Skip to content

ci: pin Vector 0.54.0 and remove repeat() compatibility guard #191

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
TerrifiedBug wants to merge 1 commit into from
Closed

ci: pin Vector 0.54.0 and remove repeat() compatibility guard #191

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,6 +61,12 @@ jobs:
- name: Type check
run: npx tsc --noEmit

- name: Install Vector 0.54.0
run: |
curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
| sudo tar -xz -C /usr/local/bin --strip-components=2 "vector-x86_64-unknown-linux-musl/bin/vector"
vector --version
Comment on lines +65 to +68
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps Bot Apr 27, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 No checksum verification on downloaded binary

The tarball is piped directly into sudo tar without verifying its SHA-256 digest against the published checksum. Vector publishes vector-0.54.0-SHA256SUMS alongside every release; if the GitHub CDN or a transparent proxy were to serve a corrupted artifact, the malformed binary would be silently installed and then executed as sudo. Consider verifying the digest before extraction.

Suggested change
run: |
curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
| sudo tar -xz -C /usr/local/bin --strip-components=2 "vector-x86_64-unknown-linux-musl/bin/vector"
vector --version
- name: Install Vector 0.54.0
run: |
curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
-o /tmp/vector.tar.gz
echo "$(curl -fsSL https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-SHA256SUMS | grep vector-0.54.0-x86_64-unknown-linux-musl.tar.gz | awk '{print $1}') /tmp/vector.tar.gz" | sha256sum -c -
sudo tar -xz -C /usr/local/bin --strip-components=2 -f /tmp/vector.tar.gz "vector-x86_64-unknown-linux-musl/bin/vector"
vector --version
Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 65-68

Comment:
**No checksum verification on downloaded binary**

The tarball is piped directly into `sudo tar` without verifying its SHA-256 digest against the published checksum. Vector publishes `vector-0.54.0-SHA256SUMS` alongside every release; if the GitHub CDN or a transparent proxy were to serve a corrupted artifact, the malformed binary would be silently installed and then executed as `sudo`. Consider verifying the digest before extraction.

```suggestion
      - name: Install Vector 0.54.0
        run: |
          curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
            -o /tmp/vector.tar.gz
          echo "$(curl -fsSL https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-SHA256SUMS | grep vector-0.54.0-x86_64-unknown-linux-musl.tar.gz | awk '{print $1}')  /tmp/vector.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin --strip-components=2 -f /tmp/vector.tar.gz "vector-x86_64-unknown-linux-musl/bin/vector"
          vector --version
```

How can I resolve this? If you propose a fix, please make it concise.


- name: Test
run: pnpm test

Expand Down
53 changes: 7 additions & 46 deletions src/server/services/__tests__/dlp-vrl-integration.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,32 +18,6 @@ async function vectorAvailable(): Promise<boolean> {
}
}

/**
* Check whether the installed Vector binary supports the VRL `repeat()` function.
* `repeat()` was added after Vector 0.54; older binaries emit "call to undefined function".
* TODO: Remove this guard once CI is pinned to a Vector release that includes repeat().
*/
async function vectorSupportsRepeat(): Promise<boolean> {
const tmpDir = await mkdtemp(join(tmpdir(), "dlp-test-cap-"));
const programPath = join(tmpDir, "program.vrl");
const inputPath = join(tmpDir, "input.json");
try {
await writeFile(programPath, '. = { "r": repeat("*", 3) }');
await writeFile(inputPath, "{}");
await execFileAsync(
"vector",
["vrl", "--input", inputPath, "--program", programPath, "--print-object"],
{ timeout: 5000, env: { ...process.env, VECTOR_LOG: "error" } }
);
return true;
} catch {
return false;
} finally {
await unlink(programPath).catch(() => {});
await unlink(inputPath).catch(() => {});
}
}

async function runVrl(
source: string,
input: Record<string, unknown>
Expand All @@ -69,35 +43,22 @@ async function runVrl(
}
}

// Templates whose VRL source uses functions not available in all Vector versions.
// repeat() is not present in Vector <=0.54; skip those fixtures until CI is updated.
const REQUIRES_REPEAT = new Set(["dlp-credit-card-masking"]);

describe("DLP VRL integration tests", async () => {
const hasVector = await vectorAvailable();
const hasRepeat = hasVector && (await vectorSupportsRepeat());

describe.skipIf(!hasVector)("execute VRL templates against fixtures", () => {
for (const template of ALL_DLP_TEMPLATES) {
// Skip custom regex — it requires user-configured pattern
if (template.id === "dlp-custom-regex-masking") continue;

const needsRepeat = REQUIRES_REPEAT.has(template.id);

describe.skipIf(needsRepeat && !hasRepeat)(
// Append a note when skipped so the reason is visible in test output
needsRepeat && !hasRepeat
? `${template.name} [skipped: Vector repeat() not available]`
: template.name,
() => {
for (const fixture of template.testFixtures) {
it(fixture.description, async () => {
const result = await runVrl(template.vrlSource, fixture.input);
expect(result).toEqual(fixture.expectedOutput);
});
}
describe(template.name, () => {
for (const fixture of template.testFixtures) {
it(fixture.description, async () => {
const result = await runVrl(template.vrlSource, fixture.input);
expect(result).toEqual(fixture.expectedOutput);
});
}
);
});
}
});
});
Loading