From 77b42184c4d6341998284d602708a996a75d9ac6 Mon Sep 17 00:00:00 2001 From: Automated Date: Tue, 4 Aug 2026 08:40:58 +0000 Subject: [PATCH 1/2] Update GitHub Actions to latest vetted versions | Action | SHA | Version | Vetted in | |--------|-----|---------|-----------| | `actions/checkout` | `3d3c42e5` | v7.0.1 | | | `actions/setup-go` | `b7ad1dad` | v7.0.0 | | | `golangci/golangci-lint-action` | `ba0d7d2e` | v9.3.0 | [exoscale/gha-pins#14](https://github.com/exoscale/gha-pins/pull/14) | --- .github/workflows/e2e.yml | 8 ++++---- .github/workflows/golangci-lint.yml | 6 +++--- .github/workflows/govulncheck.yml | 4 ++-- .github/workflows/main.yml | 2 +- .github/workflows/release.yml | 2 +- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml index 08253502d..dead01021 100644 --- a/.github/workflows/e2e.yml +++ b/.github/workflows/e2e.yml @@ -9,10 +9,10 @@ jobs: name: Run E2E (Testscript) Tests / Without API runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: "go.mod" @@ -38,10 +38,10 @@ jobs: - suite: storage run: TestScriptsAPIStorage steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: "go.mod" diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index 672a5a5b6..c81004257 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -8,12 +8,12 @@ jobs: name: lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Setup Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: go.mod - - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 + - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: latest args: --timeout 4m diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index e035a82d6..44ff4dbda 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -7,8 +7,8 @@ jobs: govulncheck: runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version-file: 'go.mod' cache-dependency-path: 'go.sum' diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 971527492..b52b38195 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -19,7 +19,7 @@ jobs: name: Build + Run Unit Tests runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a3360cae3..91a1ce462 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: linux_amd64_checksum: ${{ steps.get-linux-amd64-checksum.outputs.linux_amd64_checksum }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 From 45caafc8c33c32c57094b664d879f55571de4e34 Mon Sep 17 00:00:00 2001 From: Natalie Perret <11332444+natalie-o-perret@users.noreply.github.com> Date: Wed, 5 Aug 2026 21:15:58 +0200 Subject: [PATCH 2/2] Harden nested GitHub Actions usage --- .github/actions/build/action.yaml | 10 ++++---- .github/workflows/golangci-lint.yml | 3 ++- .github/workflows/release.yml | 36 +++++++++++++++++++++++------ 3 files changed, 36 insertions(+), 13 deletions(-) diff --git a/.github/actions/build/action.yaml b/.github/actions/build/action.yaml index 3f69e7d1d..eb4a1ba26 100644 --- a/.github/actions/build/action.yaml +++ b/.github/actions/build/action.yaml @@ -1,15 +1,15 @@ name: "Build" +description: "Build and test the CLI" runs: using: "composite" steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - fetch-depth: 0 - - run: make go.mk shell: bash - - uses: ./go.mk/.github/actions/setup + - name: Set up Go + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 + with: + go-version-file: go.mod - uses: ./go.mk/.github/actions/pre-check diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index c81004257..ade470f0f 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -15,6 +15,7 @@ jobs: go-version-file: go.mod - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - version: latest + version: v2.12.2 + install-mode: binary args: --timeout 4m only-new-issues: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 91a1ce462..c7fdc49fc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,7 @@ name: release on: push: tags: - - 'v[0-9]+\.[0-9]+\.[0-9]+' + - 'v[0-9]+.[0-9]+.[0-9]+' jobs: community-docs: @@ -36,13 +36,35 @@ jobs: gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }} passphrase: ${{ secrets.GPG_PASSPHRASE }} - - uses: ./go.mk/.github/actions/release + - name: Login to Docker Hub + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: - release_github_token: ${{ secrets.RELEASE_GITHUB_TOKEN }} - registry_username: ${{ secrets.DOCKERHUB_USERNAME }} - registry_password: ${{ secrets.DOCKERHUB_TOKEN }} - exoscale_api_key: ${{ secrets.SOS_PKG_BUCKET_KEY }} - exoscale_api_secret: ${{ secrets.SOS_PKG_BUCKET_SECRET }} + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Compute goreleaser cache key + id: goreleaser-cache-key + run: echo "GORELEASER_CACHE_KEY=$(make --just-print install-goreleaser | tr --delete [:space:] | base32 --wrap 0)" >> "$GITHUB_OUTPUT" + + - name: Cache goreleaser + id: cache-goreleaser + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 + with: + path: /home/runner/go/bin/goreleaser + key: ${{ steps.goreleaser-cache-key.outputs.GORELEASER_CACHE_KEY }} + + - name: Install goreleaser + if: steps.cache-goreleaser.outputs.cache-hit != 'true' + run: make install-goreleaser + + - run: echo "$(go env GOPATH)/bin/" >> "$GITHUB_PATH" + + - name: Release + run: make release + env: + GITHUB_TOKEN: ${{ secrets.RELEASE_GITHUB_TOKEN }} + EXOSCALE_API_KEY: ${{ secrets.SOS_PKG_BUCKET_KEY }} + EXOSCALE_API_SECRET: ${{ secrets.SOS_PKG_BUCKET_SECRET }} - run: echo "version_tag=$(make get-version-tag)" >> $GITHUB_OUTPUT id: get-version-tag