[WIP] Do not Merge, Build image use only.

[HigashikataZhangsuke]

Do not Merge, Build image use only.

[spectro-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: HigashikataZhangsuke
To complete the pull request process, please assign after the PR has been reviewed.
You can assign the PR to them by writing /assign in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[bulwark-spectrocloud]

⚠️ GoVulnCheck scan found vulnerabilities:

1. GO-2025-3754
   • Module: github.com/cloudflare/circl
   • Found in: v1.3.7
   • Fixed in: v1.6.1
   • Example Traces:
     1. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ed448.init
     2. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ed25519.init
     3. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls x448.init
     4. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls x25519.init
     5. cmd/clusterctl/internal/test/fake_github.go:24:2: test.init calls github.init, which eventually calls ed25519.init

Please review these findings and fix the issues before merging.

[bulwark-spectrocloud]

⚠️ GoSec scan found code issues:

1. G115: integer overflow conversion int64 -> int32, Severity: HIGH
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:107:63
   • 2. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/cluster/cluster_controller_status.go:104:70
   • 3. File: /home/runner/work/bulwark/bulwark/target-repo/internal/contract/types.go:129:22
   • 4. File: /home/runner/work/bulwark/bulwark/target-repo/internal/test/envtest/environment.go:89:47
   • 5. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:189:26
   • 6. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller_status.go:123:26
   • 7. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1207:37
   • 8. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1206:33
   • 9. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1205:40
   • 10. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machineset/machineset_controller.go:1204:28
   • 11. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:690:26
   • 12. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:678:27
   • 13. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:253:33
   • 14. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machinehealthcheck/machinehealthcheck_controller.go:238:35
   • 15. File: /home/runner/work/bulwark/bulwark/target-repo/internal/controllers/machinedeployment/mdutil/util.go:726:14
   • ... (truncated), run gosec locally to capture all failure for the rule G115
2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/util/util.go:61:8
   • 2. File: /home/runner/work/bulwark/bulwark/target-repo/util/conversion/conversion.go:160:18
   • 3. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:616:43
   • 4. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:478:33
   • 5. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:468:40
   • 6. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:411:43
   • 7. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:307:43
   • 8. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/internal/controllers/inmemorymachine_controller.go:269:43
   • 9. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/docker/exp/internal/controllers/dockermachinepool_controller_phases.go:95:18
   • 10. File: /home/runner/work/bulwark/bulwark/target-repo/test/framework/machinedeployment_helpers.go:379:100
   • 11. File: /home/runner/work/bulwark/bulwark/target-repo/test/framework/machinedeployment_helpers.go:378:96
   • 12. File: /home/runner/work/bulwark/bulwark/target-repo/test/framework/machinedeployment_helpers.go:377:93
   • 13. File: /home/runner/work/bulwark/bulwark/target-repo/test/e2e/clusterclass_rollout.go:226:46
   • 14. File: /home/runner/work/bulwark/bulwark/target-repo/test/e2e/clusterclass_rollout.go:225:81
   • 15. File: /home/runner/work/bulwark/bulwark/target-repo/test/e2e/clusterclass_rollout.go:224:77
   • ... (truncated), run gosec locally to capture all failure for the rule G404
3. G402: TLS InsecureSkipVerify set true., Severity: HIGH
   • 1. File: /home/runner/work/bulwark/bulwark/target-repo/test/infrastructure/inmemory/pkg/server/mux.go:466:24
   • 2. File: /home/runner/work/bulwark/bulwark/target-repo/controlplane/kubeadm/internal/workload_cluster.go:469:62

Please review these findings and fix the issues before merging.

[HigashikataZhangsuke]

Done in PEM-10055