Merge branch 'main' into print-statistics

Author: dlevy-msft-sql

.github/copilot-instructions.md

@@ -155,6 +155,57 @@ The project supports creating SQL Server instances using Docker or Podman:
 - Use the `internal/localizer` package for localized messages
 - Supported languages: Chinese (Simplified/Traditional), English, French, German, Italian, Japanese, Korean, Portuguese (Brazil), Russian, Spanish
 
+### Adding Localizable Strings
+
+When adding user-facing strings to the code, use the `localizer` package:
+
+```go
+import "github.com/microsoft/go-sqlcmd/internal/localizer"
+
+// Use localizer.Sprintf for formatted strings
+message := localizer.Sprintf("This is a localizable message with %s", value)
+
+// Use localizer.Errorf for localized errors
+err := localizer.Errorf("Error: %s failed", operation)
+```
+
+Constants that are not user-facing (like environment variable names, command names) should be placed in `internal/localizer/constants.go` and do not need localization.
+
+### Generating Localization Files
+
+After adding new localizable strings, you **must** regenerate the translation catalog files before committing. The build scripts handle this automatically.
+
+#### On Windows
+
+```cmd
+build\build.cmd
+```
+
+This script:
+- Installs `gotext` if not already installed
+- Runs `go generate` which executes the gotext command defined in `internal/translations/translations.go`
+- Generates/updates the translation catalog in `internal/translations/catalog.go`
+- Reports any conflicting localizable strings that need to be fixed
+
+#### On Linux/macOS
+
+Run the following commands manually:
+
+```bash
+# Install gotext if not already installed
+go install golang.org/x/text/cmd/gotext@latest
+
+# Generate translation files
+go generate ./...
+```
+
+### Important Notes
+
+- Always run the build script after adding new user-facing strings
+- Check the build output for "conflicting localizable strings" warnings and resolve them
+- The `SQLCMD_LANG` environment variable controls the runtime language (e.g., `de-de`, `fr-fr`)
+- Test your changes with different language settings to ensure proper localization
+
 ## Azure Authentication
 
 - Azure AD authentication is supported via the `azidentity` package

.github/dependabot.yml

@@ -0,0 +1,36 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # Enable version updates for Go modules
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "deps"
+      include: "scope"
+
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"

.github/workflows/golangci-lint.yml

@@ -9,12 +9,16 @@ jobs:
     name: lint-pr-changes
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      # Pinned to commit SHA for supply chain security (CWE-829)
+      # Verify: gh api repos/actions/setup-go/git/ref/tags/v6 --jq '.object.sha'
+      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
         with:
-          go-version: stable
-      - uses: actions/checkout@v4
+          go-version: '1.24'
+      - uses: actions/checkout@v6
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        # Pinned to commit SHA for supply chain security (CWE-829)
+        # Verify: gh api repos/golangci/golangci-lint-action/git/ref/tags/v9 --jq '.object.sha'
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.0.0
         with:
           version: latest
           only-new-issues: true

.github/workflows/pr-validation.yml

@@ -9,11 +9,11 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v6
     - name: Setup go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@v6
       with:
-        go-version: '1.22'
+        go-version: '1.24'
     - name: Run tests against Linux SQL
       run: |
         go version
@@ -23,5 +23,20 @@ jobs:
         export SQLCMDPASSWORD=$(date +%s|sha256sum|base64|head -c 32)
         export SQLCMDUSER=sa
         docker run -m 2GB -e ACCEPT_EULA=1 -d --name sql2022 -p:1433:1433 -e SA_PASSWORD=$SQLCMDPASSWORD mcr.microsoft.com/mssql/server:2022-latest
+        echo "Waiting for SQL Server to be ready..."
+        READY=0
+        for i in {1..60}; do
+          if docker exec sql2022 /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SQLCMDPASSWORD" -C -Q "SELECT 1" &>/dev/null; then
+            echo "SQL Server is ready!"
+            READY=1
+            break
+          fi
+          echo "Attempt $i: SQL Server not ready yet, waiting..."
+          sleep 2
+        done
+        if [ $READY -eq 0 ]; then
+          echo "ERROR: SQL Server failed to become ready within 2 minutes"
+          exit 1
+        fi
         cd ../..
         go test -v ./...

.github/workflows/security.yml

@@ -0,0 +1,38 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+name: Security Scanning
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Run weekly on Monday at 9:00 AM UTC
+    - cron: '0 9 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    name: Go Vulnerability Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.24.13'
+
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+
+      - name: Run govulncheck
+        run: govulncheck ./...

.pipelines/LocBuild.yml

@@ -19,7 +19,8 @@ steps:
       packageSourceAuth: patAuth
       dependencyPackageSource: 'https://pkgs.dev.azure.com/msdata/_packaging/SQLDS_SSMS/nuget/v3/index.json'
       patVariable: $(System.AccessToken)
-
+      isAutoCompletePrSelected: false
+      isShouldReusePrSelected: true
   - task: PublishPipelineArtifact@1
     inputs:
       targetPath: '$(Build.ArtifactStagingDirectory)'

.pipelines/include-install-go-tools.yml

@@ -1,7 +1,7 @@
 steps: 
   - task: GoTool@0
     inputs:
-      version: '1.22.10'
+      version: '1.24.2'
   - task: Go@0
     displayName: 'Go: get dependencies'
     inputs:

NOTICE.md

@@ -587,8 +587,8 @@ SOFTWARE.
 ## github.com/docker/distribution
 
 * Name: github.com/docker/distribution
-* Version: v2.8.2
-* License: [Apache-2.0](https://github.com/docker/distribution/blob/v2.8.2/LICENSE)
+* Version: v2.8.3
+* License: [Apache-2.0](https://github.com/docker/distribution/blob/v2.8.3/LICENSE)
 
 ```
 Apache License
@@ -5056,6 +5056,61 @@ SUBDIRECTORIES
 
 ```
 
+## github.com/shopspring/decimal
+
+* Name: github.com/shopspring/decimal
+* Version: v1.4.0
+* License: [MIT](https://github.com/shopspring/decimal/blob/v1.4.0/LICENSE)
+
+```
+The MIT License (MIT)
+
+Copyright (c) 2015 Spring, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+- Based on https://github.com/oguzbilgic/fpd, which has the following license:
+"""
+The MIT License (MIT)
+
+Copyright (c) 2013 Oguz Bilgic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+"""
+
+```
+
 ## github.com/spf13/afero
 
 * Name: github.com/spf13/afero

README.md

@@ -112,6 +112,24 @@ sqlcmd
 
 If no current context exists, `sqlcmd` (with no connection parameters) reverts to the original ODBC `sqlcmd` behavior of creating an interactive session to the default local instance on port 1433 using trusted authentication, otherwise it will create an interactive session to the current context.
 
+### Piping input to sqlcmd
+
+You can pipe SQL commands directly to `sqlcmd` from the command line. This is useful for scripting and automation:
+
+**PowerShell:**
+```powershell
+"SELECT @@version" | sqlcmd -S myserver -d mydb -G
+"SELECT name FROM sys.databases" | sqlcmd -S myserver.database.windows.net -d mydb -G
+```
+
+**Bash:**
+```bash
+echo "SELECT @@version" | sqlcmd -S myserver -d mydb -G
+cat myscript.sql | sqlcmd -S myserver -d mydb -G
+```
+
+Note: When piping input, `GO` batch terminators are optional—`sqlcmd` will automatically execute the batch when the input ends. However, you can still include `GO` statements if you want to execute multiple batches.
+
 ## Sqlcmd
 
 The `sqlcmd` project aims to be a complete port of the original ODBC sqlcmd to the `Go` language, utilizing the [go-mssqldb][] driver. For full documentation of the tool and installation instructions, see [go-sqlcmd-utility][].