Skip to content

Commit 7196d32

Browse files
FiloSottileFiloSottile
committed
.github/workflows: update and harden GitHub Actions workflows
1 parent 9f49b46 commit 7196d32

File tree

3 files changed

+88
-62
lines changed

3 files changed

+88
-62
lines changed

‎.github/workflows/build.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,19 +16,20 @@ jobs:
1616
- {GOOS: linux, GOARCH: amd64}
1717
- {GOOS: linux, GOARCH: arm, GOARM: 6}
1818
- {GOOS: linux, GOARCH: arm64}
19-
- {GOOS: darwin, GOARCH: amd64}
2019
- {GOOS: darwin, GOARCH: arm64}
2120
- {GOOS: windows, GOARCH: amd64}
2221
- {GOOS: freebsd, GOARCH: amd64}
2322
steps:
2423
- name: Checkout repository
25-
uses: actions/checkout@v4
24+
uses: actions/checkout@v5
2625
with:
2726
fetch-depth: 0
27+
persist-credentials: false
2828
- name: Install Go
2929
uses: actions/setup-go@v5
3030
with:
3131
go-version: 1.x
32+
cache: false
3233
- name: Build binary
3334
run: |
3435
cp LICENSE "$RUNNER_TEMP/LICENSE"

‎.github/workflows/ronn.yml‎

Lines changed: 22 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -13,23 +13,24 @@ jobs:
1313
name: Ronn
1414
runs-on: ubuntu-latest
1515
steps:
16-
- name: Checkout
17-
uses: actions/checkout@v4
18-
- name: Install ronn
19-
run: sudo apt-get update && sudo apt-get install -y ronn
20-
- name: Run ronn
21-
run: bash -O globstar -c 'ronn **/*.ronn'
22-
- name: Undo email mangling
23-
# rdiscount randomizes the output for no good reason, which causes
24-
# changes to always get committed. Sigh.
25-
# https://github.com/davidfstr/rdiscount/blob/6b1471ec3/ext/generate.c#L781-L795
26-
run: |-
27-
for f in doc/*.html; do
28-
awk '/Filippo Valsorda/ { $0 = "<p>Filippo Valsorda <a href=\"mailto:age@filippo.io\" data-bare-link=\"true\">age@filippo.io</a></p>" } { print }' "$f" > "$f.tmp"
29-
mv "$f.tmp" "$f"
30-
done
31-
- name: Upload generated files
32-
uses: actions/upload-artifact@v4
16+
- uses: actions/checkout@v5
17+
with:
18+
persist-credentials: false
19+
- uses: geomys/sandboxed-step@v1.2.1
20+
with:
21+
persist-workspace-changes: true
22+
run: |
23+
sudo apt-get update && sudo apt-get install -y ronn
24+
bash -O globstar -c 'ronn **/*.ronn'
25+
# rdiscount randomizes the output for no good reason, which causes
26+
# changes to always get committed. Sigh.
27+
# https://github.com/davidfstr/rdiscount/blob/6b1471ec3/ext/generate.c#L781-L795
28+
run: |-
29+
for f in doc/*.html; do
30+
awk '/Filippo Valsorda/ { $0 = "<p>Filippo Valsorda <a href=\"mailto:age@filippo.io\" data-bare-link=\"true\">age@filippo.io</a></p>" } { print }' "$f" > "$f.tmp"
31+
mv "$f.tmp" "$f"
32+
done
33+
- uses: actions/upload-artifact@v4
3334
with:
3435
name: man-pages
3536
path: |
@@ -42,10 +43,10 @@ jobs:
4243
contents: write
4344
runs-on: ubuntu-latest
4445
steps:
45-
- name: Checkout
46-
uses: actions/checkout@v4
47-
- name: Download generated files
48-
uses: actions/download-artifact@v4
46+
- uses: actions/checkout@v5
47+
with:
48+
persist-credentials: false
49+
- uses: actions/download-artifact@v4
4950
with:
5051
name: man-pages
5152
path: doc/

‎.github/workflows/test.yml‎

Lines changed: 63 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,79 @@
11
name: Go tests
2-
on: [push, pull_request]
2+
on:
3+
push:
4+
pull_request:
5+
schedule: # daily at 09:42 UTC
6+
- cron: '42 9 * * *'
7+
workflow_dispatch:
38
permissions:
49
contents: read
510
jobs:
611
test:
7-
name: Test
812
strategy:
913
fail-fast: false
1014
matrix:
11-
go: [1.19.x, 1.x]
12-
os: [ubuntu-latest, macos-latest, windows-latest]
15+
go:
16+
- { go-version: stable }
17+
- { go-version: oldstable }
18+
- { go-version-file: go.mod }
19+
os:
20+
- ubuntu-latest
21+
- macos-latest
22+
- windows-latest
1323
runs-on: ${{ matrix.os }}
1424
steps:
15-
- name: Install Go ${{ matrix.go }}
16-
uses: actions/setup-go@v5
17-
with:
18-
go-version: ${{ matrix.go }}
19-
- name: Checkout repository
20-
uses: actions/checkout@v4
21-
with:
22-
fetch-depth: 0
23-
- name: Run tests
24-
run: go test -race ./...
25-
gotip:
26-
name: Test (Go tip)
25+
- uses: actions/checkout@v5
26+
with:
27+
persist-credentials: false
28+
- uses: actions/setup-go@v6
29+
with:
30+
go-version: ${{ matrix.go.go-version }}
31+
go-version-file: ${{ matrix.go.go-version-file }}
32+
- run: |
33+
go test -race ./...
34+
test-latest:
35+
runs-on: ubuntu-latest
2736
strategy:
2837
fail-fast: false
2938
matrix:
30-
os: [ubuntu-latest, macos-latest, windows-latest]
31-
runs-on: ${{ matrix.os }}
39+
go:
40+
- { go-version: stable }
41+
- { go-version: oldstable }
42+
- { go-version-file: go.mod }
43+
steps:
44+
- uses: actions/checkout@v5
45+
with:
46+
persist-credentials: false
47+
- uses: actions/setup-go@v6
48+
with:
49+
go-version: ${{ matrix.go.go-version }}
50+
go-version-file: ${{ matrix.go.go-version-file }}
51+
- uses: geomys/sandboxed-step@v1.2.1
52+
with:
53+
run: |
54+
go get -u -t ./...
55+
go test -race ./...
56+
staticcheck:
57+
runs-on: ubuntu-latest
3258
steps:
33-
- name: Install bootstrap Go
34-
uses: actions/setup-go@v5
59+
- uses: actions/checkout@v5
60+
with:
61+
persist-credentials: false
62+
- uses: actions/setup-go@v6
3563
with:
3664
go-version: stable
37-
- name: Install Go tip (UNIX)
38-
if: runner.os != 'Windows'
39-
run: |
40-
git clone --filter=tree:0 https://go.googlesource.com/go $HOME/gotip
41-
cd $HOME/gotip/src && ./make.bash
42-
echo "$HOME/gotip/bin" >> $GITHUB_PATH
43-
- name: Install Go tip (Windows)
44-
if: runner.os == 'Windows'
45-
run: |
46-
git clone --filter=tree:0 https://go.googlesource.com/go $HOME/gotip
47-
cd $HOME/gotip/src && ./make.bat
48-
echo "$HOME/gotip/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
49-
- name: Checkout repository
50-
uses: actions/checkout@v4
51-
with:
52-
fetch-depth: 0
53-
- run: go version
54-
- name: Run tests
55-
run: go test -race ./...
65+
- uses: geomys/sandboxed-step@v1.2.1
66+
with:
67+
run: go run honnef.co/go/tools/cmd/staticcheck@latest ./...
68+
govulncheck:
69+
runs-on: ubuntu-latest
70+
steps:
71+
- uses: actions/checkout@v5
72+
with:
73+
persist-credentials: false
74+
- uses: actions/setup-go@v6
75+
with:
76+
go-version: stable
77+
- uses: geomys/sandboxed-step@v1.2.1
78+
with:
79+
run: go run golang.org/x/vuln/cmd/govulncheck@latest ./...

0 commit comments

Comments
 (0)