ci: add govulncheck + backported cleanup

.github/workflows/static-analysis.yml

@@ -49,7 +49,8 @@ jobs:
         echo "GOPATH=$(go env GOPATH)" >> $GITHUB_ENV
         echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
 
-        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.54.2
+        go install golang.org/x/vuln/cmd/govulncheck@latest
+        curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.59.1
         sudo curl -sSfL https://github.com/mvdan/sh/releases/download/v3.7.0/shfmt_v3.7.0_linux_$(go env GOARCH) -o /usr/bin/shfmt
         sudo chmod +x /usr/bin/shfmt
         sudo DEBIAN_FRONTEND=noninteractive apt install -y expect
@@ -58,27 +59,23 @@ jobs:
       run: go mod download
 
     - name: "Static Analysis: Copyright"
-      if: steps.filter.outputs.static-analysis == 'true' || steps.filter.outputs.go == 'true'
       run: |
         STATIC_ANALYSIS_JOB=test_copyright make static-analysis
       shell: bash
 
     - name: "Static Analysis: Shell Check"
-      if: steps.filter.outputs.static-analysis == 'true' || steps.filter.outputs.sh == 'true'
       run: |
         STATIC_ANALYSIS_JOB=test_static_analysis_shell make static-analysis
       shell: bash
 
     - name: "Static Analysis: Go Check"
-      if: steps.filter.outputs.static-analysis == 'true' || steps.filter.outputs.go == 'true'
       run: |
         # Explicitly set GOROOT to avoid golangci-lint/issues/3107
         export "GOROOT=$(go env GOROOT)"
         STATIC_ANALYSIS_JOB=test_static_analysis_go make static-analysis
       shell: bash
 
     - name: "Static Analysis: Python Check"
-      if: steps.filter.outputs.static-analysis == 'true' || steps.filter.outputs.python == 'true'
       run: |
         STATIC_ANALYSIS_JOB=test_static_analysis_python make static-analysis
       shell: bash

acceptancetests/jujupy/client.py

@@ -1868,7 +1868,7 @@ def backup(self):
             raise
         log.info('backup file {}'.format(output))
         backup_file_pattern = re.compile(
-            '(juju-backup-[0-9-]+\.(t|tar.)gz)'.encode('ascii'))
+            '(juju-backup-[0-9-]+\\.(t|tar.)gz)'.encode('ascii'))
         match = backup_file_pattern.search(output)
         if match is None:
             raise Exception("The backup file was not found in output: %s" %
@@ -2273,7 +2273,7 @@ def handle_openstack(self, child, cloud):
             child.expect(self.REGION_ENDPOINT_PROMPT)
             child.sendline(values['endpoint'])
             match = child.expect([
-                u"Enter another region\? \([yY]/[nN]\):",
+                u"Enter another region\\? \\([yY]/[nN]\\):",
                 u"Can't validate endpoint"
             ])
             if match == 1:
@@ -2285,7 +2285,7 @@ def handle_openstack(self, child, cloud):
 
     def handle_vsphere(self, child, cloud):
         match = child.expect([u"Enter a name for your .* cloud:",
-                              u'Enter the (vCenter address or URL|API endpoint url for the cloud \[\]):'])
+                              u'Enter the (vCenter address or URL|API endpoint url for the cloud \\[\\]):'])
         if match == 0:
             raise NameNotAccepted('Cloud name not accepted.')
         if match == 1:
@@ -2301,7 +2301,7 @@ def handle_vsphere(self, child, cloud):
                 raise InvalidEndpoint()
             child.sendline(name)
             child.expect(
-                u'Enter another (datacenter|region)\? \([yY]/[nN]\):')
+                u'Enter another (datacenter|region)\\? \\([yY]/[nN]\\):')
             if num + 1 < len(cloud['regions']):
                 child.sendline('y')
             else:
@@ -2410,7 +2410,7 @@ def register_user_interactively(client, token, controller_name):
         child.sendline(password)
         child.expect(u'Confirm password:')
         child.sendline(password)
-        child.expect(u'Enter a name for this controller( \[.*\])?:')
+        child.expect(u'Enter a name for this controller( \\[.*\\])?:')
         child.sendline(controller_name)
 
         def login_if_need(session):

acceptancetests/jujupy/tests/test_status.py

@@ -80,7 +80,7 @@ def test_to_exception_stuck_allocating(self):
                                      current='allocating', message='foo')
         with self.assertRaisesRegexp(
                 StuckAllocatingError,
-                "\('0', 'Stuck allocating.  Last message: foo'\)"):
+                "\\('0', 'Stuck allocating.  Last message: foo'\\)"):
             raise item.to_exception()
 
     def test_to_exception_allocating_unit(self):

acceptancetests/repository/trusty/haproxy/cm.py

@@ -32,7 +32,7 @@ def get_branch_config(config_file):
             line = line.split('#')[0].strip()
             bzr_match = re.match(r'(\S+)\s+'
                                  'lp:([^;]+)'
-                                 '(?:;revno=(\d+))?', line)
+                                 '(?:;revno=(\\d+))?', line)
             if bzr_match:
                 name, branch, revno = bzr_match.group(1, 2, 3)
                 if revno is None:
@@ -42,7 +42,7 @@ def get_branch_config(config_file):
                 branches[name] = (branch, revspec)
                 continue
             dir_match = re.match(r'(\S+)\s+'
-                                 '\(directory\)', line)
+                                 '\\(directory\\)', line)
             if dir_match:
                 name = dir_match.group(1)
                 branches[name] = None

acceptancetests/tests/test_jujucharm.py

@@ -118,7 +118,7 @@ def test_ensure_valid_name(self):
         self.assertIsNone(Charm.NAME_REGEX.match(charm.metadata['name']))
         self.assertRaisesRegexp(
             JujuAssertionError,
-            'Invalid Juju Charm Name, "BAD_NAME" does not match ".*"\.',
+            'Invalid Juju Charm Name, "BAD_NAME" does not match ".*"\\.',
             Charm, 'BAD_NAME', 'A charm with a checked bad name')
 
     def test_ensure_valid_name_anchoring(self):

scripts/find-bad-doc-comments.py

@@ -31,8 +31,8 @@ def find_go_files(root):
             yield path.join(directory, filename)
 
 DOC_COMMENT_PATT = '\n\n//.+\n(//.+\n)*func.+\n'
-FIRST_WORD_PATT = '// *(\w+)'
-FUNC_NAME_PATT = 'func(?: \([^)]+\))? (\S+)\('
+FIRST_WORD_PATT = '// *(\\w+)'
+FUNC_NAME_PATT = 'func(?: \\([^)]+\\))? (\\S+)\\('
 
 def extract_doc_comments(text):
     for match in re.finditer(DOC_COMMENT_PATT, text, re.MULTILINE):

scripts/leadershipclaimer/count-leadership.py

@@ -13,9 +13,9 @@ def main(args):
     p.add_argument("--tick", type=float, default=1.0,
             help="seconds between printing status ticks")
     opts = p.parse_args(args)
-    actionsRE = re.compile("\s*(?P<time>\d+\.\d\d\d)s\s+(?P<action>claimed|extended|lost|connected).*in (?P<duration>[0-9m.]+s)")
+    actionsRE = re.compile("\\s*(?P<time>\\d+\\.\\d\\d\\d)s\\s+(?P<action>claimed|extended|lost|connected).*in (?P<duration>[0-9m.]+s)")
     # We don't have minutes if we have 'ms', so match 'ms' first, we might have 'm' if we have 's', so put it before s.
-    durationRE = re.compile("((?P<milliseconds>\d+)ms)?((?P<minutes>\d+)m)?((?P<seconds>\d+(\.\d+)?)s)?")
+    durationRE = re.compile("((?P<milliseconds>\\d+)ms)?((?P<minutes>\\d+)m)?((?P<seconds>\\d+(\\.\\d+)?)s)?")
     totalClaims = 0
     extendedSum = 0
     extendedCount = 0

tests/README.md

@@ -58,7 +58,7 @@ sudo snap install expect
 The static analysis tests also require `golangci-lint`:
 
 ```
-go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.54.2
+go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.59.1
 ```
 
 To get started, it's best to quickly look at the help command from the runner.

tests/suites/static_analysis/lint_go.sh

@@ -1,7 +1,7 @@
 run_go() {
 	VER=$(golangci-lint --version | tr -s ' ' | cut -d ' ' -f 4 | cut -d '.' -f 1,2)
-	if [[ ${VER} != "1.54" ]] && [[ ${VER} != "v1.54" ]]; then
-		(echo >&2 -e '\nError: golangci-lint version does not match 1.54. Please upgrade/downgrade to the right version.')
+	if [[ ${VER} != "1.59" ]] && [[ ${VER} != "v1.59" ]]; then
+		(echo >&2 -e '\nError: golangci-lint version does not match 1.59. Please upgrade/downgrade to the right version.')
 		exit 1
 	fi
 	OUT=$(golangci-lint run -c .github/golangci-lint.config.yaml 2>&1)
@@ -27,6 +27,10 @@ run_go_tidy() {
 	fi
 }
 
+run_govulncheck() {
+	govulncheck "github.com/juju/juju/..."
+}
+
 test_static_analysis_go() {
 	if [ "$(skip 'test_static_analysis_go')" ]; then
 		echo "==> TEST SKIPPED: static go analysis"
@@ -40,5 +44,12 @@ test_static_analysis_go() {
 
 		run_linter "run_go"
 		run_linter "run_go_tidy"
+
+		# govulncheck static analysis
+		if which govulncheck >/dev/null 2>&1; then
+			run_linter "run_govulncheck"
+		else
+			echo "govulncheck not found, govulncheck static analysis disabled"
+		fi
 	)
 }