Dogfood Nancy about ahab HOT 6 CLOSED

Doh! I will add a CI readme file immediately, that should shed some light on the build process. (Most other projects have one already)

from ahab.

I've been wanting to learn about Nancy so I can blog about it, and this might be a good chance. I don't know anything about your build process (github actions?), but would be happy to dig in and try to figure this out if there's not already WIP.

from ahab.

see: https://github.com/sonatype-nexus-community/ahab/blob/master/.circleci/circleci-readme.md

Probably easier to run some of the CI commands individually, at least at the start.

One thing I like about CircleCI is the ability to locally "mimic" the whole build. It stubs out some things that can't be done locally, but a local build is helpful to find issues with shorter round-trips than doing full pushes every time.

from ahab.

That local build option is neato, reminds me of Concourse...very nice.

When adding nancy, we get two critical CVEs that fail the build. Should we go down the 🐰 🕳️ of getting those fixed up as part of this PR?

[1/2]   pkg:golang/github.com/coreos/[email protected]
3 known vulnerabilities affecting installed version 
[2/2]   pkg:golang/golang.org/x/[email protected]
5 known vulnerabilities affecting installed version 

Several are 7.5s. I can go get -u or whatever but that last one would seem to need newer go or pinning net somehow (not sure if replace can do that in go.mod).

from ahab.

@deadlysyn We solved an etcd issue with a replace directive in Nancy: https://github.com/sonatype-nexus-community/nancy/blob/main/go.mod#L40

The x/net should be cleared up by tomorrow. It's a data issue on our side. See Nancy Issue #189

from ahab.

Thanks for the guidance @bhamail

I'll get a PR going for this, seems fine now:

❯ circleci local execute -c .circleci/local-config.yml --job 'build'
...
====>> go get -u github.com/sonatype-nexus-community/nancy
  #!/bin/bash -eo pipefail
go get -u github.com/sonatype-nexus-community/nancy
...
====>> go list -json -m all | nancy sleuth
  #!/bin/bash -eo pipefail
go list -json -m all | nancy sleuth
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Summary                       ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━┫
┃ Audited Dependencies    ┃ 113 ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━╋━━━━━┫
┃ Vulnerable Dependencies ┃ 0   ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━━━┛
Success!

from ahab.