
retry can never block the handler and stall the push/pull flow, which
addresses the review comment about a potential deadlock.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Fix data race by using channel instead of shared variable for requestURL
- Make assertions more robust by parsing URL and checking query parameters instead of exact string matching
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change 'bellow' to 'below' (spelling correction in multiple places)
- Change 'WithScopeHint' to 'withScopeHint' to match actual function name
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
- Change DockerRegistryHost to use 127.0.0.1 for HTTP tests and helm-test-registry for TLS tests to match certificate hostname
- Add defer ln.Close() to prevent resource leak in token auth server setup
- Restore requestURL variable and assertion in test body instead of handler to avoid potential race condition
Signed-off-by: kimsm28 <sm28.kim@samsung.com>
Solomon Wakhungu
秀吉
dependabot[bot]
Akanksha Trehun
Matt Farina
Terry Howe
Benoit Tigeot
Benoit Tigeot
Matthieu MOREL
George Jenkins
kimsungmin1
kimsm28