Merge branch 'main' into dependabot/github_actions/actions/github-scr…

…ipt-7
bulwark-security · Aug 10, 2024 · c195876 · c195876
2 parents 156968c + d2688aa
commit c195876
Show file tree

Hide file tree

Showing 14 changed files with 176 additions and 124 deletions.
diff --git a/.dryrunsecurity.yaml b/.dryrunsecurity.yaml
@@ -1,10 +1,12 @@
 sensitiveCodepaths:
   # Files only allowed authors can modify
-  - '.github/**/*'
+  - ".github/**/*"
 allowedAuthors:
   usernames:
     # GitHub username
-    - 'sporkmonger'
+    - "sporkmonger"
+    - "dependabot"
+    - "dependabot[bot]"
 notificationList:
   # GitHub username or team name
-  - '@sporkmonger'
+  - "@sporkmonger"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -17,3 +17,19 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+
+  - package-ecosystem: "pip"
+    directory: "/crates/ext-processor/protobuf/protoc-gen-validate"
+    schedule:
+      interval: "monthly"
+    labels: []
+    ignore:
+      - dependency-name: "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/crates/ext-processor/protobuf/protoc-gen-validate"
+    schedule:
+      interval: "monthly"
+    labels: []
+    ignore:
+      - dependency-name: "*"
diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
     - uses: actions/checkout@v4
     - name: 'cargo deny'
-      uses: EmbarkStudios/cargo-deny-action@v1
+      uses: EmbarkStudios/cargo-deny-action@v2
       with:
         command: check
         command-arguments: all
diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
@@ -18,14 +18,14 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+      uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
       with:
         toolchain: stable
         components: clippy
         target: wasm32-wasi
 
     - name: Ensure generated files are available
-      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
+      uses: clechasseur/rs-cargo@34eb9ee3e4186e5c7820a54393fbf081f78bc102 # v2.0.2
       with:
         command: test
         args: -p bulwark-config -p bulwark-sdk

diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
@@ -17,7 +17,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+      uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
       with:
         toolchain: stable
         components: clippy
@@ -27,7 +27,7 @@ jobs:
       run: /usr/bin/sudo /usr/bin/apt install -y protobuf-compiler
 
     - name: Build release target
-      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
+      uses: clechasseur/rs-cargo@34eb9ee3e4186e5c7820a54393fbf081f78bc102 # v2.0.2
       with:
         command: build
         args: --release --target=x86_64-unknown-linux-gnu
@@ -64,7 +64,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+      uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
       with:
         toolchain: stable
         components: clippy
@@ -78,7 +78,7 @@ jobs:
       run: brew install protobuf
 
     - name: Build release target
-      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
+      uses: clechasseur/rs-cargo@34eb9ee3e4186e5c7820a54393fbf081f78bc102 # v2.0.2
       with:
         command: build
         args: --release --target=x86_64-apple-darwin
@@ -115,7 +115,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+      uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
       with:
         toolchain: stable
         components: clippy
@@ -129,7 +129,7 @@ jobs:
       run: brew install protobuf
 
     - name: Build release target
-      uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
+      uses: clechasseur/rs-cargo@34eb9ee3e4186e5c7820a54393fbf081f78bc102 # v2.0.2
       with:
         command: build
         args: --release --target=aarch64-apple-darwin

diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+      - uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
         with:
           toolchain: stable
           components: rustfmt
@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
         with:
           toolchain: stable
           components: clippy
@@ -56,7 +56,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
         with:
           toolchain: stable
           components: clippy
@@ -119,7 +119,7 @@ jobs:
         run: /usr/bin/docker run -d --name envoy --network "${{ job.container.network }}" --network-alias envoy -p 4080:4080 -e GITHUB_ACTIONS=true -e CI=true -v "./tests/gha_envoy.yaml":"/etc/envoy/envoy.yaml" envoyproxy/envoy:v${{ matrix.envoy-version }}-latest envoy -l debug -c /etc/envoy/envoy.yaml
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@21dc36fb71dd22e3317045c0c31a3f4249868b17
+        uses: dtolnay/rust-toolchain@7b1c307e0dcbda6122208f10795a713336a9b35a
         with:
           toolchain: ${{ matrix.rust_version }}
           components: clippy
@@ -135,7 +135,7 @@ jobs:
         run: /usr/bin/docker ps
 
       - name: Run bulwark tests
-        uses: clechasseur/rs-cargo@5cd564345ef5b1136392a1dc943b33a3a888b873 # v2.0.2
+        uses: clechasseur/rs-cargo@34eb9ee3e4186e5c7820a54393fbf081f78bc102 # v2.0.2
         with:
           command: test
           args: -p bulwark-cli -p bulwark-build -p bulwark-config -p bulwark-decision -p bulwark-ext-processor -p bulwark-host -p bulwark-sdk -p bulwark-sdk-macros -- --include-ignored

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -34,8 +34,8 @@ clap = { version = "4.4.3", features = ["derive"] }
 clap_complete = "4.5.2"
 color-eyre = "0.6.2"
 hyper = { version = "1.2.0", features = ["server"] }
-metrics-exporter-prometheus = "0.15.0"
-metrics-exporter-statsd = "0.6.0"
+metrics-exporter-prometheus = "0.15.3"
+metrics-exporter-statsd = "0.8.0"
 quoted-string = "0.6.1"
 tower = { version = "0.4.13", features = ["tokio", "tracing"] }
 tower-http = { version = "0.5.0", features = [
@@ -119,7 +119,7 @@ futures = "0.3"
 hex = "0.4.3"
 http = "1.0"
 matchit = "0.8.2"
-metrics = "0.21.1"
+metrics = "0.23.0"
 owo-colors = "3.5.0"
 redis = { version = "0.25", features = [
     "tokio-comp",

diff --git a/crates/ext-processor/src/protobuf.rs b/crates/ext-processor/src/protobuf.rs
@@ -11,6 +11,7 @@ pub mod envoy {
             }
         }
         pub mod core {
+            #[allow(clippy::doc_lazy_continuation)]
             #[allow(clippy::large_enum_variant)]
             pub mod v3 {
                 include!(concat!(env!("OUT_DIR"), "/envoy.config.core.v3.rs"));
@@ -21,6 +22,7 @@ pub mod envoy {
         pub mod filters {
             pub mod http {
                 pub mod ext_authz {
+                    #[allow(clippy::doc_lazy_continuation)]
                     #[allow(clippy::large_enum_variant)]
                     pub mod v3 {
                         include!(concat!(
@@ -30,6 +32,7 @@ pub mod envoy {
                     }
                 }
                 pub mod ext_proc {
+                    #[allow(clippy::doc_lazy_continuation)]
                     pub mod v3 {
                         include!(concat!(
                             env!("OUT_DIR"),
@@ -52,6 +55,7 @@ pub mod envoy {
     }
     pub mod service {
         pub mod auth {
+            #[allow(clippy::doc_lazy_continuation)]
             pub mod v3 {
                 include!(concat!(env!("OUT_DIR"), "/envoy.service.auth.v3.rs"));
             }