Merge branch 'main' into wb/guard-release-version

Author: marcleblanc2

.github/workflows/diff-tour.yml

@@ -0,0 +1,27 @@
+# This GitHub Action imported from the shared action
+# https://github.com/sourcegraph/actions/blob/main/diff-tour/
+# Please make fixes / enhancements in the shared action,
+# so all of our repos get the benefits
+
+name: Diff Tour link
+
+on:
+  pull_request:
+    # `edited` fires when the base branch changes; `synchronize` does not
+    # `closed` fires on merge and on plain close; either way the comment is
+    # updated to a link that survives deleting the head branch
+    types: [closed, edited, opened, reopened, synchronize]
+
+# The only permission needed. The action does not check out your repo, so
+# `contents: read` is not required, even for private repos
+permissions:
+  pull-requests: write
+
+jobs:
+  diff-tour:
+    name: Comment
+    runs-on: ubuntu-latest
+    # Diff Tour resolves branch names against the base repo, so skip fork PRs
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    steps:
+      - uses: sourcegraph/actions/diff-tour@main

CHANGELOG.md

@@ -15,9 +15,20 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Changed
 
+- Updated Go to 1.26.10 and the Alpine `ca-certificates-bundle` in Docker images to 20261020-r0 to stop trusting the compromised eMudhra CAs ([CVE-2026-111943](https://emudhra.we-have-a-problem.com/)).
+- HTTP requests now fail instead of hanging forever if the server does not start responding within 1 minute. Set the `SRC_RESPONSE_HEADER_TIMEOUT` environment variable to change this timeout, or to `0` to disable it. Responses that stream data for a long time (for example, large search job results) are not affected.
+- `src search-jobs logs` and `src search-jobs results` now use the standard API client, gaining proxy support, `-insecure-skip-verify`, and cross-host redirect protection, and now report an error on non-200 responses instead of writing the error page into the output.
+- The command list in `src help` is now generated from the registered commands instead of being maintained by hand. `src debug`, `src snapshot`, and `src lsp` now appear in it; aliases are shown after each description.
+
+### Fixed
+
+- `src doc` now generates reference pages for the `search-jobs`, `debug`, and `snapshot` subcommands, and the root `index.md` again lists legacy commands (`batch`, `repos`, `search`, ...) alongside the `urfave/cli` ones.
+
 ### Removed
 
 - Removed `src sbom` and `src signature` commands. SBOMs and container signatures are no longer published as of Sourcegraph 7.1.0.
+- Removed the internal `src batch exec` command. Server-side Batch Changes execution now uses the `batch-exec` binary in the Sourcegraph repository.
+- Removed the `src teams` (`src team`) commands. Teams were removed in Sourcegraph 7.0 and the commands have refused to run against 7.x instances since src-cli 7.0.0.
 
 ## 6.7.1104
 
@@ -43,7 +54,7 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Added
 
-- SBOM support: Added `--image` and `--exclude-image` flags to `src sbom fetch` for filtering which docker images SBOMs are fetched for. Both flags support glob patterns (e.g., `frontend`, `*api*`) and comma-separated lists. The `sourcegraph/` image name prefix is optional.
+- SBOM support: Added `--image` and `--exclude-image` flags to `src sbom fetch` for filtering which Docker images SBOMs are fetched for. Both flags support glob patterns (e.g., `frontend`, `*api*`) and comma-separated lists. The `sourcegraph/` image name prefix is optional.
 
 ### Changed
 
@@ -85,7 +96,7 @@ All notable changes to `src-cli` are documented in this file.
 ## 5.10.0
 
 - cody gateway benchmark changes
-- fix local builds for non sourcegraph team [1121](https://github.com/sourcegraph/src-cli/pull/1121)
+- fix local builds for non Sourcegraph team [1121](https://github.com/sourcegraph/src-cli/pull/1121)
 
 ## 5.9.1
 
@@ -163,7 +174,7 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Fixed
 
-- The fork attribute in changesetTemplate is now acknowleged when creating a batch change via `src-cli`. [#58156](https://github.com/sourcegraph/sourcegraph/pull/58156)
+- The fork attribute in changesetTemplate is now acknowledged when creating a batch change via `src-cli`. [#58156](https://github.com/sourcegraph/sourcegraph/pull/58156)
 
 ## 5.2.0
 
@@ -179,7 +190,7 @@ All notable changes to `src-cli` are documented in this file.
 
 ### Fixed
 
-- The temporary docker volume created during workspace preparation is now cleaned up when failure occurs. [#1021](https://github.com/sourcegraph/src-cli/pull/1021).
+- The temporary Docker volume created during workspace preparation is now cleaned up when failure occurs. [#1021](https://github.com/sourcegraph/src-cli/pull/1021).
 
 ## 5.1.1
 
@@ -265,7 +276,7 @@ No noteworthy changes, mechanical release to match Sourcegraph release.
 
 ### Fixed
 
-- Fix network timeout in `src users clean` occuring in instances with many users [#901](https://github.com/sourcegraph/src-cli/pull/901)
+- Fix network timeout in `src users clean` occurring in instances with many users [#901](https://github.com/sourcegraph/src-cli/pull/901)
 - Aligned parsing of spec file parameter of `src batch repos` with other commands. [#919](https://github.com/sourcegraph/src-cli/pull/919)
 - Remove empty log outputs during batch spec execution. [#923](https://github.com/sourcegraph/src-cli/pull/923)
 
@@ -277,7 +288,7 @@ No noteworthy changes, mechanical release to match Sourcegraph release.
 
 ### Added
 
-- Batch Changes: Watchdog that checks for docker responsiveness while running commands has been added. [#898](https://github.com/sourcegraph/src-cli/pull/898)
+- Batch Changes: Watchdog that checks for Docker responsiveness while running commands has been added. [#898](https://github.com/sourcegraph/src-cli/pull/898)
 
 ## 4.2.1
 
@@ -306,7 +317,7 @@ No noteworthy changes, mechanical release to match Sourcegraph release.
 
 ### Changed
 
-- Improved output for failing docker pulls in batch change execution. [#880](https://github.com/sourcegraph/src-cli/pull/880)
+- Improved output for failing Docker pulls in batch change execution. [#880](https://github.com/sourcegraph/src-cli/pull/880)
 
 ## 4.1.0
 
@@ -793,7 +804,7 @@ Re-release of 3.29.3 for Sourcegraph 3.30.
 
 ### Fixed
 
-- When specifying `-skip-errors`, the batch spec would always be empty. This ix fixed and the intended behavior has been restored. [#539](https://github.com/sourcegraph/src-cli/pull/539)
+- When specifying `-skip-errors`, the batch spec would always be empty. This is fixed and the intended behavior has been restored. [#539](https://github.com/sourcegraph/src-cli/pull/539)
 
 ## 3.27.0
 
@@ -868,13 +879,13 @@ Re-release of 3.29.3 for Sourcegraph 3.30.
 
 ### Fixed
 
-- The homebrew recipe for `src-cli` contained the wrong binary name.
+- The Homebrew recipe for `src-cli` contained the wrong binary name.
 
 ## 3.24.6
 
 ### Fixed
 
-- Workspaces could sometimes fail with docker bind mount errors, due to a race condition of multiple workspaces accessing the same auxilliary files. [#468](https://github.com/sourcegraph/src-cli/pull/468)
+- Workspaces could sometimes fail with Docker bind mount errors, due to a race condition of multiple workspaces accessing the same auxiliary files. [#468](https://github.com/sourcegraph/src-cli/pull/468)
 
 ## 3.24.5
 
@@ -1150,7 +1161,7 @@ Re-release of 3.29.3 for Sourcegraph 3.30.
 
 - Add `--no-progress` flag to the `lsif upload` command to disable verbose output in non-TTY environments.
 - `SRC_HEADER_AUTHORIZATION="Bearer $(...)"` is now supported for authenticating `src` with custom auth proxies. See [auth proxy configuration docs](AUTH_PROXY.md) for more information. [#239](https://github.com/sourcegraph/src-cli/pull/239)
-- Pull missing docker images automatically. [#191](https://github.com/sourcegraph/src-cli/pull/191)
+- Pull missing Docker images automatically. [#191](https://github.com/sourcegraph/src-cli/pull/191)
 - Searches that result in errors will now display any alerts returned by Sourcegraph, including suggestions for how the search could be corrected. [#221](https://github.com/sourcegraph/src-cli/pull/221)
 
 ### Changed

DEVELOPMENT.md

@@ -62,7 +62,7 @@ For quick end-to-end CLI sanity checks against a live Sourcegraph instance, run:
 
 This script intentionally uses your currently exported `SRC_*` environment variables, is not hooked up to CI, and is meant for manual regression checks (for example, to catch issues like `src users list` failing unexpectedly).
 
-We adhere to the [general Sourcegraph principles for testing](https://docs.sourcegraph.com/dev/background-information/testing_principles), as well as [the Go specific directions](https://docs.sourcegraph.com/dev/background-information/languages/testing_go_code), at least to the extent they apply to a standalone tool like `src`.
+We adhere to the general Sourcegraph principles for testing, as well as the Go specific directions used in the main Sourcegraph repository, at least to the extent they apply to a standalone tool like `src`.
 
 ## Releasing
 

Dockerfile

@@ -4,17 +4,18 @@
 #
 # Nothing fancy here: we copy in the source code and build on the Alpine Go
 # image. Refer to .dockerignore to get a sense of what we're not going to copy.
-FROM golang:1.26.5-alpine3.23@sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc AS builder
+FROM golang:1.26.10-alpine3.23@sha256:a07f231c19b03e6106cf442f02a5bcf262147e744d15b7b5e4b6d81d420c70a0 AS builder
 
 COPY . /src
 WORKDIR /src
 RUN go build ./cmd/src
 
 # This stage should be kept in sync with Dockerfile.release.
-FROM alpine:3.22@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
 # needed for `src code-intel upload` and `src actions exec`
-RUN apk add --no-cache git
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle
 
 COPY --from=builder /src/src /usr/bin/
 ENTRYPOINT ["/usr/bin/src"]

Dockerfile.release

@@ -2,10 +2,11 @@
 # suitable for testing, since it depends on a src binary being at the project
 # root _and_ that src binary being runnable on Alpine. To test this, refer to
 # the main Dockerfile, which should have an identical second stage.
-FROM alpine:3.22@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22@sha256:5291449c3df73caf6ed85e649dec1b9e818b39a5d8c871e97afc13e9cd5e8fa8
 
 # needed for `src code-intel upload` and `src actions exec`
-RUN apk add --no-cache git
+# ca-certificates-bundle >= 20261020-r0 drops the eMudhra roots (CVE-2026-111943).
+RUN apk add --no-cache git && apk upgrade --no-cache ca-certificates-bundle
 
 COPY src /usr/bin/
 ENTRYPOINT ["/usr/bin/src"]

README.md

@@ -7,7 +7,7 @@
 - **Search & get results in your terminal**
 - **Search & get JSON** for programmatic consumption
 - Make **GraphQL API requests** with auth easily & get JSON back fast
-- Execute **[batch changes](https://docs.sourcegraph.com/batch_changes)**
+- Execute **[batch changes](https://sourcegraph.com/docs/batch_changes)**
 - **Manage & administrate** repositories, users, and more
 - **Easily convert src-CLI commands to equivalent curl commands**, just add --get-curl!
 
@@ -173,7 +173,7 @@ Is your Sourcegraph instance behind a custom auth proxy? See [auth proxy configu
  - `src auth` - print the active authentication token or authorization header
  - `src search` - perform searches and get results in your terminal or as JSON
  - `src api` - run Sourcegraph GraphQL API requests
- - `src batch` - execute and manage [batch changes](https://docs.sourcegraph.com/batch_changes)
+ - `src batch` - execute and manage [batch changes](https://sourcegraph.com/docs/batch_changes)
  - `src repos` - manage repositories
  - `src users` - manage users
  - `src orgs` - manages organization
@@ -185,7 +185,7 @@ Is your Sourcegraph instance behind a custom auth proxy? See [auth proxy configu
  - `src version` - check version and guaranteed-compatible version for your Sourcegraph instance
 
 Run `src -h` and `src <subcommand> -h` for more detailed usage information.
-You can also read the [usage docs for the latest version of `src-cli`](https://docs.sourcegraph.com/cli/references) online.
+You can also read the [usage docs for the latest version of `src-cli`](https://sourcegraph.com/docs/cli/references) online.
 
 #### Optional: Renaming `src`
 
@@ -197,6 +197,10 @@ mv /usr/local/bin/src /usr/local/bin/src-cli
 
 You can then invoke it via `src-cli`.
 
+## Timeouts
+
+`src` waits up to 1 minute for the server to start responding to a request. To change this, set the `SRC_RESPONSE_HEADER_TIMEOUT` environment variable to a duration such as `30s` or `10m`, or to `0` to disable the timeout. This timeout only applies until the server sends its response headers — responses that stream data for a long time, such as large search job results, are not interrupted.
+
 ## Telemetry
 
 `src` includes the operating system and architecture in the `User-Agent` header sent to Sourcegraph. For example, running `src` version 3.21.10 on an x86-64 Linux host will result in this header:
@@ -207,7 +211,7 @@ src-cli/3.21.10 linux amd64
 
 To disable this and _only_ send the version, you can set `-user-agent-telemetry=false` for a single command, or set the `SRC_DISABLE_USER_AGENT_TELEMETRY` environment variable to any non-blank string.
 
-As with [other Sourcegraph telemetry](https://docs.sourcegraph.com/dev/background-information/telemetry), any collected data is only sent to Sourcegraph.com in aggregate form.
+As with other Sourcegraph telemetry, any collected data is only sent to Sourcegraph.com in aggregate form.
 
 ## Development
 

cmd/src/batch.go

@@ -37,7 +37,8 @@ Use "src batch [command] -h" for more information about a command.
 
 	// Register the command.
 	commands = append(commands, &command{
-		flagSet: flagSet,
+		flagSet:     flagSet,
+		description: "manages batch changes",
 		aliases: []string{
 			"batchchange",
 			"batch-change",