Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump OPA version from v0.70.0 to v1.0.1 #1526

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

github-actions[bot]
Copy link
Contributor

@github-actions github-actions bot commented Jan 22, 2025

🗣 Description

  • This pull request was created by a GitHub Action to bump ScubaGear's Open Policy Agent (OPA) executable version dependency.
  • Please fill out the rest of the template that the Action did not cover.

💭 Motivation and context

  • Bump to the latest OPA version v1.0.1

🧪 Testing

  • Currently a human should still check if bumping the OPA version affects ScubaGear.

✅ Pre-approval checklist

  • This PR has an informative and human-readable title.
  • PR targets the correct parent branch (e.g., main or release-name) for merge.
  • Changes are limited to a single goal - eschew scope creep!
  • Changes are sized such that they do not touch excessive number of files.
  • All future TODOs are captured in issues, which are referenced in code comments.
  • These code changes follow the ScubaGear content style guide.
  • Related issues these changes resolve are linked preferably via closing keywords.
  • All relevant type-of-change labels added.
  • All relevant project fields are set.
  • All relevant repo and/or project documentation updated to reflect these changes.
  • Unit tests added/updated to cover PowerShell and Rego changes.
  • Functional tests added/updated to cover PowerShell and Rego changes.
  • All relevant functional tests passed.
  • All automated checks (e.g., linting, static analysis, unit/smoke tests) passed.

✅ Pre-merge checklist

  • PR passed smoke test check.

  • Feature branch has been rebased against changes from parent branch, as needed

    Use Rebase branch button below or use this reference to rebase from the command line.

  • Resolved all merge conflicts on branch

  • Notified merge coordinator that PR is ready for merge via comment mention

  • Demonstrate changes to the team for questions and comments.
    (Note: Only required for issues of size Medium or larger)

✅ Post-merge checklist

  • Feature branch deleted after merge to clean up repository.
  • Verified that all checks pass on parent branch (e.g., main or release-name) after merge.

@github-actions github-actions bot added the version bump This issue or pull request increments the version number label Jan 22, 2025
@schrolla schrolla self-assigned this Jan 23, 2025
@schrolla schrolla added this to the Lionfish milestone Jan 23, 2025
@schrolla schrolla force-pushed the opa-version-bump-1.0.1 branch from e93748c to ec8beef Compare January 23, 2025 21:29
@@ -258,7 +258,7 @@ function Install-OPAforSCuBA {
)

# Constants
$ACCEPTABLEVERSIONS = '0.69.0', [ScubaConfig]::ScubaDefault('DefaultOPAVersion') # End Versions
$ACCEPTABLEVERSIONS = '0.69.0', '0.70.0', [ScubaConfig]::ScubaDefault('DefaultOPAVersion') # End Versions
Copy link
Collaborator

@mitchelbaker-cisa mitchelbaker-cisa Jan 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Add v1.0.0 as accepted version? Smoke tests pass https://github.com/cisagov/ScubaGear/actions/runs/12958646112

Suggested change
$ACCEPTABLEVERSIONS = '0.69.0', '0.70.0', [ScubaConfig]::ScubaDefault('DefaultOPAVersion') # End Versions
$ACCEPTABLEVERSIONS = '0.69.0', '0.70.0', '1.0.0', [ScubaConfig]::ScubaDefault('DefaultOPAVersion') # End Versions

Copy link
Collaborator

@buidav buidav Jan 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OPA v1.0.1 was created to address CVEs in the Go runtime. OPA typically removes the manual download links for the vulnerable version in the website as well. Example in the picture below. Would recommend we keep the versioning consistent to how OPA has the versions displayed on their website, leaving off vulnerable versions.
opa

Copy link
Collaborator

@mitchelbaker-cisa mitchelbaker-cisa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ran with no errors for G5 interactively/noninteractively.
Ran with no errors for G3 interactively/noninteractively.
Ran with no errors for GCC high interactively/noninteractively.

Copy link
Collaborator

@buidav buidav left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same behavior as v1.0.0 no functional issues with ScubaGear when running with v1.0.1.

Had issues personally with my terminal on one client hanging when trying to do the hash verification. No issues on another client. I chalk that up to isolated client issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
version bump This issue or pull request increments the version number
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants