Skip to content

fix: Phase 1 — Security, concurrency & provisioner resilience + E2E tests #623

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ArangoGutierrez merged 1 commit into from
Feb 9, 2026
Merged

fix: Phase 1 — Security, concurrency & provisioner resilience + E2E tests #623

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions cmd/action/ci/ci.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@ func readInputs() error {
if awsSshKey != "" {
err := os.Setenv("AWS_SSH_KEY", awsSshKey)
if err != nil {
return fmt.Errorf("failed to set AWS_SSH_KEY: %v", err)
return fmt.Errorf("failed to set AWS_SSH_KEY: %w", err)
}
}
// Map INPUT_AWS_ACCESS_KEY_ID and INPUT_AWS_SECRET_ACCESS_KEY
Expand All @@ -85,14 +85,14 @@ func readInputs() error {
if accessKeyID != "" {
err := os.Setenv("AWS_ACCESS_KEY_ID", accessKeyID)
if err != nil {
return fmt.Errorf("failed to set AWS_ACCESS_KEY_ID: %v", err)
return fmt.Errorf("failed to set AWS_ACCESS_KEY_ID: %w", err)
}
}
secretAccessKey := os.Getenv("INPUT_AWS_SECRET_ACCESS_KEY")
if secretAccessKey != "" {
err := os.Setenv("AWS_SECRET_ACCESS_KEY", secretAccessKey)
if err != nil {
return fmt.Errorf("failed to set AWS_SECRET_ACCESS_KEY: %v", err)
return fmt.Errorf("failed to set AWS_SECRET_ACCESS_KEY: %w", err)
}
}

Expand All @@ -101,7 +101,7 @@ func readInputs() error {
if vsphereSshKey != "" {
err := os.Setenv("VSPHERE_SSH_KEY", vsphereSshKey)
if err != nil {
return fmt.Errorf("failed to set VSPHERE_SSH_KEY: %v", err)
return fmt.Errorf("failed to set VSPHERE_SSH_KEY: %w", err)
}
}
// Map INPUT_VSPHERE_USERNAME and INPUT_VSPHERE_PASSWORD
Expand All @@ -110,14 +110,14 @@ func readInputs() error {
if vsphereUsername != "" {
err := os.Setenv("HOLODECK_VCENTER_USERNAME", vsphereUsername)
if err != nil {
return fmt.Errorf("failed to set HOLODECK_VCENTER_USERNAME: %v", err)
return fmt.Errorf("failed to set HOLODECK_VCENTER_USERNAME: %w", err)
}
}
vspherePassword := os.Getenv("INPUT_VSPHERE_PASSWORD")
if vspherePassword != "" {
err := os.Setenv("HOLODECK_VCENTER_PASSWORD", vspherePassword)
if err != nil {
return fmt.Errorf("failed to set HOLODECK_VCENTER_PASSWORD: %v", err)
return fmt.Errorf("failed to set HOLODECK_VCENTER_PASSWORD: %w", err)
}
}

Expand Down
14 changes: 7 additions & 7 deletions cmd/action/ci/cleanup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ func cleanup(log *logger.FunLogger) error {
configFile = "/github/workspace/" + configFile
cfg, err := jyaml.UnmarshalFromFile[v1alpha1.Environment](configFile)
if err != nil {
return fmt.Errorf("error reading config file: %s", err)
return fmt.Errorf("error reading config file: %w", err)
}

// Set env name
Expand All @@ -54,7 +54,7 @@ func cleanup(log *logger.FunLogger) error {

provider, err := newProvider(log, &cfg)
if err != nil {
return fmt.Errorf("failed to create provider: %v", err)
return fmt.Errorf("failed to create provider: %w", err)
}

if err := provider.Delete(); err != nil {
Expand All @@ -66,13 +66,13 @@ func cleanup(log *logger.FunLogger) error {
// if kubeconfig exists, delete it
if _, err := os.Stat(kubeconfig); err == nil {
if err := os.Remove(kubeconfig); err != nil {
log.Error(fmt.Errorf("error deleting kubeconfig: %s", err))
log.Error(fmt.Errorf("error deleting kubeconfig: %w", err))
}
}

if _, err := os.Stat(sshKeyFile); err == nil {
if err := os.Remove(sshKeyFile); err != nil {
log.Error(fmt.Errorf("error deleting ssh key: %s", err))
log.Error(fmt.Errorf("error deleting ssh key: %w", err))
}
}

Expand All @@ -93,17 +93,17 @@ func isTerminated(log *logger.FunLogger) (bool, error) {
configFile = "/github/workspace/" + configFile
cfg, err := jyaml.UnmarshalFromFile[v1alpha1.Environment](configFile)
if err != nil {
return false, fmt.Errorf("error reading config file: %s", err)
return false, fmt.Errorf("error reading config file: %w", err)
}

provider, err := newProvider(log, &cfg)
if err != nil {
return false, fmt.Errorf("failed to create provider: %v", err)
return false, fmt.Errorf("failed to create provider: %w", err)
}

status, err := provider.Status()
if err != nil {
return false, fmt.Errorf("failed to get status: %v", err)
return false, fmt.Errorf("failed to get status: %w", err)
}

for _, s := range status {
Expand Down
10 changes: 5 additions & 5 deletions cmd/action/ci/entrypoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ func entrypoint(log *logger.FunLogger) error {
// Read the config file
cfg, err := jyaml.UnmarshalFromFile[v1alpha1.Environment](configFile)
if err != nil {
return fmt.Errorf("error reading config file: %s", err)
return fmt.Errorf("error reading config file: %w", err)
}
// If no containerruntime is specified, default to none
if cfg.Spec.ContainerRuntime.Name == "" {
Expand All @@ -53,7 +53,7 @@ func entrypoint(log *logger.FunLogger) error {

provider, err := newProvider(log, &cfg)
if err != nil {
return fmt.Errorf("failed to create provider: %v", err)
return fmt.Errorf("failed to create provider: %w", err)
}

err = provider.Create()
Expand All @@ -64,7 +64,7 @@ func entrypoint(log *logger.FunLogger) error {
// Read cache after creating the environment
cache, err := jyaml.UnmarshalFromFile[v1alpha1.Environment](cacheFile)
if err != nil {
return fmt.Errorf("failed to read cache file: %v", err)
return fmt.Errorf("failed to read cache file: %w", err)
}

// Get the host url
Expand Down Expand Up @@ -92,13 +92,13 @@ func entrypoint(log *logger.FunLogger) error {

log.Info("Provisioning \u2699")
if err = p.Run(cfg); err != nil {
return fmt.Errorf("failed to run provisioner: %v", err)
return fmt.Errorf("failed to run provisioner: %w", err)
}

if cfg.Spec.Kubernetes.Install {
err = utils.GetKubeConfig(log, &cfg, hostUrl, kubeconfig)
if err != nil {
return fmt.Errorf("failed to get kubeconfig: %v", err)
return fmt.Errorf("failed to get kubeconfig: %w", err)
}
}

Expand Down
6 changes: 3 additions & 3 deletions cmd/action/ci/provider.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ func newAwsProvider(log *logger.FunLogger, cfg *v1alpha1.Environment) (*aws.Prov
if _, err := os.Stat(cachedir); os.IsNotExist(err) {
err := os.Mkdir(cachedir, 0750)
if err != nil {
log.Error(fmt.Errorf("error creating cache directory: %s", err))
log.Error(fmt.Errorf("error creating cache directory: %w", err))
return nil, err
}
}
Expand Down Expand Up @@ -77,14 +77,14 @@ func getSSHKeyFile(log *logger.FunLogger, envKey string) error {
}
err := os.WriteFile(sshKeyFile, []byte(envSshKey), 0600)
if err != nil {
log.Error(fmt.Errorf("error writing ssh key to file: %s", err))
log.Error(fmt.Errorf("error writing ssh key to file: %w", err))
return err
}
} else {
// copy file to sshKeyFile
err := os.Rename(holodeckSSHKeyFile, sshKeyFile)
if err != nil {
log.Error(fmt.Errorf("error copying ssh key file: %s", err))
log.Error(fmt.Errorf("error copying ssh key file: %w", err))
return err
}
}
Expand Down
2 changes: 1 addition & 1 deletion cmd/action/ci/vpc_cleanup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ func RunCleanup(log *logger.FunLogger) error {
}

if cleanupErr != nil {
log.Error(fmt.Errorf("failed to cleanup VPC %s: %v", vpcID, cleanupErr))
log.Error(fmt.Errorf("failed to cleanup VPC %s: %w", vpcID, cleanupErr))
failCount++
} else {
log.Info("Successfully cleaned up VPC %s", vpcID)
Expand Down
4 changes: 2 additions & 2 deletions cmd/cli/cleanup/cleanup.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,9 +179,9 @@ func (m *command) run(c *cli.Context) error {

if cleanupErr != nil {
if ctx.Err() != nil {
m.log.Error(fmt.Errorf("cleanup of VPC %s was cancelled: %v", vpcID, cleanupErr))
m.log.Error(fmt.Errorf("cleanup of VPC %s was cancelled: %w", vpcID, cleanupErr))
} else {
m.log.Error(fmt.Errorf("failed to cleanup VPC %s: %v", vpcID, cleanupErr))
m.log.Error(fmt.Errorf("failed to cleanup VPC %s: %w", vpcID, cleanupErr))
}
failCount++
} else {
Expand Down
6 changes: 3 additions & 3 deletions cmd/cli/common/host.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,12 +87,12 @@ const (
func ConnectSSH(log *logger.FunLogger, keyPath, userName, hostUrl string) (*ssh.Client, error) {
key, err := os.ReadFile(keyPath) //nolint:gosec // keyPath is from trusted env config
if err != nil {
return nil, fmt.Errorf("failed to read key file %s: %v", keyPath, err)
return nil, fmt.Errorf("failed to read key file %s: %w", keyPath, err)
}

signer, err := ssh.ParsePrivateKey(key)
if err != nil {
return nil, fmt.Errorf("failed to parse private key: %v", err)
return nil, fmt.Errorf("failed to parse private key: %w", err)
}

config := &ssh.ClientConfig{
Expand All @@ -116,5 +116,5 @@ func ConnectSSH(log *logger.FunLogger, keyPath, userName, hostUrl string) (*ssh.
time.Sleep(sshRetryDelay)
}

return nil, fmt.Errorf("failed to connect after %d attempts: %v", sshMaxRetries, err)
return nil, fmt.Errorf("failed to connect after %d attempts: %w", sshMaxRetries, err)
}
28 changes: 14 additions & 14 deletions cmd/cli/create/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ func (m command) build() *cli.Command {
var err error
opts.cfg, err = jyaml.UnmarshalFromFile[v1alpha1.Environment](opts.envFile)
if err != nil {
return fmt.Errorf("error reading config file: %s", err)
return fmt.Errorf("error reading config file: %w", err)
}

// if no containerruntime is specified, default to none
Expand Down Expand Up @@ -184,7 +184,7 @@ func (m command) run(c *cli.Context, opts *options) error {
// Read cache after creating the environment
opts.cache, err = jyaml.UnmarshalFromFile[v1alpha1.Environment](opts.cacheFile)
if err != nil {
return fmt.Errorf("failed to read cache file: %v", err)
return fmt.Errorf("failed to read cache file: %w", err)
}

if opts.provision {
Expand Down Expand Up @@ -443,22 +443,22 @@ func runSingleNodeProvision(log *logger.FunLogger, opts *options) error {
}
data, err := jyaml.MarshalYAML(opts.cfg)
if err != nil {
return fmt.Errorf("failed to marshal environment: %v", err)
return fmt.Errorf("failed to marshal environment: %w", err)
}
if err := os.WriteFile(opts.cacheFile, data, 0600); err != nil {
return fmt.Errorf("failed to update cache file with provisioning status: %v", err)
return fmt.Errorf("failed to update cache file with provisioning status: %w", err)
}
return fmt.Errorf("failed to run provisioner: %v", err)
return fmt.Errorf("failed to run provisioner: %w", err)
}

// Set provisioning status to true after successful provisioning
opts.cfg.Labels[instances.InstanceProvisionedLabelKey] = "true"
data, err := jyaml.MarshalYAML(opts.cfg)
if err != nil {
return fmt.Errorf("failed to marshal environment: %v", err)
return fmt.Errorf("failed to marshal environment: %w", err)
}
if err := os.WriteFile(opts.cacheFile, data, 0600); err != nil {
return fmt.Errorf("failed to update cache file with provisioning status: %v", err)
return fmt.Errorf("failed to update cache file with provisioning status: %w", err)
}

// Download kubeconfig
Expand All @@ -476,7 +476,7 @@ func runSingleNodeProvision(log *logger.FunLogger, opts *options) error {
}
}
if err = utils.GetKubeConfig(log, &opts.cache, hostUrl, opts.kubeconfig); err != nil {
return fmt.Errorf("failed to get kubeconfig: %v", err)
return fmt.Errorf("failed to get kubeconfig: %w", err)
}
}

Expand Down Expand Up @@ -524,22 +524,22 @@ func runMultinodeProvision(log *logger.FunLogger, opts *options) error {
}
data, err := jyaml.MarshalYAML(opts.cfg)
if err != nil {
return fmt.Errorf("failed to marshal environment: %v", err)
return fmt.Errorf("failed to marshal environment: %w", err)
}
if err := os.WriteFile(opts.cacheFile, data, 0600); err != nil {
return fmt.Errorf("failed to update cache file with provisioning status: %v", err)
return fmt.Errorf("failed to update cache file with provisioning status: %w", err)
}
return fmt.Errorf("failed to provision multinode cluster: %v", err)
return fmt.Errorf("failed to provision multinode cluster: %w", err)
}

// Set provisioning status to true after successful provisioning
opts.cfg.Labels[instances.InstanceProvisionedLabelKey] = "true"
data, err := jyaml.MarshalYAML(opts.cfg)
if err != nil {
return fmt.Errorf("failed to marshal environment: %v", err)
return fmt.Errorf("failed to marshal environment: %w", err)
}
if err := os.WriteFile(opts.cacheFile, data, 0600); err != nil {
return fmt.Errorf("failed to update cache file with provisioning status: %v", err)
return fmt.Errorf("failed to update cache file with provisioning status: %w", err)
}

// Download kubeconfig from first control-plane node
Expand All @@ -554,7 +554,7 @@ func runMultinodeProvision(log *logger.FunLogger, opts *options) error {
}
if hostUrl != "" {
if err := utils.GetKubeConfig(log, &opts.cache, hostUrl, opts.kubeconfig); err != nil {
return fmt.Errorf("failed to get kubeconfig: %v", err)
return fmt.Errorf("failed to get kubeconfig: %w", err)
}
}
}
Expand Down
4 changes: 2 additions & 2 deletions cmd/cli/delete/delete.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,12 +73,12 @@ func (m command) run(c *cli.Context) error {
// First check if the instance exists
instance, err := manager.GetInstance(instanceID)
if err != nil {
return fmt.Errorf("failed to get instance %s: %v", instanceID, err)
return fmt.Errorf("failed to get instance %s: %w", instanceID, err)
}

// Delete the instance
if err := manager.DeleteInstance(instanceID); err != nil {
return fmt.Errorf("failed to delete instance %s: %v", instanceID, err)
return fmt.Errorf("failed to delete instance %s: %w", instanceID, err)
}

m.log.Info("Successfully deleted instance %s (%s)", instanceID, instance.Name)
Expand Down
4 changes: 2 additions & 2 deletions cmd/cli/describe/describe.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,13 +239,13 @@ func (m command) run(instanceID string) error {
manager := instances.NewManager(m.log, m.cachePath)
instance, err := manager.GetInstance(instanceID)
if err != nil {
return fmt.Errorf("failed to get instance: %v", err)
return fmt.Errorf("failed to get instance: %w", err)
}

// Load environment
env, err := jyaml.UnmarshalFromFile[v1alpha1.Environment](instance.CacheFile)
if err != nil {
return fmt.Errorf("failed to read environment: %v", err)
return fmt.Errorf("failed to read environment: %w", err)
}

age := time.Since(instance.CreatedAt).Round(time.Second)
Expand Down
6 changes: 3 additions & 3 deletions cmd/cli/dryrun/dryrun.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ func (m command) build() *cli.Command {
var err error
opts.cfg, err = jyaml.UnmarshalFromFile[v1alpha1.Environment](opts.envFile)
if err != nil {
return fmt.Errorf("failed to read config file %s: %v", opts.envFile, err)
return fmt.Errorf("failed to read config file %s: %w", opts.envFile, err)
}

return nil
Expand Down Expand Up @@ -132,11 +132,11 @@ func connectOrDie(keyPath, userName, hostUrl string) error {
var err error
key, err := os.ReadFile(keyPath) // nolint:gosec
if err != nil {
return fmt.Errorf("failed to read key file: %v", err)
return fmt.Errorf("failed to read key file: %w", err)
}
signer, err := ssh.ParsePrivateKey(key)
if err != nil {
return fmt.Errorf("failed to parse private key: %v", err)
return fmt.Errorf("failed to parse private key: %w", err)
}
sshConfig := &ssh.ClientConfig{
User: userName,
Expand Down
Loading
Loading