opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-10-16 14:48:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

chore: bump github.com/coder/boundary to v0.11.0 (#30083)

Browse Source 
Bumps `github.com/coder/boundary` from v0.10.0 to
[v0.11.0](https://github.com/coder/boundary/releases/tag/v0.11.0). No
transitive dependency changes.

boundary v0.11.0 wraps the `--session-id-inject-target` format and
example in backticks, so:

- The `coder agent-firewall` help golden and
`docs/reference/cli/agent-firewall.md` are regenerated.
- The temporary `<host>`/`<glob>` entry for that page in
`scripts/docshtmlcheck`'s `allowedUnknownTags` is now stale (the
linter's self-clearing guard fails on it), so it is removed. The
allowlist is now passed into `filterAllowed`/`reportFindings` so the
tests use their own fixture instead of depending on the real, now-empty
map.

> Generated by Coder Agents on behalf of @SasSwart.
This commit is contained in:
Sas Swart
2026-09-29 17:00:27 +02:00
committed by GitHub
parent b83504b350
commit bcb981b839
7 changed files with 36 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/cli/agent-firewall.md
Generated
+1 -1
View File
@@ -169,4 +169,4 @@ Enable session correlation header injection. When no inject targets are configur
| Type | <code>string</code> |
| Environment | <code>$BOUNDARY_SESSION_ID_INJECT_TARGET</code> |
Inject target for session correlation headers. Repeat the flag once per target; each value describes exactly one target. Format: "domain=<host> [path=<glob>]". Example: --session-id-inject-target "domain=prod.coder.com path=/api/v2/aibridge/*".
Inject target for session correlation headers. Repeat the flag once per target; each value describes exactly one target. Format: `domain=<host> [path=<glob>]`. Example: `--session-id-inject-target "domain=prod.coder.com path=/api/v2/aibridge/*"`.
enterprise/cli/testdata/coder_agent-firewall_--help.golden
Vendored
+2 -2
View File
@@ -59,8 +59,8 @@ OPTIONS:
--session-id-inject-target string, $BOUNDARY_SESSION_ID_INJECT_TARGET
Inject target for session correlation headers. Repeat the flag once
per target; each value describes exactly one target. Format:
"domain=<host> [path=<glob>]". Example: --session-id-inject-target
"domain=prod.coder.com path=/api/v2/aibridge/*".
`domain=<host> [path=<glob>]`. Example: `--session-id-inject-target
"domain=prod.coder.com path=/api/v2/aibridge/*"`.
string-array
Inject targets from config file (YAML only).
go.mod
+1 -1
View File
@@ -539,7 +539,7 @@ require (
github.com/brianvoe/gofakeit/v7 v7.17.0
github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
github.com/coder/aisdk-go v0.0.9
github.com/coder/boundary v0.10.0
github.com/coder/boundary v0.11.0
github.com/coder/preview v1.0.10-0.20260915135839-c0dfdeecbd89
github.com/coder/safedial v0.2.0
github.com/danieljoos/wincred v1.2.3
go.sum
+2 -2
View File
@@ -327,8 +327,8 @@ github.com/coder/aisdk-go v0.0.9 h1:Vzo/k2qwVGLTR10ESDeP2Ecek1SdPfZlEjtTfMveiVo=
github.com/coder/aisdk-go v0.0.9/go.mod h1:KF6/Vkono0FJJOtWtveh5j7yfNrSctVTpwgweYWSp5M=
github.com/coder/anthropic-sdk-go v0.0.0-20260428122333-47cab198e449 h1:X4XOtomDcJlr5/bmgcnrZiJeZIS+qixzVn1EWqgCZ4E=
github.com/coder/anthropic-sdk-go v0.0.0-20260428122333-47cab198e449/go.mod h1:hqlYqR7uPKOKfnNeicUbZp0Ps0GeYFlKYtwh5HGDCx8=
github.com/coder/boundary v0.10.0 h1:qX8iGKpAx5jm4wdbhYfLQLvNMiq16pkZiOjLLBklI+Q=
github.com/coder/boundary v0.10.0/go.mod h1:dDILpof96k+ixVbVDRA2ez+zmj+n0ZhJPSiidB6rtrw=
github.com/coder/boundary v0.11.0 h1:mEtteSCUPTGipzR7pXSOGPHYULS/PVt7nDGS2F5QX0c=
github.com/coder/boundary v0.11.0/go.mod h1:dDILpof96k+ixVbVDRA2ez+zmj+n0ZhJPSiidB6rtrw=
github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41 h1:SBN/DA63+ZHwuWwPHPYoCZ/KLAjHv5g4h2MS4f2/MTI=
github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41/go.mod h1:I9ULxr64UaOSUv7hcb3nX4kowodJCVS7vt7VVJk/kW4=
github.com/coder/clistat v1.2.1 h1:P9/10njXMyj5cWzIU5wkRsSy5LVQH49+tcGMsAgWX0w=
scripts/docshtmlcheck/README.md
+1 -3
View File
@@ -61,9 +61,7 @@ $ go run ./scripts/docshtmlcheck path/to/file.md path/to/dir
`allowedUnknownTags` in `main.go` is a deliberately narrow, per-file escape
hatch for placeholders whose source is outside this repository (so they cannot
be fixed by a source edit here). It currently holds a temporary entry for
`docs/reference/cli/agent-firewall.md` (`<host>`/`<glob>`, generated from the
external `github.com/coder/boundary` CLI help).
be fixed by a source edit here). It is currently empty.
The escape hatch is **self-clearing**: if an allowlisted tag no longer appears
in its file (for example once the upstream fix and dependency bump land and the
scripts/docshtmlcheck/main.go
+13 -21
View File
@@ -151,15 +151,8 @@ var optionalEndTags = map[string]bool{
// file is deleted outright is never rescanned and lingers as harmless dead
// config (a missing file yields no findings, so nothing hides behind it).
//
// Temporary: docs/reference/cli/agent-firewall.md renders <host> and <glob>
// from the --session-id-inject-target help text, which is defined in the
// external github.com/coder/boundary CLI, not in this repo. The stale-entry
// guard removes the need to track removal by hand: once the upstream fix and
// dependency bump land and the generated page no longer contains the bare
// placeholders, the build fails until this entry is deleted.
var allowedUnknownTags = map[string]map[string]bool{
"docs/reference/cli/agent-firewall.md": {"host": true, "glob": true},
}
// Keys are canonical file paths; values are the set of allowed tag names.
var allowedUnknownTags = map[string]map[string]bool{}
// docshtmlcheckSource is where allowlist-maintenance findings are reported: the
// fix for a stale entry lives in this file's allowedUnknownTags, not in the
@@ -210,7 +203,7 @@ func run(roots []string, stdout, stderr io.Writer) int {
_, _ = fmt.Fprintf(stderr, "docshtmlcheck: %v\n", err)
return 2
}
h, s := reportFindings(path, filterAllowed(path, checkSource(src)), stdout)
h, s := reportFindings(path, filterAllowed(path, checkSource(src), allowedUnknownTags), allowedUnknownTags, stdout)
htmlIssues += h
staleIssues += s
}
@@ -239,10 +232,9 @@ func run(roots []string, stdout, stderr io.Writer) int {
// author at the generator source instead of the throwaway output.
//
// The allowlist skip is file-scoped: a genuinely new invalid tag on an
// allowlisted generated page (for example a future boundary bump emitting
// <Foo> in agent-firewall.md) is still reported, but without the
// generator-source hint. That is acceptable for the single external page.
func reportFindings(path string, findings []finding, out io.Writer) (htmlIssues, staleIssues int) {
// allowlisted generated page is still reported, but without the
// generator-source hint, because that page's source is external.
func reportFindings(path string, findings []finding, allowlist map[string]map[string]bool, out io.Writer) (htmlIssues, staleIssues int) {
realFinding := false
for _, f := range findings {
loc := path
@@ -263,7 +255,7 @@ func reportFindings(path string, findings []finding, out io.Writer) (htmlIssues,
realFinding = true
}
}
if realFinding && isGeneratedDoc(path) && allowedUnknownTags[canonicalPath(path)] == nil {
if realFinding && isGeneratedDoc(path) && allowlist[canonicalPath(path)] == nil {
_, _ = fmt.Fprintf(out, "%s: note: this page is generated by `make gen`; fix the source "+
"(codersdk/*.go doc comments, CLI --help text, or swagger annotations) and "+
"regenerate; edits to this file will not persist\n", path)
@@ -326,12 +318,12 @@ func isGeneratedDoc(path string) bool {
return strings.HasPrefix(canonicalPath(path), "docs/reference/")
}
// filterAllowed drops unknown-element findings suppressed by allowedUnknownTags
// for the file. It also reports any allowlist entry that suppressed nothing, so
// a stale escape hatch fails the build instead of silently masking a future
// regression of the same tag on that page.
func filterAllowed(path string, findings []finding) []finding {
allowed := allowedUnknownTags[canonicalPath(path)]
// filterAllowed drops unknown-element findings suppressed by allowlist (see
// allowedUnknownTags) for the file. It also reports any allowlist entry that
// suppressed nothing, so a stale escape hatch fails the build instead of
// silently masking a future regression of the same tag on that page.
func filterAllowed(path string, findings []finding, allowlist map[string]map[string]bool) []finding {
allowed := allowlist[canonicalPath(path)]
if allowed == nil {
return findings
}
scripts/docshtmlcheck/main_test.go
+16 -11
View File
@@ -277,24 +277,29 @@ func TestIsGeneratedDoc(t *testing.T) {
}
}
// testAllowlist stands in for allowedUnknownTags so these tests do not depend
// on which pages the real allowlist currently holds.
var testAllowlist = map[string]map[string]bool{
"docs/reference/cli/external.md": {"host": true, "glob": true},
}
func TestFilterAllowed(t *testing.T) {
t.Parallel()
// agent-firewall's <host>/<glob> come from an external dependency and are
// suppressed on that specific path only.
// Allowlisted tags are suppressed on that specific path only.
src := "Format: \"domain=<host> [path=<glob>]\".\n"
raw := checkSource([]byte(src))
if len(raw) != 2 {
t.Fatalf("expected 2 raw findings, got %d: %+v", len(raw), raw)
}
filtered := filterAllowed("docs/reference/cli/agent-firewall.md", checkSource([]byte(src)))
filtered := filterAllowed("docs/reference/cli/external.md", checkSource([]byte(src)), testAllowlist)
if len(filtered) != 0 {
t.Fatalf("expected agent-firewall host/glob to be suppressed, got %+v", filtered)
t.Fatalf("expected allowlisted host/glob to be suppressed, got %+v", filtered)
}
// The same tokens are NOT suppressed on any other path.
other := filterAllowed("docs/reference/cli/other.md", checkSource([]byte(src)))
other := filterAllowed("docs/reference/cli/other.md", checkSource([]byte(src)), testAllowlist)
if len(other) != 2 {
t.Fatalf("expected 2 findings on non-allowlisted path, got %d: %+v", len(other), other)
}
@@ -308,7 +313,7 @@ func TestFilterAllowedStaleEntry(t *testing.T) {
// Only <host> remains; the <glob> allowlist entry now suppresses nothing.
src := "Format: \"domain=<host>\".\n"
got := filterAllowed("docs/reference/cli/agent-firewall.md", checkSource([]byte(src)))
got := filterAllowed("docs/reference/cli/external.md", checkSource([]byte(src)), testAllowlist)
if len(got) != 1 {
t.Fatalf("want exactly 1 stale finding, got %d: %+v", len(got), got)
}
@@ -378,9 +383,9 @@ func TestReportFindings(t *testing.T) {
// An allowlisted external page is generated, but its placeholders
// come from an external CLI, so the generator-source note is skipped.
name: "allowlisted external page omits the generator note",
path: "docs/reference/cli/agent-firewall.md",
path: "docs/reference/cli/external.md",
findings: []finding{{line: 5, kind: kindUnknownElement, tag: "foo", msg: "swallowed"}},
wantContains: []string{"docs/reference/cli/agent-firewall.md:5: unknown-element: swallowed"},
wantContains: []string{"docs/reference/cli/external.md:5: unknown-element: swallowed"},
wantAbsent: []string{"generated by `make gen`"},
wantHTML: 1,
},
@@ -395,10 +400,10 @@ func TestReportFindings(t *testing.T) {
// A stale-allowlist finding is reported against the linter source
// with no line, counts as stale (not HTML), and never draws the note.
name: "stale entry reports against the linter source",
path: "docs/reference/cli/agent-firewall.md",
path: "docs/reference/cli/external.md",
findings: []finding{{kind: kindStaleAllowlist, tag: "glob", msg: "remove it from allowedUnknownTags"}},
wantContains: []string{docshtmlcheckSource + ": stale-allowlist-entry: remove it from allowedUnknownTags"},
wantAbsent: []string{"generated by `make gen`", "agent-firewall.md:"},
wantAbsent: []string{"generated by `make gen`", "external.md:"},
wantStale: 1,
},
}
@@ -407,7 +412,7 @@ func TestReportFindings(t *testing.T) {
t.Run(tc.name, func(t *testing.T) {
t.Parallel()
var out strings.Builder
html, stale := reportFindings(tc.path, tc.findings, &out)
html, stale := reportFindings(tc.path, tc.findings, testAllowlist, &out)
got := out.String()
for _, want := range tc.wantContains {
if !strings.Contains(got, want) {