From 761a42f4d817772e24c5f578b91b3a1d8b28ad72 Mon Sep 17 00:00:00 2001 From: Vinny Barton Date: Mon, 5 Oct 2026 17:48:20 -0400 Subject: [PATCH 1/6] ci: adopt shared Go lint workflow --- .github/workflows/lint.yml | 41 ++++++++++++-------------------------- 1 file changed, 13 insertions(+), 28 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index f5af221..90995b5 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1,35 +1,20 @@ -name: golangci-lint +name: Go Lint on: - push: - branches: [ main ] - pull_request: workflow_dispatch: + pull_request: + push: + branches: + - main -permissions: - contents: read +permissions: read-all jobs: lint: - name: 🔍 Lint - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 - with: - go-version-file: 'go.mod' - cache: true - - - name: Install Dependencies - run: go mod download - - - name: Run golangci-lint - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 - with: - version: v2.8 - - - name: Add Job Summary - run: | - echo "### 🔍 Lint Results" >> $GITHUB_STEP_SUMMARY - echo "- ✅ Code linting completed successfully" >> $GITHUB_STEP_SUMMARY + permissions: + contents: read + uses: shiftleftcyber/supply-chain-workflows/.github/workflows/go-lint.yml@08214ced07c278eaed1c68fa459916e07f071553 + with: + go-version-file: go.mod + golangci-lint-version: v2.8.0 + working-directory: . From f4f8cbf5e8b63c4ab7065073c20935d526b16381 Mon Sep 17 00:00:00 2001 From: Vinny Barton Date: Mon, 5 Oct 2026 20:18:05 -0400 Subject: [PATCH 2/6] fix: inherit caller read permissions --- .github/workflows/lint.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 90995b5..309dd82 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -11,8 +11,6 @@ permissions: read-all jobs: lint: - permissions: - contents: read uses: shiftleftcyber/supply-chain-workflows/.github/workflows/go-lint.yml@08214ced07c278eaed1c68fa459916e07f071553 with: go-version-file: go.mod From a9a8574c75f42143a02a81919530fdb2387ee5e2 Mon Sep 17 00:00:00 2001 From: Vinny Barton Date: Mon, 5 Oct 2026 20:45:12 -0400 Subject: [PATCH 3/6] ci: adopt shared Go CI and security --- .github/workflows/build.yml | 53 +++++----------------- .github/workflows/codeql-analysis.yml | 33 -------------- .github/workflows/osv-scanner-pr.yml | 16 ------- .github/workflows/osv-scanner-schedule.yml | 14 ------ .github/workflows/security.yml | 21 +++++++++ 5 files changed, 33 insertions(+), 104 deletions(-) delete mode 100644 .github/workflows/codeql-analysis.yml delete mode 100644 .github/workflows/osv-scanner-pr.yml delete mode 100644 .github/workflows/osv-scanner-schedule.yml create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a06eafc..c8ed4ce 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,47 +1,18 @@ -name: Build & Test +name: Go CI on: - push: - branches: [ main ] - pull_request: workflow_dispatch: + pull_request: + push: + branches: + - main + +permissions: read-all jobs: build: - name: 🧩 Build & Test - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 - with: - go-version-file: 'go.mod' - cache: true - - - name: Install Dependencies - run: go mod download - - - name: Build - run: | - go version - go build -o bin/sbom-validator-example example/main.go - - - name: Run Tests - run: | - go test -v -coverprofile=coverage.out ./... - go tool cover -func=coverage.out - - - name: Upload Coverage Report - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 - with: - name: coverage-report - path: coverage.out - - - name: Add Job Summary - run: | - echo "### ✅ Build & Test Completed" >> $GITHUB_STEP_SUMMARY - echo "- ✅ Unit tests passed successfully" >> $GITHUB_STEP_SUMMARY - echo "- 📊 Coverage Summary:" >> $GITHUB_STEP_SUMMARY - go tool cover -func=coverage.out | tail -n 1 >> $GITHUB_STEP_SUMMARY + uses: shiftleftcyber/supply-chain-workflows/.github/workflows/go-ci.yml@08214ced07c278eaed1c68fa459916e07f071553 + with: + coverage-artifact-name: coverage-report + go-version-file: go.mod + working-directory: . diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index 09c8a21..0000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null @@ -1,33 +0,0 @@ -name: CodeQL - -on: - push: - branches: - - main - pull_request: - branches: - - main - workflow_dispatch: { } - schedule: - - cron: "42 23 * * 5" # run friday night - -permissions: { } - -jobs: - analyze: - name: Analyze - timeout-minutes: 10 - runs-on: ubuntu-latest - permissions: - security-events: write - steps: - - name: Checkout Repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # tag=v4.3.1 - - name: Initialize CodeQL - uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # tag=v2.11.2 - with: - languages: "go" - - name: Run Autobuild - uses: github/codeql-action/autobuild@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # tag=v2.11.2 - - name: Perform Analysis - uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # tag=v2.11.2 \ No newline at end of file diff --git a/.github/workflows/osv-scanner-pr.yml b/.github/workflows/osv-scanner-pr.yml deleted file mode 100644 index 0fee8e1..0000000 --- a/.github/workflows/osv-scanner-pr.yml +++ /dev/null @@ -1,16 +0,0 @@ -name: OSV-Scanner PR Scan - -on: - pull_request: - branches: [main] - merge_group: - branches: [main] - -permissions: - actions: read - security-events: write - contents: read - -jobs: - scan-pr: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" #v2.3.8 diff --git a/.github/workflows/osv-scanner-schedule.yml b/.github/workflows/osv-scanner-schedule.yml deleted file mode 100644 index 57f8cdb..0000000 --- a/.github/workflows/osv-scanner-schedule.yml +++ /dev/null @@ -1,14 +0,0 @@ -name: OSV-Scanner Scan - -on: - schedule: - - cron: "30 12 * * 1" - -permissions: - actions: read - security-events: write - contents: read - -jobs: - scan-scheduled: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2" #v2.3.8 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..02cba0a --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,21 @@ +name: Go Security + +on: + workflow_dispatch: + pull_request: + push: + branches: + - main + schedule: + - cron: "30 12 * * 1" + +permissions: + contents: read + security-events: write + +jobs: + security: + uses: shiftleftcyber/supply-chain-workflows/.github/workflows/security-go.yml@08214ced07c278eaed1c68fa459916e07f071553 + with: + go-version-file: go.mod + working-directory: . From 032df942af502503a6f5f984a0498a5151955c80 Mon Sep 17 00:00:00 2001 From: Vinny Barton Date: Mon, 5 Oct 2026 20:55:52 -0400 Subject: [PATCH 4/6] fix: pin security workflow permission correction --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 02cba0a..6c5de1a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -15,7 +15,7 @@ permissions: jobs: security: - uses: shiftleftcyber/supply-chain-workflows/.github/workflows/security-go.yml@08214ced07c278eaed1c68fa459916e07f071553 + uses: shiftleftcyber/supply-chain-workflows/.github/workflows/security-go.yml@c4b3a0e6e31f5b47d5f792da6b39eee0f058c9a9 with: go-version-file: go.mod working-directory: . From f4ac6c70f35e3c744f2aeb4842b197fea1a8cbd4 Mon Sep 17 00:00:00 2001 From: Vinny Barton Date: Mon, 5 Oct 2026 20:58:04 -0400 Subject: [PATCH 5/6] fix: pin scanner toolchain correction --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 6c5de1a..ed25274 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -15,7 +15,7 @@ permissions: jobs: security: - uses: shiftleftcyber/supply-chain-workflows/.github/workflows/security-go.yml@c4b3a0e6e31f5b47d5f792da6b39eee0f058c9a9 + uses: shiftleftcyber/supply-chain-workflows/.github/workflows/security-go.yml@d175f38df5c7934cadbc5a9024d21bce9ac55530 with: go-version-file: go.mod working-directory: . From 20ac2fdad707c31587923e9c54b0b74452686e81 Mon Sep 17 00:00:00 2001 From: Vinny Barton Date: Mon, 5 Oct 2026 21:00:49 -0400 Subject: [PATCH 6/6] build: update Go to patched 1.25.13 --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 2bec88c..462aaa3 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/shiftleftcyber/sbom-validator/v2 -go 1.25.7 +go 1.25.13 require github.com/xeipuuv/gojsonschema v1.2.0