actions-runner-controller

Repository on GitHub, which provides public git repositories with URLs.

Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.

We release a new version of the "canary" container image for each new commit to our master branch, so that anyone can test the unreleased edge version of the software and report any bugs to GitHub Issues. We build such canary images by using GitHub Actions, as implemented in https://github.com/actions-runner-controller/actions-runner-controller/blob/master/.github/workflows/wip.yml

Repository on GitHub, which uses git. git is distributed.

We use semver and publish release for two things, the primary software written in Golang, and another for the Helm chart that wraps the software into a K8s package. As you can see in https://github.com/actions-runner-controller/actions-runner-controller/releases, both of those are versioned uniquely.

We tag git commits with version numbers.

We provide release notes at https://github.com/actions-runner-controller/actions-runner-controller/tree/master/docs/releasenotes

N/A. There's no known vulnerability.

We provide a bug report form https://github.com/actions-runner-controller/actions-runner-controller/issues/new?assignees=&labels=bug&template=bug_report.yml&title=Bug

We're using GitHub Issues as the issue tracker

We acknowledge most of the bugs in a day or two

We respond most of the feature requests in a day or two

You can view old reports in GitHub Issues https://github.com/actions-runner-controller/actions-runner-controller/issues?q=is%3Aissue+is%3Aclosed+

https://github.com/actions-runner-controller/actions-runner-controller/blob/master/SECURITY.md

The reporter is encouraged to use e-mail for private communication as documented in https://github.com/actions-runner-controller/actions-runner-controller/blob/master/SECURITY.md#reporting-a-vulnerability

N/A, we've never had vulnerabilities yet

Non-trivial build file in repository: https://github.com/actions-runner-controller/actions-runner-controller/blob/master/Makefile.

Non-trivial build file in repository: https://github.com/actions-runner-controller/actions-runner-controller/blob/master/Makefile.

The project can be built by using Golang only, which is a FLOSS provided by Google.

We use GitHub Actions for CI and builds are automatically ran against every pull request submitted by the user. Also, there's a detailed instruction on how to run tests locally in our CONTRIBUTING.md https://github.com/actions-runner-controller/actions-runner-controller/blob/master/CONTRIBUTING.md#testing-controller-built-from-a-pull-request

The test suite can be run via go test, which is the standard way to run tests for Golang

We use GitHub Actions for CI.

Every new feature needs evidence (the test procedure and the testdata that is used to test the new feature locally and the expected result) for every new feature, as documented in https://github.com/actions-runner-controller/actions-runner-controller/blob/master/CONTRIBUTING.md#how-to-contribute-a-patch

We only include major features in our automated test suite due to financial reasons(some test requires a real server that costs hundreds dollars per month when run regularly so we only run tests that are possible within the free GitHub Actions environment).

We do test every new feature manually before each release though.

We use go vet

The maintainer addresses any warnings found by go vet

We run all the checks provided by go vet

The project's primary maintainer is Yusuke Kuoka (a.k.a @mumoshu) who has experience in managing secure production Kubernetes clusters for various industries including messaging and financial services, and developing and running various secure Kubernetes controllers written in Golang on those clusters.

The project "actions-runner-controller" is supposed to run in a Kubernetes cluster and written in Golang. The primary maintainer has production experience in both of those, and applies many security practices like correctly designed Kubernetes custom resources and RBAC onto the project.

Same as above.

We use GitHub release assets to publish hashes over https.

go vet

go vet provides a few rules to detect potential issues due to unsafe cgo usage or concurrency bugs. We don't use Go's unsafe features at all and concurrency bugs are expected to be discovered via our test suite. Also, we rely on K8s' validation to not accept invalid user inputs that may lead to vulnerabilities if handled inappropriately.

We address vulnerabilities according to our policy documented at https://github.com/actions-runner-controller/actions-runner-controller/blob/master/SECURITY.md

We do run static analysis on every change for a part of our project(helm chart)

We run gofuzz for dynamic analysis

We use Go and don't rely on CGO or unsafe features so it's memory-safe

We use go's race detector while running unit tests to detect some of issues covered by dynamic analysis