Vendor PromClick as a Digitalis.io distribution (attribution, CI, hardening)#1
Merged
Merged
Conversation
Add a schema Mode/Tables config so the proxy can serve metadata, series and queries over OpenTelemetry-style ClickHouse tables via UNION ALL, and fold scalar-only binary expressions to fix a nil-plan panic on expressions like 1+1. Security: chEscape now doubles backslashes before escaping single quotes so a trailing backslash in an unauthenticated request parameter (match[], label name) can no longer break out of a ClickHouse string literal and inject SQL. Signed-off-by: Sergio Rua <sergio.rua@digitalis.io>
Package the upstream Apache-2.0 PromClick project (github.com/PromClick/PromClick) as a Digitalis.io distribution while preserving original attribution: - Add NOTICE crediting the upstream authors and recording Digitalis modifications per Apache-2.0 section 4; add the Digitalis copyright line to LICENSE.md. - Brand the README (logo, attribution, contact) and repoint image/clone/helm refs to ghcr.io/digitalis-io and github.com/digitalis-io. - Add a container build workflow publishing multi-arch images to ghcr.io/digitalis-io/promclick (SHA-pinned actions, timeout, concurrency, manual dispatch); cross-compile in the Dockerfile instead of QEMU; add .dockerignore. - Add CHANGELOG.md (Keep a Changelog) and bump the Helm chart to 1.1.0 with Digitalis maintainer metadata. Signed-off-by: Sergio Rua <sergio.rua@digitalis.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Packages the upstream Apache-2.0 PromClick project as a Digitalis.io distribution, preserving the original owner's licence attribution, and adds container + Helm CI.
Licensing & attribution (Apache-2.0)
NOTICEcrediting the upstream PromClick Authors (Mateusz Darmetko/hinskii, Maciej Bekas, Pavel Kravtsov) and recording Digitalis modifications per §4.LICENSE.mdkeeps the original copyright and adds a Digitalis modifications line.Vendoring
quay.io/hinski/promclick→ghcr.io/digitalis-io/promclick(Helm values,docker-compose.yaml, README).oci://pull path →digitalis-ioorg.1.1.0withhome/sources/maintainersmetadata (upstream retained insources).CHANGELOG.md(Keep a Changelog).CI — build containers & charts
.github/workflows/build.yml: multi-arch (amd64/arm64) image build, publishes toghcr.io/digitalis-io/promclickonmain+v*tags, manual dispatch; PRs build without pushing. Actions SHA-pinned,timeout-minutes,concurrency, least-privilege perms.Dockerfilecross-compiles on the native platform (GOARCH=$TARGETARCH, CGO off) instead of QEMU — much faster arm64 builds. Added.dockerignore.validate.yml/release.ymlworkflows unchanged.Security fix (carried Go WIP)
chEscapenow doubles backslashes before escaping quotes, so a trailing backslash in an unauthenticated request parameter can no longer break out of a ClickHouse string literal.Review gates run
secrets-auditor(PASS — no new secrets),docs-quality-reviewer(logo URL fixed),devops(hardening applied),go-specialist(injection fix applied).Follow-ups (out of scope, not blocking)
charts/promclick-chart/values.yaml(secretRefs.clickhouse.password) should move to anexistingSecret.mode: otelrequires non-emptytables; drop unusedlabelOpparams intranslator/plan.go; de-duplicate OTel sanitisation betweenhandlersandtranslator.release.yml/validate.ymlactions (still@v3).github.com/PromClick/PromClick(builds fine; rename todigitalis-iois a separate large refactor).Testing
go testpasses for all pure-Go packages (eval,translator,config,proxy/config,proxy/clickhouse,proxy/server/handlers);helm lintpasses; workflow YAML validated.Assisted-by: Claude Code