added security context

config/200-psp.yaml

@@ -13,7 +13,7 @@ spec:
   allowPrivilegeEscalation: false
   requiredDropCapabilities: ["ALL"]
   readOnlyRootFilesystem: true
-  volumes: ["secret"]
+  volumes: ["configMap", "secret"]
   hostNetwork: false
   hostIPC: false
   hostPID: false

config/deployment.yaml

@@ -20,8 +20,13 @@ spec:
       containers:
       - name: status-reporter
         image: git.giftfish.de/ston1th/status-reporter
+        imagePullPolicy: Always
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          capabilities:
+            drop: ["ALL"]
         resources:
           requests:
             cpu: 100m
             memory: 128Mi
-        imagePullPolicy: Always

main.go

@@ -89,6 +89,8 @@ type Status struct {
 type StatusCache struct {
 	sync.Mutex
 	cache map[string]Status
+
+	comment sync.Mutex
 }
 
 func NewStatusCache() *StatusCache {
@@ -219,6 +221,8 @@ func statusUpdate(obj interface{}, s *StatusCache, sec typedcorev1.SecretInterfa
 		log.Printf("skipped comment on issue %s for %s/%s", issue, pr.Namespace, pr.Name)
 		return
 	}
+	s.comment.Lock()
+	defer s.comment.Unlock()
 	err = postComment(pr, url, issue, secret)
 	if err != nil {
 		log.Printf("error posting comment for %s issue %s: %v", url, issue, err)
@@ -332,6 +336,51 @@ type Comment struct {
 	Body string `json:"body"`
 }
 
+func parseLink(link string) (next string, last string) {
+	if len(link) < 2 {
+		return
+	}
+	a := strings.Split(link, ", ")
+	for _, v := range a {
+		b := strings.Split(v, "; ")
+		if len(b) == 2 {
+			url := b[0][1 : len(b[0])-1]
+			switch b[1] {
+			case `rel="next"`:
+				next = url
+			case `rel="last"`:
+				last = url
+			}
+		}
+	}
+	return
+}
+
+func readComments(c *http.Client, url, user, pass, preview string) (found bool, next, last string, err error) {
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return
+	}
+	req.Header.Set(contentType, jsonType)
+	req.SetBasicAuth(user, pass)
+	resp, err := c.Do(req)
+	if err != nil {
+		return
+	}
+	defer resp.Body.Close()
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return
+	}
+	if resp.StatusCode != http.StatusOK {
+		err = fmt.Errorf("error reading comments: %s", url)
+		return
+	}
+	next, last = parseLink(resp.Header.Get("Link"))
+	found = bytes.Contains(body, []byte(preview))
+	return
+}
+
 func postComment(pr *PipelineRun, gitUrl, issue string, sec *corev1.Secret) error {
 	u, err := url.Parse(gitUrl)
 	if err != nil {
@@ -356,28 +405,27 @@ func postComment(pr *PipelineRun, gitUrl, issue string, sec *corev1.Secret) erro
 	if err != nil {
 		return err
 	}
-	req, err := http.NewRequest("GET", u.String(), nil)
-	if err != nil {
-		return err
-	}
-	req.Header.Set(contentType, jsonType)
-	req.SetBasicAuth(user, pass)
 	c := &http.Client{Transport: &http.Transport{
 		DialContext: (&net.Dialer{
 			Timeout: 30 * time.Second,
 		}).DialContext,
 	}}
-	resp, err := c.Do(req)
+	commentsUrl := u.String()
-	if err != nil {
+	for {
-		return err
+		found, next, last, err := readComments(c, commentsUrl, user, pass, preview)
-	}
+		if err != nil {
-	defer resp.Body.Close()
+			return err
-	body, err := ioutil.ReadAll(resp.Body)
+		}
-	if err != nil {
+		if found {
-		return err
+			return nil
-	}
+		}
-	if bytes.Contains(body, []byte(preview)) {
+		if next == "" {
-		return nil
+			break
+		}
+		if commentsUrl == last {
+			break
+		}
+		commentsUrl = next
 	}
 
 	comment := &Comment{preview}
@@ -386,7 +434,7 @@ func postComment(pr *PipelineRun, gitUrl, issue string, sec *corev1.Secret) erro
 	if err != nil {
 		return err
 	}
-	req, err = http.NewRequest("POST", u.String(), buf)
+	req, err := http.NewRequest("POST", u.String(), buf)
 	if err != nil {
 		return err
 	}