feat: handle panics in goroutines

Wrap functions which run in goroutines so that their panics are recovered and turned into errors.

Also, bump Go & some deps, rekres.

Signed-off-by: Utku Ozdemir <utku.ozdemir@siderolabs.com>

Author: utkuozdemir

.github/workflows/lock.yml

@@ -0,0 +1,21 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2025-06-09T15:23:45Z by kres 5c988d4.
+
+name: Lock old issues
+"on":
+  schedule:
+    - cron: 0 2 * * *
+permissions:
+  issues: write
+jobs:
+  action:
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - name: Lock old issues
+        uses: dessant/lock-threads@v5.0.1
+        with:
+          issue-inactive-days: "60"
+          log-output: "true"
+          process-only: issues

.github/workflows/stale.yml

@@ -0,0 +1,27 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2025-06-09T15:23:45Z by kres 5c988d4.
+
+name: Close stale issues and PRs
+"on":
+  schedule:
+    - cron: 30 1 * * *
+permissions:
+  issues: write
+  pull-requests: write
+jobs:
+  stale:
+    runs-on:
+      - ubuntu-latest
+    steps:
+      - name: Close stale issues and PRs
+        uses: actions/stale@v9.1.0
+        with:
+          close-issue-message: This issue was closed because it has been stalled for 7 days with no activity.
+          days-before-issue-close: "5"
+          days-before-issue-stale: "180"
+          days-before-pr-close: "-1"
+          days-before-pr-stale: "45"
+          operations-per-run: "2000"
+          stale-issue-message: This issue is stale because it has been open 180 days with no activity. Remove stale label or comment or this will be closed in 7 days.
+          stale-pr-message: This PR is stale because it has been open 45 days with no activity.

Makefile

@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
 #
-# Generated on 2025-06-05T10:30:41Z by kres fc6afbe.
+# Generated on 2025-06-09T15:23:45Z by kres 5c988d4.
 
 # common variables
 
@@ -21,12 +21,12 @@ PROTOBUF_GO_VERSION ?= 1.36.6
 GRPC_GO_VERSION ?= 1.5.1
 GRPC_GATEWAY_VERSION ?= 2.26.3
 VTPROTOBUF_VERSION ?= 0.6.0
-GOIMPORTS_VERSION ?= 0.33.0
+GOIMPORTS_VERSION ?= 0.34.0
 GOMOCK_VERSION ?= 0.5.2
 DEEPCOPY_VERSION ?= v0.5.6
 GOLANGCILINT_VERSION ?= v2.1.6
 GOFUMPT_VERSION ?= v0.8.0
-GO_VERSION ?= 1.24.3
+GO_VERSION ?= 1.24.4
 GO_BUILDFLAGS ?=
 GO_LDFLAGS ?=
 CGO_ENABLED ?= 0

go.mod

@@ -1,19 +1,19 @@
 module github.com/siderolabs/siderolink
 
-go 1.23.0
+go 1.24.4
 
 require (
 	github.com/google/uuid v1.6.0
 	github.com/jsimonetti/rtnetlink/v2 v2.0.2
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10
-	github.com/siderolabs/gen v0.8.0
+	github.com/siderolabs/gen v0.8.4
 	github.com/siderolabs/go-pointer v1.0.0
 	github.com/stretchr/testify v1.10.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.0
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba
-	golang.org/x/sync v0.10.0
-	golang.org/x/sys v0.29.0
+	golang.org/x/sync v0.15.0
+	golang.org/x/sys v0.33.0
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20241231184526-a9ab2273dd10
 	google.golang.org/grpc v1.69.4
@@ -29,10 +29,10 @@ require (
 	github.com/mdlayher/netlink v1.7.2 // indirect
 	github.com/mdlayher/socket v0.5.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	golang.org/x/crypto v0.32.0 // indirect
+	golang.org/x/crypto v0.39.0 // indirect
 	golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 // indirect
-	golang.org/x/net v0.34.0 // indirect
-	golang.org/x/text v0.21.0 // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250122153221-138b5a5a4fd4 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect

go.sum

@@ -36,8 +36,8 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgm
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/siderolabs/gen v0.8.0 h1:Pj93+hexkk5hQ7izjJ6YXnEWc8vlzOmDwFz13/VzS7o=
-github.com/siderolabs/gen v0.8.0/go.mod h1:an3a2Y53O7kUjnnK8Bfu3gewtvnIOu5RTU6HalFtXQQ=
+github.com/siderolabs/gen v0.8.4 h1:1Xj/YvKTXgpnr9ZC7heKcskJo5wHvWOybwjQSCfEmsQ=
+github.com/siderolabs/gen v0.8.4/go.mod h1:CRrktDXQf3yDJI7xKv+cDYhBbKdfd/YE16OpgcHoT9E=
 github.com/siderolabs/go-pointer v1.0.0 h1:6TshPKep2doDQJAAtHUuHWXbca8ZfyRySjSBT/4GsMU=
 github.com/siderolabs/go-pointer v1.0.0/go.mod h1:HTRFUNYa3R+k0FFKNv11zgkaCLzEkWVzoYZ433P3kHc=
 github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
@@ -60,18 +60,18 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba h1:0b9z3AuHCjxk0x/opv64kcgZLBseWJUpBw5I82+2U4M=
 go4.org/netipx v0.0.0-20231129151722-fdeea329fbba/go.mod h1:PLyyIXexvUFg3Owu6p/WfdlivPbZJsZdgWZlrGope/Y=
-golang.org/x/crypto v0.32.0 h1:euUpcYgM8WcP71gNpTqQCn6rC2t6ULUPiOzfWaXVVfc=
-golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
+golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
+golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
 golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8 h1:yqrTHse8TCMW1M1ZCP+VAR/l0kKxwaAIqN/il7x4voA=
 golang.org/x/exp v0.0.0-20250106191152-7588d65b2ba8/go.mod h1:tujkw807nyEEAamNbDrEGzRav+ilXA7PCRAd6xsmwiU=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ=
-golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
-golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
+golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
+golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
+golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
 golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 h1:vVKdlvoWBphwdxWKrFZEuM0kGgGLxUOYcY4U/2Vjg44=
 golang.org/x/time v0.0.0-20220210224613-90d013bbcef8/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2 h1:B82qJJgjvYKsXS9jeunTOisW56dUokqW/FOteYJJ/yg=

hack/siderolink-client/main.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/siderolabs/gen/ensure"
+	"github.com/siderolabs/gen/panicsafe"
 	"github.com/siderolabs/gen/xslices"
 	"github.com/siderolabs/go-pointer"
 	"go.uber.org/zap"
@@ -83,7 +84,13 @@ func app() error {
 		return fmt.Errorf("failed to create tunnel device: %w", err)
 	}
 
-	go func() { cancel(device.Run()) }()
+	go func() {
+		if runErr := panicsafe.Run(func() {
+			cancel(device.Run())
+		}); runErr != nil {
+			logger.Error("error running tunnel device", zap.Error(runErr))
+		}
+	}()
 
 	defer closeClosable(device.Close, "tunnel device", logger)
 
@@ -102,13 +109,13 @@ func app() error {
 	logger.Info("wireguard device link up", zap.String("interface", ifaceName))
 
 	go func() {
-		monitorErr := monitorPeers(ctx, ctrl, ifaceName, logger)
-		if monitorErr == nil {
-			return
-		}
+		if monitorErr := panicsafe.RunErr(func() error {
+			return monitorPeers(ctx, ctrl, ifaceName, logger)
+		}); monitorErr != nil {
+			logger.Error("peer monitoring failed", zap.Error(monitorErr))
 
-		logger.Error("peer monitoring failed", zap.Error(monitorErr))
-		cancel(monitorErr)
+			cancel(monitorErr)
+		}
 	}()
 
 	for {
@@ -202,7 +209,13 @@ func run(ctx context.Context, ctrl wgCtrl, ifaceName string, queuePair *wgbind.Q
 
 	defer closeClosable(relay.Close, "relay", logger)
 
-	go func() { cancel(relay.Run(ctx, logger)) }()
+	go func() {
+		if runErr := panicsafe.Run(func() {
+			cancel(relay.Run(ctx, logger))
+		}); runErr != nil {
+			logger.Error("error running relay", zap.Error(runErr))
+		}
+	}()
 
 	for {
 		select {
@@ -307,7 +320,10 @@ func notifyContextCause(ctx context.Context, sigs ...os.Signal) (context.Context
 }
 
 func closeClosable(closeable func(), name string, logger *zap.Logger) {
-	closeClosableErr(func() error { closeable(); return nil }, name, logger)
+	closeClosableErr(func() error {
+		closeable()
+		return nil
+	}, name, logger)
 }
 
 func closeClosableErr(closeable func() error, name string, logger *zap.Logger) {
@@ -352,8 +368,8 @@ func provision(ctx context.Context, conn *grpc.ClientConn, key wgtypes.Key, clie
 }
 
 type mxCtrl struct {
-	mx   sync.Mutex
 	ctrl *wgctrl.Client
+	mx   sync.Mutex
 }
 
 func (m *mxCtrl) ConfigureDevice(name string, cfg wgtypes.Config) error {

internal/wait/value_test.go

@@ -32,7 +32,7 @@ func TestWaitableValue(t *testing.T) {
 	require.True(t, ok)
 	require.Equal(t, 42, value)
 
-	value, err := wv.Get(context.Background())
+	value, err := wv.Get(t.Context())
 	require.NoError(t, err)
 	require.Equal(t, 42, value)
 
@@ -60,7 +60,7 @@ func TestParallel(t *testing.T) { //nolint:tparallel
 		t.Run("Get", func(t *testing.T) {
 			t.Parallel()
 
-			val, err := wv.Get(context.Background())
+			val, err := wv.Get(t.Context())
 
 			require.NoError(t, err)
 			require.Equal(t, 42, val)
@@ -73,7 +73,7 @@ func TestParallel(t *testing.T) { //nolint:tparallel
 		t.Run("Get", func(t *testing.T) {
 			t.Parallel()
 
-			ctx, cancel := context.WithTimeout(context.Background(), time.Millisecond)
+			ctx, cancel := context.WithTimeout(t.Context(), time.Millisecond)
 			defer cancel()
 
 			val, err := wv.Get(ctx)
@@ -98,7 +98,7 @@ func TestTryGetSetUnset(t *testing.T) { //nolint:tparallel
 
 	var wv wait.Value[*int]
 
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second)
 	t.Cleanup(cancel)
 
 	eg, ctx := errgroup.WithContext(ctx)

pkg/agent/event_sink.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/siderolabs/gen/panicsafe"
 	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc"
 	"gopkg.in/yaml.v3"
@@ -47,11 +48,11 @@ func eventSink(ctx context.Context, apiEndpoint string, eg *errgroup.Group) erro
 
 	stopServer := sync.OnceFunc(server.Stop)
 
-	eg.Go(func() error {
+	eg.Go(panicsafe.RunErrF(func() error {
 		defer stopServer()
 
 		return server.Serve(listen)
-	})
+	}))
 
 	context.AfterFunc(ctx, stopServer)
 

pkg/agent/log_receiver.go

@@ -12,6 +12,7 @@ import (
 	"net/netip"
 	"sync"
 
+	"github.com/siderolabs/gen/panicsafe"
 	"go.uber.org/zap"
 	"golang.org/x/sync/errgroup"
 
@@ -34,7 +35,7 @@ func logReceiver(ctx context.Context, endpoint string, eg *errgroup.Group, logge
 
 	stopServer := sync.OnceFunc(srv.Stop)
 
-	eg.Go(func() error {
+	eg.Go(panicsafe.RunErrF(func() error {
 		defer stopServer()
 
 		serveErr := srv.Serve()
@@ -44,7 +45,7 @@ func logReceiver(ctx context.Context, endpoint string, eg *errgroup.Group, logge
 		}
 
 		return serveErr
-	})
+	}))
 
 	context.AfterFunc(ctx, stopServer)
 

pkg/agent/siderolink.go

@@ -14,6 +14,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/siderolabs/gen/panicsafe"
 	"go.uber.org/zap"
 	"golang.org/x/sync/errgroup"
 	"golang.zx2c4.com/wireguard/conn"
@@ -110,19 +111,19 @@ func sideroLink(ctx context.Context, eg *errgroup.Group, cfg sideroLinkConfig, p
 	pb.RegisterProvisionServiceServer(s, srv)
 	pb.RegisterWireGuardOverGRPCServiceServer(s, wggrpc.NewService(pt, allowedPeers, logger))
 
-	eg.Go(func() error {
+	eg.Go(panicsafe.RunErrF(func() error {
 		defer wgDevice.Close() //nolint:errcheck
 
 		return wgDevice.Run(ctx, logger, srv)
-	})
+	}))
 
 	stopServer := sync.OnceFunc(s.Stop)
 
-	eg.Go(func() error {
+	eg.Go(panicsafe.RunErrF(func() error {
 		defer stopServer()
 
 		return s.Serve(lis)
-	})
+	}))
 
 	context.AfterFunc(ctx, stopServer)