From 81243ef2315603830f58fc0affd07bd69b09949b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 27 Aug 2026 01:42:11 +0200 Subject: [PATCH 1/4] ci: update golangci-lint for go1.27 Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 60f1999..fffb871 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,7 +40,7 @@ jobs: ln -s vendor.sum go.sum - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - version: v2.12.2 + version: v2.13 skip-cache: true test: From c0a09ed04531655b4a52d0870d17b38fcb4c8c20 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 27 Aug 2026 01:51:12 +0200 Subject: [PATCH 2/4] ci: test against minimum, oldstable, and stable Also test on other platforms, and some minor fixups. Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 46 +++++++++++++++++++++++++----------- .github/workflows/codeql.yml | 9 +++---- 2 files changed, 37 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fffb871..a9eb95a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,47 +25,60 @@ env: jobs: lint: - runs-on: ubuntu-24.04 + runs-on: ubuntu-latest timeout-minutes: 5 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 - with: - go-version: "oldstable" - cache: false - name: Create go.mod run: | ln -s vendor.mod go.mod ln -s vendor.sum go.sum + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version: "oldstable" + cache: false - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.13 skip-cache: true test: - runs-on: ubuntu-24.04 - timeout-minutes: 5 - + name: ${{ matrix.os }} / ${{ matrix.go-version || 'minimum' }} strategy: + fail-fast: false matrix: - go: ["1.13", "oldstable", "stable"] - + go-version: + - "" # leave empty to use go-version-file (use go.mod); see https://github.com/actions/setup-go/issues/450#issuecomment-3620402646 + - oldstable + - stable + os: [ubuntu-latest, windows-latest, macos-latest] + exclude: + # Go 1.13 predates darwin/arm64. + # FIXME(thaJeztah): remove this exclude once we update the minimum go version. + - os: macos-latest + go-version: "" + runs-on: ${{ matrix.os }} + timeout-minutes: 10 steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: ${{ matrix.go }} - cache: false + persist-credentials: false - name: Create go.mod run: | ln -s vendor.mod go.mod ln -s vendor.sum go.sum + - name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version: ${{ matrix.go-version }} + go-version-file: go.mod # used when go-version is empty. + cache: false - name: Run tests run: go test -race govulncheck: - runs-on: ubuntu-24.04 + runs-on: ubuntu-latest timeout-minutes: 5 permissions: @@ -78,6 +91,11 @@ jobs: run: | ln -s vendor.mod go.mod ln -s vendor.sum go.sum + - name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version: stable + cache: false - name: Create artifact directory run: mkdir -p ${{ env.DESTDIR }} - name: Run govulncheck diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index cf9b475..f6fbae9 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -32,7 +32,7 @@ on: jobs: codeql: - runs-on: ubuntu-24.04 + runs-on: ubuntu-latest timeout-minutes: 10 permissions: actions: read @@ -41,13 +41,14 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 - with: - go-version: "stable" - name: Create go.mod run: | ln -s vendor.mod go.mod ln -s vendor.sum go.sum + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version: "stable" + cache: false - name: Initialize CodeQL uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: From f42e366329da6b3ee43b55666731b5bf6671159b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Fri, 28 Aug 2026 11:58:05 +0200 Subject: [PATCH 3/4] ci: govulncheck: update codeql-action/upload-sarif Signed-off-by: Sebastiaan van Stijn --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a9eb95a..1e51564 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -108,6 +108,6 @@ jobs: output-file: ${{ env.DESTDIR }}/govulncheck.out - name: Upload SARIF report if: ${{ github.event_name != 'pull_request' && github.repository == 'docker/go-events' }} - uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3 + uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0 with: sarif_file: ${{ env.DESTDIR }}/govulncheck.out From 4bd53e6cc522de2ccc0c88707bfe2ef9b309fbf0 Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Thu, 27 Aug 2026 23:14:03 +0200 Subject: [PATCH 4/4] ci: fix codeql branch names Signed-off-by: Sebastiaan van Stijn --- .github/workflows/codeql.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index f6fbae9..4395b0d 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -12,12 +12,12 @@ permissions: on: push: branches: - - 'master' + - 'main' tags: - 'v*' pull_request: # The branches below must be a subset of the branches above - branches: ["master"] + branches: ["main"] schedule: # ┌───────────── minute (0 - 59) # │ ┌───────────── hour (0 - 23)