pulumi/3.142.0-r0: cve remediation

[octo-sts]

pulumi/3.142.0-r0: fix GHSA-q59j-vv4j-v33c

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/pulumi.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "Error: Failed to running update. Error: failed to run 'go mod tidy': exit status 1 with output: go: go.mod file not found in current directory or any parent directory"

• Error Category: Configuration/Build

• Failure Point: go/bump step in pipeline trying to run go mod tidy

• Root Cause Analysis: The go/bump step is failing because it can't find the go.mod file. This is because the modroot path specified in the YAML isn't correct relative to the working directory.

• Suggested Fix:
Update the go/bump step in the YAML to include the correct modroot path:

  - uses: go/bump
    with:
      deps: github.com/moby/[email protected]
      modroot: ./pulumi

• Explanation:
The git-checkout step clones the repository into a "pulumi" directory, but the go/bump step is looking for go.mod in the current directory. By explicitly setting modroot to "./pulumi", we point to the correct location of the go.mod file.

• Additional Notes:

• The go/bump action requires the go.mod file to be present in the specified modroot directory
• The path should be relative to the working directory where melange is running
• You can verify the correct path by checking the git-checkout step's destination parameter

• References:

• Melange documentation on go/bump action: https://github.com/chainguard-dev/melange/blob/main/docs/reference/actions.md#gobump
• Go modules reference: https://go.dev/ref/mod#go-mod-file