Update GitHub Actions (main)

.github/workflows/ci.yml

@@ -96,9 +96,9 @@ jobs:
             ~/go/pkg/mod
           key: ${{ runner.os }}-go-
       - name: Lint Go
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
         with:
-          version: v2.11.4
+          version: v2.12.2
           skip-cache: true
 
   vulnerability-scan:
@@ -143,7 +143,7 @@ jobs:
         - name: Run Unit Tests
           run: make unit-test
         - name: Uplaod Test Coverage
-          uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+          uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
           with:
             files: ./build/test/coverage.out
             token: ${{ secrets.CODECOV_TOKEN }}
@@ -500,7 +500,7 @@ jobs:
           path: build
 
       - name: Login to Docker Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.nginx-private-registry-url }}
           username: ${{ env.nginx-pkg-jwt }}
@@ -669,7 +669,7 @@ jobs:
           secrets-filter: 'docker,nginx-private-registry,nginx-pkg-jwt'
 
       - name: Login to Docker Registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ${{ env.nginx-private-registry-url }}
           username: ${{ env.nginx-pkg-jwt }}

.github/workflows/label-pr.yml

@@ -14,6 +14,6 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-24.04
     steps:
-      - uses: release-drafter/release-drafter/autolabeler@563bf132657a13ded0b01fcb723c5a58cdd824e2 # v7.2.1
+      - uses: release-drafter/release-drafter/autolabeler@693d20e7c1ce1a81d3a41962f85914253b518449 # v7.3.1
         env:
           GITHUB_TOKEN: ${{ github.token }}

internal/collector/nginxreceiver/internal/scraper/accesslog/operator/input/file/grok.go

@@ -62,7 +62,8 @@ func NewCompiledGrok(logFormat string, logger *zap.Logger) (*grok.CompiledGrok,
 
 	g, err := grok.New(grok.Config{
 		NamedCapturesOnly: false,
-		Patterns:          map[string]string{"DEFAULT": grokPattern},
+		//nolint:goconst // value is local to this function
+		Patterns: map[string]string{"DEFAULT": grokPattern},
 	})
 	if err != nil {
 		return nil, err

internal/collector/otel_collector_plugin.go

@@ -48,6 +48,7 @@ const (
 		`date(timestamp).UTC(); utcTime.Format("Jan  2 15:04:05")) : date(timestamp).Format("Jan 02 15:04:05"); ` +
 		`split(body, ">")[0] + ">" + newTimestamp + " " + split(body, " ", 2)[1])'`
 	debugOTelConfigFile = "/opentelemetry-collector-agent-debug.yaml"
+	insertAction        = "insert"
 )
 
 type (
@@ -383,8 +384,8 @@ func (oc *Collector) updateResourceProcessor(resourceUpdateContext *v1.Resource)
 		resourceProcessorUpdated = oc.updateResourceAttributes(
 			[]config.ResourceAttribute{
 				{
-					Key:    "resource.id",
-					Action: "insert",
+					Key:    "resource.id", //nolint:goconst // value is local to this function
+					Action: insertAction,
 					Value:  resourceUpdateContext.GetResourceId(),
 				},
 			},
@@ -404,7 +405,7 @@ func (oc *Collector) updateHeadersSetterExtension(
 		oc.config.Collector.Extensions.HeadersSetter.Headers != nil {
 		isUUIDHeaderSet := false
 		for _, header := range oc.config.Collector.Extensions.HeadersSetter.Headers {
-			if header.Key == "uuid" {
+			if header.Key == "uuid" { //nolint:goconst // value is local to this function
 				isUUIDHeaderSet = true
 				break
 			}
@@ -418,7 +419,7 @@ func (oc *Collector) updateHeadersSetterExtension(
 			oc.config.Collector.Extensions.HeadersSetter.Headers = append(
 				oc.config.Collector.Extensions.HeadersSetter.Headers,
 				config.Header{
-					Action: "insert",
+					Action: insertAction,
 					Key:    "uuid",
 					Value:  resourceUpdateContext.GetResourceId(),
 				},
@@ -465,7 +466,7 @@ func (oc *Collector) restartCollector(ctx context.Context) {
 
 	settings := OTelCollectorSettings(oc.config)
 
-	if strings.ToLower(oc.config.Log.Level) == "debug" {
+	if strings.ToLower(oc.config.Log.Level) == "debug" { //nolint:goconst // value is local to this function
 		writeErr := oc.writeRunningConfig(ctx, settings)
 		if writeErr != nil {
 			slog.ErrorContext(ctx, "Failed to write debug OTel Collector config", "error", writeErr)
@@ -643,6 +644,7 @@ func (oc *Collector) updateExistingNginxOSSReceiver(
 	return nginxReceiverFound, reloadCollector
 }
 
+//nolint:goconst // keeping map raw values to avoid overengineering
 func (oc *Collector) updateNginxAppProtectTcplogReceivers(
 	ctx context.Context, nginxConfigContext *model.NginxConfigContext,
 ) bool {
@@ -900,7 +902,7 @@ func normaliseAddress(address string) string {
 		return address
 	}
 
-	if host == "localhost" {
+	if host == "localhost" { //nolint:goconst // value is local to this function
 		host = "127.0.0.1"
 	}
 

internal/collector/settings.go

@@ -107,7 +107,7 @@ func writeCollectorConfig(conf *config.Collector) error {
 
 	for _, pipeline := range conf.Pipelines.Metrics {
 		if i := slices.Index(pipeline.Exporters, "otlp/default"); i != -1 {
-			pipeline.Exporters[i] = "otlp_grpc/default"
+			pipeline.Exporters[i] = "otlp_grpc/default" //nolint:goconst // value is local to this function
 		}
 	}
 

internal/collector/settings_test.go

@@ -196,7 +196,8 @@ func TestTemplateWrite(t *testing.T) {
 			"otlp/default", "nginx", "nginxplus/456", "nginxplus/789",
 		},
 		Processors: []string{"resource/default", "batch/default"},
-		Exporters:  []string{"otlp_grpc/default", "prometheus", "debug"},
+		//nolint:goconst // test clarity is better with explicit literals
+		Exporters: []string{"otlp_grpc/default", "prometheus", "debug"},
 	}
 	cfg.Collector.Pipelines.Logs = make(map[string]*config.Pipeline)
 	cfg.Collector.Pipelines.Logs["default"] = &config.Pipeline{

internal/config/command.go

@@ -14,7 +14,7 @@ import (
 
 var RootCommand = &cobra.Command{
 	Use:   "nginx-agent [flags]",
-	Short: "nginx-agent",
+	Short: "nginx-agent", //nolint:goconst // keeping raw values here makes it cleaner
 }
 
 var CompletionCommand = &cobra.Command{

internal/config/config.go

@@ -43,6 +43,8 @@ const (
 	DefaultLogsBatchProcessor    = "default_logs"
 	DefaultExporter              = "default"
 	DefaultPipeline              = "default"
+	DefaultOtlpGrpc              = "otlp_grpc/default"
+	InsertAction                 = "insert"
 
 	// Regular expression to match invalid characters in paths.
 	// It matches whitespace, control characters, non-printable characters, and specific Unicode characters.
@@ -218,7 +220,7 @@ func addDefaultPipelines(collector *Collector) {
 		collector.Pipelines.Metrics[DefaultPipeline] = &Pipeline{
 			Receivers:  []string{"host_metrics", "nginx_metrics"},
 			Processors: []string{"batch/default_metrics"},
-			Exporters:  []string{"otlp_grpc/default"},
+			Exporters:  []string{DefaultOtlpGrpc},
 		}
 	}
 
@@ -229,7 +231,7 @@ func addDefaultPipelines(collector *Collector) {
 		collector.Pipelines.Logs[DefaultPipeline] = &Pipeline{
 			Receivers:  []string{"tcplog/nginx_app_protect"},
 			Processors: []string{"securityviolationsfilter/default", "batch/default_logs"},
-			Exporters:  []string{"otlp_grpc/default"},
+			Exporters:  []string{DefaultOtlpGrpc},
 		}
 	}
 }
@@ -282,7 +284,7 @@ func extractTokenFromAuth(auth *AuthConfig) string {
 func addAuthHeader(collector *Collector, token string) {
 	header := []Header{
 		{
-			Action: "insert",
+			Action: InsertAction,
 			Key:    "authorization",
 			Value:  token,
 		},
@@ -358,7 +360,7 @@ func addDefaultContainerHostMetricsReceiver(collector *Collector) {
 	if collector.Log == nil {
 		collector.Log = &Log{
 			Path:  "stdout",
-			Level: "info",
+			Level: "info", //nolint:goconst // value is local to this function
 		}
 	}
 }
@@ -386,7 +388,7 @@ func AddLabelsAsOTelHeaders(collector *Collector, labels map[string]any) {
 			valueString, ok := value.(string)
 			if ok {
 				collector.Extensions.HeadersSetter.Headers = append(collector.Extensions.HeadersSetter.Headers, Header{
-					Action: "insert",
+					Action: InsertAction,
 					Key:    key,
 					Value:  valueString,
 				})
@@ -1012,7 +1014,7 @@ func normalizeFunc(f *flag.FlagSet, name string) flag.NormalizedName {
 
 func resolveLog() *Log {
 	logLevel := strings.ToLower(viperInstance.GetString(LogLevelKey))
-	validLevels := []string{"debug", "info", "warn", "error"}
+	validLevels := []string{"debug", "info", "warn", "error"} //nolint:goconst // value is local to this function
 
 	if !slices.Contains(validLevels, logLevel) {
 		slog.Warn("Invalid log level set, defaulting to 'info'", "log_level", logLevel)

internal/config/defaults.go

@@ -133,6 +133,7 @@ func DefaultFeatures() []string {
 	}
 }
 
+//nolint:goconst // path values are local to this function
 func DefaultAllowedDirectories() []string {
 	return []string{
 		"/etc/nginx",

internal/config/mapper.go

@@ -148,6 +148,7 @@ func ToAgentConfigLogProto(log *Log) *mpi.Log {
 	}
 }
 
+//nolint:goconst // extracting log levels constant here would be overengineering
 func MapConfigLogLevelToSlogLevel(level mpi.Log_LogLevel) string {
 	slogLevel := "INFO"
 

internal/nginx/nginx_plugin.go

@@ -92,7 +92,7 @@ func (n *NginxPlugin) Close(ctx context.Context) error {
 }
 
 func (n *NginxPlugin) Info() *bus.Info {
-	name := "nginx"
+	name := "nginx" //nolint:goconst // value is local to this function
 	if n.serverType.String() == model.Auxiliary.String() {
 		name = "auxiliary-nginx"
 	}
@@ -442,7 +442,8 @@ func (n *NginxPlugin) handleConfigApplyRequest(ctx context.Context, msg *bus.Mes
 			rollbackResponse := response.CreateDataPlaneResponse(
 				correlationID,
 				&mpi.CommandResponse{
-					Status:  mpi.CommandResponse_COMMAND_STATUS_FAILURE,
+					Status: mpi.CommandResponse_COMMAND_STATUS_FAILURE,
+					//nolint:goconst // keep raw value to avoid overengeneering
 					Message: "Config apply failed, rollback failed",
 					Error:   combinedErr.Error(),
 				},

pkg/host/info.go

@@ -358,7 +358,7 @@ func readOsRelease(path string) (map[string]string, error) {
 }
 
 func parseOsReleaseFile(reader io.Reader) (map[string]string, error) {
-	osReleaseInfoMap := map[string]string{"NAME": "unix"}
+	osReleaseInfoMap := map[string]string{name: "unix"}
 	scanner := bufio.NewScanner(reader)
 	for scanner.Scan() {
 		line := strings.TrimSpace(scanner.Text())

pkg/tls/self_signed_cert.go

@@ -56,7 +56,7 @@ func GenerateCertificate(req *CertReq) (*x509.Certificate, []byte, error) {
 	if parseCertErr != nil {
 		return &x509.Certificate{}, []byte{}, fmt.Errorf("error parsing certificate: %w", parseCertErr)
 	}
-
+	//nolint:goconst // extracting a constant here would be overengineering
 	b := pem.Block{Type: "CERTIFICATE", Bytes: certBytes}
 	certPEM := pem.EncodeToMemory(&b)