Skip to content

Block private and loopback dials in webhook HTTP client #12536

Block private and loopback dials in webhook HTTP client

Block private and loopback dials in webhook HTTP client #12536

Triggered via pull request May 29, 2026 11:11
Status Success
Total duration 15m 56s
Artifacts 13

run-on-pr.yml

on: pull_request
Matrix: Tests / test-go-code
Linting  /  Lint Go Code
1m 20s
Linting / Lint Go Code
Codegen  /  Verify Code Generation
1m 3s
Codegen / Verify Code Generation
Docs  /  Verify Swagger Documentation
2m 28s
Docs / Verify Swagger Documentation
Spellcheck  /  Codespell
16s
Spellcheck / Codespell
License Headers  /  Check License Headers
18s
License Headers / Check License Headers
Security Scan  /  Grype Repository Scan
1m 4s
Security Scan / Grype Repository Scan
Security Scan  /  Go Vulnerability Check
1m 27s
Security Scan / Go Vulnerability Check
Helm Charts  /  Lint and Test Helm Charts
4m 56s
Helm Charts / Lint and Test Helm Charts
Build Skills  /  Build and Publish Skills
2m 17s
Build Skills / Build and Publish Skills
E2E Tests  /  Build ToolHive Binary
2m 7s
E2E Tests / Build ToolHive Binary
Operator CI  /  Operator Tests
2m 18s
Operator CI / Operator Tests
Operator CI  /  Operator Tests Integration
3m 58s
Operator CI / Operator Tests Integration
Operator CI  /  Build Operator
1m 21s
Operator CI / Build Operator
Operator CI  /  Generate CRDs
42s
Operator CI / Generate CRDs
Operator CI  /  Generate CRD Docs
44s
Operator CI / Generate CRD Docs
Matrix: Operator CI / E2E Tests Operator
Matrix: E2E Tests / e2e-tests-core
Fit to window
Zoom out
Zoom in

Annotations

17 warnings and 3 notices
Codegen / Verify Code Generation
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Security Scan / Grype Repository Scan
Failed minimum severity level. Found vulnerabilities with level 'medium' or higher
Security Scan / Go Vulnerability Check
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/setup-go@v5.0.0. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Security Scan / Go Vulnerability Check
Failed to save: <h2>Our services aren't available right now</h2><p>We're working to restore all services as soon as possible. Please check back soon.</p>0w3QZagAAAADG0fCYi3M6SIFLRdRJVEqvUEhYMzFFREdFMDYyMQBFZGdl
Security Scan / Go Vulnerability Check
Failed to restore: Cache service responded with 400
Helm Charts / Lint and Test Helm Charts
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2, azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Helm Charts / Lint and Test Helm Charts
No file matched to [/home/runner/work/toolhive/toolhive/**/*requirements*.txt,/home/runner/work/toolhive/toolhive/**/*requirements*.in,/home/runner/work/toolhive/toolhive/**/*constraints*.txt,/home/runner/work/toolhive/toolhive/**/*constraints*.in,/home/runner/work/toolhive/toolhive/**/pyproject.toml,/home/runner/work/toolhive/toolhive/**/uv.lock,/home/runner/work/toolhive/toolhive/**/*.py.lock]. The cache will never get invalidated. Make sure you have checked out the target repository and configured the cache-dependency-glob input correctly.
Tests / Test Go Code (ubuntu-8cores-32gb)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea, arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / Generate CRDs
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / Generate CRD Docs
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / Build Operator
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
E2E Tests / Build ToolHive Binary
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / Operator Tests
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / Operator Tests Integration
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / E2E Tests Operator (kindest/node:v1.35.1)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2, azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / E2E Tests Operator (kindest/node:v1.33.7)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2, azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Operator CI / E2E Tests Operator (kindest/node:v1.34.3)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: arduino/setup-task@v2, azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
e2e-test-results-api-clients Expired
14.3 KB
sha256:8f9a71c4a6198c69d67243eaad1139c32a2d5724492f1481200d5d6725bc40aa
e2e-test-results-api-misc Expired
17.5 KB
sha256:033b899f5724f282c30cca911ecddf021d7eef788fdf2edc4ed6632b8c57c4dd
e2e-test-results-api-registry Expired
21.6 KB
sha256:6b42222d97acc2057ee49a28307b466faf3198ba97d229b3b744ea84f2cbb372
e2e-test-results-api-workloads Expired
14.5 KB
sha256:665fd2df33d3b942d8847210434a2464c592cbf8c20e87cf006c60226a229e2e
e2e-test-results-api-workloads-lifecycle Expired
17.6 KB
sha256:9055291156e32bde3e1b18eb97e149e45a576f706cd9bf399b00d5c9c7f32c8b
e2e-test-results-core Expired
20.5 KB
sha256:6ccedf730d185933cb7c84b9510b9d8eb3123df726bfce72c893f281005cb132
e2e-test-results-llm Expired
18.2 KB
sha256:0eb1f2b2e43ed8c0f6c370e690f8dd0555ad7e2a15a10424edb6b076c3eb3cec
e2e-test-results-mcp-protocol Expired
29.4 KB
sha256:d03f4aa704c08e52ab58e36f9718354154e9f88a7b84e0fd2f5abf820f2c297c
e2e-test-results-mcp-run Expired
23.4 KB
sha256:3e99e97ac687bd3e579853cd180fb1ea199f5bf4bc58c5f21b41ef3f66da4f8b
e2e-test-results-middleware Expired
37.6 KB
sha256:51d893ae2ed9340ce4adeeda17ff6e2c8abcff13521cb0df01318300ffa71de5
e2e-test-results-proxy Expired
22.2 KB
sha256:1c069818c7c8bb37f738938539288ad2b34d901aadabcaa604802a2fd3361093
e2e-test-results-vmcp Expired
22.9 KB
sha256:5a8c4662904a4758d01556e12ae098d5dbecc138ae0cecb194ad6d0e085711ed
toolhive-binary Expired
36 MB
sha256:8fc969be2d6a01d8dea3e120c96407db49bd13c5d214506c83d5100d686c6b8a