Skip to content
Closed
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions .github/dependabot.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
version: 2
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "04:00"
timezone: "UTC"
open-pull-requests-limit: 5
labels: ["dependencies", "gomod"]
commit-message:
prefix: "chore(deps)"
groups:
minor-and-patch:
update-types: ["minor", "patch"]

- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
day: "monday"
time: "04:00"
timezone: "UTC"
open-pull-requests-limit: 5
labels: ["dependencies", "github-actions"]
commit-message:
prefix: "chore(actions)"
40 changes: 40 additions & 0 deletions .github/workflows/go.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
name: CI
on:
push:
branches: ["main", "devel"]
paths:
- '**.go'
- '**.yml'
- '**.yaml'
pull_request:
branches: ["main", "devel"]

permissions:
contents: read

jobs:
test:
strategy:
fail-fast: true
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
Comment thread
coderabbitai[bot] marked this conversation as resolved.
- uses: actions/setup-go@v6

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/go.yml

Repository: gaissmai/ipam

Length of output: 1083


Pin all action references to immutable commit SHAs.

Lines 21, 22, 31, 32, and 38 use mutable version tags (@v5, @v6, @v9), which weakens CI supply-chain integrity. Pin each uses: to a full commit SHA instead.

🧰 Tools
🪛 zizmor (1.25.2)

[warning] 21-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)


[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/go.yml around lines 21 - 22, Replace all mutable version
tags in the workflow file with immutable commit SHAs. Specifically, for
actions/checkout change `@v5` to its corresponding commit SHA, for
actions/setup-go change `@v6` to its corresponding commit SHA, and for any other
actions using `@v9` or similar mutable tags, replace them with their full commit
SHA references. This ensures supply-chain integrity by preventing unexpected
updates from upstream actions.

Source: Linters/SAST tools

with:
go-version: stable
cache: true
- run: go test -v ./...

linting:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/setup-go@v6
with:
go-version: stable
cache: true

- name: golangci-lint
uses: golangci/golangci-lint-action@v9
with:
version: v2.12.0
60 changes: 60 additions & 0 deletions .golangci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
version: '2'
run:
timeout: 5m
linters:
enable:
- decorder
- errorlint
- gocyclo
- govet
- gosec
- gosmopolitan
- intrange
- misspell
- predeclared
- reassign
- staticcheck
- unconvert
- unparam
- usestdlibvars
- wastedassign
- copyloopvar
- tparallel
- gochecknoglobals
- nolintlint
- modernize
- gocritic
settings:
govet:
enable:
- shadow
gocyclo:
min-complexity: 30
exclusions:
generated: lax
rules:
- linters:
- gochecknoglobals
- gosec
- gocyclo
path: _test\.go
presets:
- comments
- common-false-positives
- legacy
- std-error-handling
paths:
- third_party$
- builtin$
- examples$

formatters:
enable:
- gofmt
- goimports
exclusions:
generated: lax
paths:
- third_party$
- builtin$
- examples$
5 changes: 5 additions & 0 deletions go.mod
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
module github.com/gaissmai/ipam

go 1.26

require github.com/gaissmai/grammar v0.3.0
2 changes: 2 additions & 0 deletions go.sum
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
github.com/gaissmai/grammar v0.3.0 h1:O90o3Fe5Vaw/3044pip3UEekN4RSl8mExKMKv2WuuGM=
github.com/gaissmai/grammar v0.3.0/go.mod h1:iAnAryYv9vmVajL9t7zKDnWjeySd8LrTacEwOMbnlvk=
105 changes: 105 additions & 0 deletions internal/grammar/grammar.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,105 @@
// package grammar defines patterns and rules for IPAM domain specific language.
Comment thread
greptile-apps[bot] marked this conversation as resolved.
Outdated
package grammar

import (
"regexp"

"github.com/gaissmai/grammar"
)

// g is ready to use after init().
//
//nolint:gochecknoglobals
var g *grammar.Grammar

// init compiles the grammar rules.
func init() {
g = grammar.New("IPAM")

for name, rawPattern := range AllRules() {
if err := g.Add(name, rawPattern); err != nil {
panic(err)
}
}

if err := g.Compile(); err != nil {
panic(err)
}
Comment thread
greptile-apps[bot] marked this conversation as resolved.
}

// MustRx returns the regexp for rule from the underlying grammar.
func MustRx(name string) *regexp.Regexp {
rx, err := g.Rx(name)
if err != nil {
panic(err)
}

return rx
}

// AllRules to build the IPAM tokens.
func AllRules() map[string]string {
return map[string]string{
"label": label,
"word": word,
"cswords": cswords,
"fqdn": fqdn,
"ident": ident,
"comment": comment,
"scoping": scoping,
"ip": ip,
"ipv4": ipv4,
"ipv6": ipv6,
}
}

// ###########################################################################
// IPAM GRAMMAR
// slimmed down version, just some helper regexps for the lexer state machine
// ###########################################################################

const (

// # comment til EOL
comment = `^ # .* $`

scoping = `^ --- -* $`

// a label is field of a FQDN
label = `(?: [- \w]+ )` // hyphen and word chars, the rest is done by the parser
Comment thread
greptile-apps[bot] marked this conversation as resolved.

// word
word = `\w [-\w]*`

// comma-separated words
cswords = `^ ${word} (?: , ${word} )* $`

// full qualified domain name, com com. www.google.com. *.foo.bar
// the length restriction parsing etc. is done by the parser
// IDNA not supported, just plain ASCII
fqdn = `^
(?:
(?: \*\. )? // alias can start with wildcard followed by dot
(?: ${label} \. )+ // one or more (label followed by dot)
${label}? [a-zA-Z]+ // TLD ends with at least one ASCII letter
\.? // last dot optional
$)`

// keywords, attributes and flags are uppercase
ident = `^ (?: [A-Z] [A-Z0-9_]+ )` // missing $ is intended

// simple and fast patterns for lexing, true parsing with netip.ParseAddr()
ip = `^ (?: ${ipv4} | ${ipv6} ) ` // missing $ is intended

ipv4 = `^ (?:
\d{1,3} \.
\d{1,3} \.
\d{1,3} \.
\d{1,3}
)` // missing $ is intended

ipv6 = `^ (?: // xdigits and colons, no dot
[[:xdigit:] :]+ :
[[:xdigit:] :]*
)` // missing $ is intended
Comment thread
greptile-apps[bot] marked this conversation as resolved.
)
46 changes: 46 additions & 0 deletions internal/grammar/grammar_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
package grammar_test

import (
"testing"

g "github.com/gaissmai/ipam/internal/grammar"
)

func TestGrammar(t *testing.T) {
t.Parallel()

for name := range g.AllRules() {
rx := g.MustRx(name)
t.Log(name, rx)
}
}

func TestGrammarWords(t *testing.T) {
t.Parallel()
tt := []struct {
rule string
input string
want bool
}{
{
rule: "word",
input: "with-hyphen",
want: true,
},
{
rule: "cswords",
input: "std,open",
want: true,
},
}

for _, tc := range tt {
t.Run(tc.input, func(t *testing.T) {
t.Parallel()
got := g.MustRx(tc.rule).MatchString(tc.input)
if got != tc.want {
t.Fatalf("rule: %s, input: %s, got %v, want %v", tc.rule, tc.input, got, tc.want)
}
})
}
}
Comment thread
greptile-apps[bot] marked this conversation as resolved.
Outdated