Skip to content

Commit 43d98bf

Browse files
EdwardAngertEdwardAngert
committed
Merge remote-tracking branch 'origin/main' into 16513-manage-ext-provisioners
2 parents bc752b8 + a322339 commit 43d98bf

File tree

263 files changed

+8408
-3250
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

263 files changed

+8408
-3250
lines changed

‎.github/workflows/ci.yaml

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ jobs:
178178
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
179179
180180
- name: golangci-lint cache
181-
uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
181+
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
182182
with:
183183
path: |
184184
${{ env.LINT_CACHE_DIR }}
@@ -188,7 +188,7 @@ jobs:
188188
189189
# Check for any typos
190190
- name: Check for typos
191-
uses: crate-ci/typos@51f257b946f503b768e522781f56e9b7b5570d48 # v1.29.7
191+
uses: crate-ci/typos@212923e4ff05b7fc2294a204405eec047b807138 # v1.29.9
192192
with:
193193
config: .github/workflows/typos.toml
194194

@@ -201,7 +201,7 @@ jobs:
201201
202202
# Needed for helm chart linting
203203
- name: Install helm
204-
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
204+
uses: azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112 # v4.3.0
205205
with:
206206
version: v3.9.2
207207

@@ -733,15 +733,15 @@ jobs:
733733

734734
- name: Upload Playwright Failed Tests
735735
if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
736-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
736+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
737737
with:
738738
name: failed-test-videos${{ matrix.variant.premium && '-premium' || '' }}
739739
path: ./site/test-results/**/*.webm
740740
retention-days: 7
741741

742742
- name: Upload pprof dumps
743743
if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
744-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
744+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
745745
with:
746746
name: debug-pprof-dumps${{ matrix.variant.premium && '-premium' || '' }}
747747
path: ./site/test-results/**/debug-pprof-*.txt
@@ -1000,7 +1000,7 @@ jobs:
10001000

10011001
- name: Upload build artifacts
10021002
if: ${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
1003-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
1003+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
10041004
with:
10051005
name: dylibs
10061006
path: |
@@ -1140,7 +1140,7 @@ jobs:
11401140

11411141
- name: Upload build artifacts
11421142
if: github.ref == 'refs/heads/main'
1143-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
1143+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
11441144
with:
11451145
name: coder
11461146
path: |
@@ -1183,7 +1183,7 @@ jobs:
11831183
uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
11841184

11851185
- name: Set up Flux CLI
1186-
uses: fluxcd/flux2/action@5350425cdcd5fa015337e09fa502153c0275bd4b # v2.4.0
1186+
uses: fluxcd/flux2/action@af67405ee43a6cd66e0b73f4b3802e8583f9d961 # v2.5.0
11871187
with:
11881188
# Keep this and the github action up to date with the version of flux installed in dogfood cluster
11891189
version: "2.2.1"

‎.github/workflows/contrib.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ jobs:
8484
repo: context.repo.repo,
8585
}
8686
87-
if (action === "opened" || action === "reopened") {
87+
if (action === "opened" || action === "reopened" || action === "ready_for_review") {
8888
if (isBreakingTitle && !labels.includes(releaseLabels.breaking)) {
8989
console.log('Add "%s" label', releaseLabels.breaking)
9090
await github.rest.issues.addLabels({

‎.github/workflows/release.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ jobs:
101101
AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
102102

103103
- name: Upload build artifacts
104-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
104+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
105105
with:
106106
name: dylibs
107107
path: |
@@ -485,7 +485,7 @@ jobs:
485485
486486
- name: Upload artifacts to actions (if dry-run)
487487
if: ${{ inputs.dry_run }}
488-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
488+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
489489
with:
490490
name: release-artifacts
491491
path: |

‎.github/workflows/scorecard.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
persist-credentials: false
3131

3232
- name: "Run analysis"
33-
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
33+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
3434
with:
3535
results_file: results.sarif
3636
results_format: sarif
@@ -39,14 +39,14 @@ jobs:
3939

4040
# Upload the results as artifacts.
4141
- name: "Upload artifact"
42-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
42+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
4343
with:
4444
name: SARIF file
4545
path: results.sarif
4646
retention-days: 5
4747

4848
# Upload the results to GitHub's code scanning dashboard.
4949
- name: "Upload to code-scanning"
50-
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
50+
uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
5151
with:
5252
sarif_file: results.sarif

‎.github/workflows/security.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
uses: ./.github/actions/setup-go
3939

4040
- name: Initialize CodeQL
41-
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
41+
uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
4242
with:
4343
languages: go, javascript
4444

@@ -48,7 +48,7 @@ jobs:
4848
rm Makefile
4949
5050
- name: Perform CodeQL Analysis
51-
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
51+
uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
5252

5353
- name: Send Slack notification on failure
5454
if: ${{ failure() }}
@@ -144,13 +144,13 @@ jobs:
144144
severity: "CRITICAL,HIGH"
145145

146146
- name: Upload Trivy scan results to GitHub Security tab
147-
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
147+
uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
148148
with:
149149
sarif_file: trivy-results.sarif
150150
category: "Trivy"
151151

152152
- name: Upload Trivy scan results as an artifact
153-
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
153+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
154154
with:
155155
name: trivy
156156
path: trivy-results.sarif

‎Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ endif
116116

117117
clean:
118118
rm -rf build/ site/build/ site/out/
119-
mkdir -p build/ site/out/bin/
119+
mkdir -p build/
120120
git restore site/out/
121121
.PHONY: clean
122122

‎agent/agent.go

Lines changed: 42 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ import (
66
"encoding/json"
77
"errors"
88
"fmt"
9+
"hash/fnv"
910
"io"
1011
"net/http"
1112
"net/netip"
@@ -340,7 +341,7 @@ func (a *agent) collectMetadata(ctx context.Context, md codersdk.WorkspaceAgentM
340341
// if it can guarantee the clocks are synchronized.
341342
CollectedAt: now,
342343
}
343-
cmdPty, err := a.sshServer.CreateCommand(ctx, md.Script, nil)
344+
cmdPty, err := a.sshServer.CreateCommand(ctx, md.Script, nil, nil)
344345
if err != nil {
345346
result.Error = fmt.Sprintf("create cmd: %+v", err)
346347
return result
@@ -372,7 +373,6 @@ func (a *agent) collectMetadata(ctx context.Context, md codersdk.WorkspaceAgentM
372373
// Important: if the command times out, we may see a misleading error like
373374
// "exit status 1", so it's important to include the context error.
374375
err = errors.Join(err, ctx.Err())
375-
376376
if err != nil {
377377
result.Error = fmt.Sprintf("run cmd: %+v", err)
378378
}
@@ -995,7 +995,6 @@ func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(co
995995
if err := manifestOK.wait(ctx); err != nil {
996996
return xerrors.Errorf("no manifest: %w", err)
997997
}
998-
var err error
999998
defer func() {
1000999
networkOK.complete(retErr)
10011000
}()
@@ -1004,9 +1003,20 @@ func (a *agent) createOrUpdateNetwork(manifestOK, networkOK *checkpoint) func(co
10041003
network := a.network
10051004
a.closeMutex.Unlock()
10061005
if network == nil {
1006+
keySeed, err := WorkspaceKeySeed(manifest.WorkspaceID, manifest.AgentName)
1007+
if err != nil {
1008+
return xerrors.Errorf("generate seed from workspace id: %w", err)
1009+
}
10071010
// use the graceful context here, because creating the tailnet is not itself tied to the
10081011
// agent API.
1009-
network, err = a.createTailnet(a.gracefulCtx, manifest.AgentID, manifest.DERPMap, manifest.DERPForceWebSockets, manifest.DisableDirectConnections)
1012+
network, err = a.createTailnet(
1013+
a.gracefulCtx,
1014+
manifest.AgentID,
1015+
manifest.DERPMap,
1016+
manifest.DERPForceWebSockets,
1017+
manifest.DisableDirectConnections,
1018+
keySeed,
1019+
)
10101020
if err != nil {
10111021
return xerrors.Errorf("create tailnet: %w", err)
10121022
}
@@ -1146,7 +1156,13 @@ func (a *agent) trackGoroutine(fn func()) error {
11461156
return nil
11471157
}
11481158

1149-
func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *tailcfg.DERPMap, derpForceWebSockets, disableDirectConnections bool) (_ *tailnet.Conn, err error) {
1159+
func (a *agent) createTailnet(
1160+
ctx context.Context,
1161+
agentID uuid.UUID,
1162+
derpMap *tailcfg.DERPMap,
1163+
derpForceWebSockets, disableDirectConnections bool,
1164+
keySeed int64,
1165+
) (_ *tailnet.Conn, err error) {
11501166
// Inject `CODER_AGENT_HEADER` into the DERP header.
11511167
var header http.Header
11521168
if client, ok := a.client.(*agentsdk.Client); ok {
@@ -1173,6 +1189,10 @@ func (a *agent) createTailnet(ctx context.Context, agentID uuid.UUID, derpMap *t
11731189
}
11741190
}()
11751191

1192+
if err := a.sshServer.UpdateHostSigner(keySeed); err != nil {
1193+
return nil, xerrors.Errorf("update host signer: %w", err)
1194+
}
1195+
11761196
sshListener, err := network.Listen("tcp", ":"+strconv.Itoa(workspacesdk.AgentSSHPort))
11771197
if err != nil {
11781198
return nil, xerrors.Errorf("listen on the ssh port: %w", err)
@@ -1850,3 +1870,20 @@ func PrometheusMetricsHandler(prometheusRegistry *prometheus.Registry, logger sl
18501870
}
18511871
})
18521872
}
1873+
1874+
// WorkspaceKeySeed converts a WorkspaceID UUID and agent name to an int64 hash.
1875+
// This uses the FNV-1a hash algorithm which provides decent distribution and collision
1876+
// resistance for string inputs.
1877+
func WorkspaceKeySeed(workspaceID uuid.UUID, agentName string) (int64, error) {
1878+
h := fnv.New64a()
1879+
_, err := h.Write(workspaceID[:])
1880+
if err != nil {
1881+
return 42, err
1882+
}
1883+
_, err = h.Write([]byte(agentName))
1884+
if err != nil {
1885+
return 42, err
1886+
}
1887+
1888+
return int64(h.Sum64()), nil
1889+
}

‎agent/agent_test.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ func TestAgent_Stats_Magic(t *testing.T) {
138138
defer sshClient.Close()
139139
session, err := sshClient.NewSession()
140140
require.NoError(t, err)
141-
session.Setenv(agentssh.MagicSessionTypeEnvironmentVariable, agentssh.MagicSessionTypeVSCode)
141+
session.Setenv(agentssh.MagicSessionTypeEnvironmentVariable, string(agentssh.MagicSessionTypeVSCode))
142142
defer session.Close()
143143

144144
command := "sh -c 'echo $" + agentssh.MagicSessionTypeEnvironmentVariable + "'"
@@ -165,7 +165,7 @@ func TestAgent_Stats_Magic(t *testing.T) {
165165
defer sshClient.Close()
166166
session, err := sshClient.NewSession()
167167
require.NoError(t, err)
168-
session.Setenv(agentssh.MagicSessionTypeEnvironmentVariable, agentssh.MagicSessionTypeVSCode)
168+
session.Setenv(agentssh.MagicSessionTypeEnvironmentVariable, string(agentssh.MagicSessionTypeVSCode))
169169
defer session.Close()
170170
stdin, err := session.StdinPipe()
171171
require.NoError(t, err)

‎agent/agentcontainers/containers.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,8 @@ type Lister interface {
144144
// NoopLister is a Lister interface that never returns any containers.
145145
type NoopLister struct{}
146146

147+
var _ Lister = NoopLister{}
148+
147149
func (NoopLister) List(_ context.Context) (codersdk.WorkspaceAgentListContainersResponse, error) {
148150
return codersdk.WorkspaceAgentListContainersResponse{}, nil
149151
}

0 commit comments

Comments
 (0)