From 1b494d48fa203400a200a1ec0140c38e0080f126 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Wed, 20 May 2026 02:03:55 +0200 Subject: [PATCH 1/2] sec(ci): verify golang-migrate tarball sha256 before install (#434) Replace the unverified `curl | tar` pipe with a two-step download + sha256 verification before extraction. The official sha256sum.txt published with the v4.17.0 release is used as the source of truth. `set -euo pipefail` ensures the step aborts immediately if the checksum check fails. Closes #434 --- .github/workflows/database-migration.yml | 36 ++++++++++++++++++++---- 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/.github/workflows/database-migration.yml b/.github/workflows/database-migration.yml index 75e3fe8d0..c5948235e 100644 --- a/.github/workflows/database-migration.yml +++ b/.github/workflows/database-migration.yml @@ -144,9 +144,17 @@ jobs: uses: actions/checkout@v5 - name: Install golang-migrate + env: + MIGRATE_VERSION: v4.17.0 + MIGRATE_SHA256: 26c53c9162c9c4aaa84c47cd12455d4a9ac725befbe82850a5937b5ec1e7b8e6 run: | - curl -L https://github.com/golang-migrate/migrate/releases/download/v4.17.0/migrate.linux-amd64.tar.gz | tar xvz - sudo mv migrate /usr/local/bin/ + set -euo pipefail + curl -fsSL -o /tmp/migrate.tar.gz \ + "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/migrate.linux-amd64.tar.gz" + echo "${MIGRATE_SHA256} /tmp/migrate.tar.gz" | sha256sum --check --strict + tar -xz -C /tmp -f /tmp/migrate.tar.gz migrate + sudo install -m 0755 /tmp/migrate /usr/local/bin/migrate + rm /tmp/migrate.tar.gz /tmp/migrate - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v6 @@ -215,9 +223,17 @@ jobs: uses: actions/checkout@v5 - name: Install golang-migrate + env: + MIGRATE_VERSION: v4.17.0 + MIGRATE_SHA256: 26c53c9162c9c4aaa84c47cd12455d4a9ac725befbe82850a5937b5ec1e7b8e6 run: | - curl -L https://github.com/golang-migrate/migrate/releases/download/v4.17.0/migrate.linux-amd64.tar.gz | tar xvz - sudo mv migrate /usr/local/bin/ + set -euo pipefail + curl -fsSL -o /tmp/migrate.tar.gz \ + "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/migrate.linux-amd64.tar.gz" + echo "${MIGRATE_SHA256} /tmp/migrate.tar.gz" | sha256sum --check --strict + tar -xz -C /tmp -f /tmp/migrate.tar.gz migrate + sudo install -m 0755 /tmp/migrate /usr/local/bin/migrate + rm /tmp/migrate.tar.gz /tmp/migrate - name: Authenticate to Google Cloud uses: google-github-actions/auth@v3 @@ -276,9 +292,17 @@ jobs: uses: actions/checkout@v5 - name: Install golang-migrate + env: + MIGRATE_VERSION: v4.17.0 + MIGRATE_SHA256: 26c53c9162c9c4aaa84c47cd12455d4a9ac725befbe82850a5937b5ec1e7b8e6 run: | - curl -L https://github.com/golang-migrate/migrate/releases/download/v4.17.0/migrate.linux-amd64.tar.gz | tar xvz - sudo mv migrate /usr/local/bin/ + set -euo pipefail + curl -fsSL -o /tmp/migrate.tar.gz \ + "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/migrate.linux-amd64.tar.gz" + echo "${MIGRATE_SHA256} /tmp/migrate.tar.gz" | sha256sum --check --strict + tar -xz -C /tmp -f /tmp/migrate.tar.gz migrate + sudo install -m 0755 /tmp/migrate /usr/local/bin/migrate + rm /tmp/migrate.tar.gz /tmp/migrate - name: Azure Login uses: azure/login@v3 From ece1b9d876b8866c957a3128cd1dba780976fcb2 Mon Sep 17 00:00:00 2001 From: Cristian Magherusan-Stanciu Date: Mon, 1 Jun 2026 19:21:56 +0200 Subject: [PATCH 2/2] fix(ci): replace duplicated golang-migrate tarball installs with go install All three cloud provider jobs in database-migration.yml had identical curl/sha256/tar/install blocks. Replaced each with setup-go + go install using the version already pinned in go.mod (v4.19.1), leveraging Go module checksums for integrity and eliminating the manual tarball approach. --- .github/workflows/database-migration.yml | 51 +++++++++--------------- 1 file changed, 18 insertions(+), 33 deletions(-) diff --git a/.github/workflows/database-migration.yml b/.github/workflows/database-migration.yml index c5948235e..74dc2876e 100644 --- a/.github/workflows/database-migration.yml +++ b/.github/workflows/database-migration.yml @@ -143,18 +143,13 @@ jobs: - name: Checkout code uses: actions/checkout@v5 + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + - name: Install golang-migrate - env: - MIGRATE_VERSION: v4.17.0 - MIGRATE_SHA256: 26c53c9162c9c4aaa84c47cd12455d4a9ac725befbe82850a5937b5ec1e7b8e6 - run: | - set -euo pipefail - curl -fsSL -o /tmp/migrate.tar.gz \ - "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/migrate.linux-amd64.tar.gz" - echo "${MIGRATE_SHA256} /tmp/migrate.tar.gz" | sha256sum --check --strict - tar -xz -C /tmp -f /tmp/migrate.tar.gz migrate - sudo install -m 0755 /tmp/migrate /usr/local/bin/migrate - rm /tmp/migrate.tar.gz /tmp/migrate + run: go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@v4.19.1 - name: Configure AWS credentials uses: aws-actions/configure-aws-credentials@v6 @@ -222,18 +217,13 @@ jobs: - name: Checkout code uses: actions/checkout@v5 + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + - name: Install golang-migrate - env: - MIGRATE_VERSION: v4.17.0 - MIGRATE_SHA256: 26c53c9162c9c4aaa84c47cd12455d4a9ac725befbe82850a5937b5ec1e7b8e6 - run: | - set -euo pipefail - curl -fsSL -o /tmp/migrate.tar.gz \ - "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/migrate.linux-amd64.tar.gz" - echo "${MIGRATE_SHA256} /tmp/migrate.tar.gz" | sha256sum --check --strict - tar -xz -C /tmp -f /tmp/migrate.tar.gz migrate - sudo install -m 0755 /tmp/migrate /usr/local/bin/migrate - rm /tmp/migrate.tar.gz /tmp/migrate + run: go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@v4.19.1 - name: Authenticate to Google Cloud uses: google-github-actions/auth@v3 @@ -291,18 +281,13 @@ jobs: - name: Checkout code uses: actions/checkout@v5 + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + - name: Install golang-migrate - env: - MIGRATE_VERSION: v4.17.0 - MIGRATE_SHA256: 26c53c9162c9c4aaa84c47cd12455d4a9ac725befbe82850a5937b5ec1e7b8e6 - run: | - set -euo pipefail - curl -fsSL -o /tmp/migrate.tar.gz \ - "https://github.com/golang-migrate/migrate/releases/download/${MIGRATE_VERSION}/migrate.linux-amd64.tar.gz" - echo "${MIGRATE_SHA256} /tmp/migrate.tar.gz" | sha256sum --check --strict - tar -xz -C /tmp -f /tmp/migrate.tar.gz migrate - sudo install -m 0755 /tmp/migrate /usr/local/bin/migrate - rm /tmp/migrate.tar.gz /tmp/migrate + run: go install -tags 'postgres' github.com/golang-migrate/migrate/v4/cmd/migrate@v4.19.1 - name: Azure Login uses: azure/login@v3