Skip to content

Commit a18adc9

Browse files
mrz1836mrz1836
authored
sync(ci): update workflows and mage-x to v1.12.2 (#22)
1 parent 72e8ed4 commit a18adc9

28 files changed

+152
-96
lines changed

‎.github/.env.base‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -235,7 +235,7 @@ REDIS_CACHE_FORCE_PULL=false # Force pull Redis images even when cache
235235
# 🪄 MAGE-X CONFIGURATION
236236
# ================================================================================================
237237

238-
MAGE_X_VERSION=v1.11.0 # https://github.com/mrz1836/mage-x/releases
238+
MAGE_X_VERSION=v1.12.2 # https://github.com/mrz1836/mage-x/releases
239239
MAGE_X_USE_LOCAL=false # Use local version for development
240240
MAGE_X_CI_SKIP_STEP_SUMMARY=true # Skip duplicate test results in step summary (already in test validation summary)
241241
MAGE_X_AUTO_DISCOVER_BUILD_TAGS=true # Enable auto-discovery of build tags
@@ -293,6 +293,12 @@ GITLEAKS_CONFIG_FILE=
293293
# Nancy CVE Exclusions (known acceptable vulnerabilities)
294294
NANCY_EXCLUDES=CVE-2024-38513,CVE-2023-45142
295295

296+
# Govulncheck/Magex CVE Exclusions (known acceptable vulnerabilities)
297+
# Format: comma-separated CVE IDs (e.g., CVE-2024-38513,CVE-2023-45142)
298+
# Used by: magex deps:audit (govulncheck) (env or param)
299+
# Can also be passed via: magex deps:audit exclude=CVE-2024-38513
300+
MAGE_X_CVE_EXCLUDES=CVE-2024-38513,CVE-2023-45142
301+
296302
# OSS Index Authentication for Nancy (optional)
297303
# Username (email) for OSS Index authentication - reduces rate limits and provides better vulnerability data
298304
# Get your API token from: https://ossindex.sonatype.org/user-token

‎.github/actions/setup-magex/action.yml‎

Lines changed: 11 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@ runs:
112112
- name: ✅ Download MAGE-X binary (remote mode only)
113113
if: inputs.use-local != 'true' && steps.magex-cache.outputs.cache-hit != 'true'
114114
shell: bash
115+
env:
116+
GH_TOKEN: ${{ github.token }}
115117
run: |
116118
echo "⬇️ Cache miss – downloading MAGE-X binary..."
117119
echo "📋 Downloading MAGE-X version ${{ inputs.magex-version }}..."
@@ -141,18 +143,22 @@ runs:
141143
VERSION="${{ inputs.magex-version }}"
142144
CLEAN_VERSION="${VERSION#v}"
143145
144-
# Build download URL
145-
DOWNLOAD_URL="https://github.com/mrz1836/mage-x/releases/download/$VERSION/mage-x_${CLEAN_VERSION}_${OS}_${ARCH}.tar.gz"
146-
echo "📥 Downloading from: $DOWNLOAD_URL"
146+
# Build asset name and download using gh CLI
147+
ASSET_NAME="mage-x_${CLEAN_VERSION}_${OS}_${ARCH}.tar.gz"
148+
echo "📥 Downloading asset: $ASSET_NAME from mrz1836/mage-x@$VERSION"
147149
148150
# Download and extract
149151
TEMP_DIR=$(mktemp -d)
150152
cd "$TEMP_DIR"
151153
152-
if curl -fsSL "$DOWNLOAD_URL" -o mage-x.tar.gz; then
154+
if gh release download "$VERSION" \
155+
--repo mrz1836/mage-x \
156+
--pattern "$ASSET_NAME" \
157+
--dir .; then
153158
echo "✅ Download successful"
159+
mv "$ASSET_NAME" mage-x.tar.gz
154160
else
155-
echo "❌ Download failed from $DOWNLOAD_URL"
161+
echo "❌ Download failed for $ASSET_NAME from mrz1836/mage-x@$VERSION"
156162
exit 1
157163
fi
158164

‎.github/workflows/auto-merge-on-approval.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,10 +34,8 @@ on:
3434
pull_request:
3535
types: [ready_for_review, review_request_removed]
3636

37-
# Security: Restrictive default permissions with job-level overrides for least privilege access
38-
permissions:
39-
contents: read # Default read-only access to repository contents
40-
pull-requests: read # Default read access to pull requests
37+
# Security: Restrict default permissions (jobs must explicitly request what they need)
38+
permissions: {}
4139

4240
# --------------------------------------------------------------------
4341
# Concurrency Control
@@ -58,6 +56,8 @@ jobs:
5856
load-env:
5957
name: 🌍 Load Environment Variables
6058
runs-on: ubuntu-latest
59+
permissions:
60+
contents: read
6161
outputs:
6262
env-json: ${{ steps.load-env.outputs.env-json }}
6363
steps:

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,8 @@ concurrency:
1818
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
1919
cancel-in-progress: true
2020

21-
# Security: Restrictive default permissions with job-level overrides for least privilege access
22-
permissions:
23-
contents: read
21+
# Security: Restrict default permissions (jobs must explicitly request what they need)
22+
permissions: {}
2423

2524
jobs:
2625
analyze:

‎.github/workflows/dependabot-auto-merge.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,8 @@ on:
3030
pull_request:
3131
types: [opened, synchronize, reopened, ready_for_review]
3232

33-
# Security: Restrictive default permissions with job-level overrides for least privilege access
34-
permissions:
35-
contents: read
33+
# Security: Restrict default permissions (jobs must explicitly request what they need)
34+
permissions: {}
3635

3736
# --------------------------------------------------------------------
3837
# Concurrency Control

‎.github/workflows/fortress-benchmarks.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -87,9 +87,8 @@ on:
8787
description: "GitHub token for API access"
8888
required: true
8989

90-
# Security: Restrictive default permissions with job-level overrides for least privilege access
91-
permissions:
92-
contents: read
90+
# Security: Restrict default permissions (jobs must explicitly request what they need)
91+
permissions: {}
9392

9493
jobs:
9594
# ----------------------------------------------------------------------------------
@@ -98,6 +97,8 @@ jobs:
9897
benchmark-go:
9998
name: 🏃 Benchmark (${{ matrix.name }})
10099
timeout-minutes: ${{ inputs.benchmark-timeout }}
100+
permissions:
101+
contents: read
101102
strategy:
102103
fail-fast: false # Continue running other benchmarks if one fails
103104
matrix: ${{ fromJSON(inputs.benchmark-matrix) }}

‎.github/workflows/fortress-code-quality.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,9 +53,8 @@ on:
5353
description: "GitHub token for API access"
5454
required: true
5555

56-
# Security: Restrictive default permissions with job-level overrides for least privilege access
57-
permissions:
58-
contents: read
56+
# Security: Restrict default permissions (jobs must explicitly request what they need)
57+
permissions: {}
5958

6059
jobs:
6160
# ----------------------------------------------------------------------------------
@@ -65,6 +64,8 @@ jobs:
6564
name: 📊 Govet (Static Analysis)
6665
if: ${{ inputs.static-analysis-enabled == 'true' }}
6766
runs-on: ${{ inputs.primary-runner }}
67+
permissions:
68+
contents: read
6869
steps:
6970
# --------------------------------------------------------------------
7071
# Checkout code (required for local actions)
@@ -210,6 +211,8 @@ jobs:
210211
timeout-minutes: 20
211212
if: ${{ inputs.go-lint-enabled == 'true' }}
212213
runs-on: ${{ inputs.primary-runner }}
214+
permissions:
215+
contents: read
213216
outputs:
214217
golangci-lint-version: ${{ steps.golangci-lint-version.outputs.version }}
215218
steps:
@@ -430,6 +433,8 @@ jobs:
430433
name: 📐 YAML/JSON Format Validation
431434
if: ${{ inputs.yaml-lint-enabled == 'true' }}
432435
runs-on: ${{ inputs.primary-runner }}
436+
permissions:
437+
contents: read
433438
outputs:
434439
yamlfmt-version: ${{ steps.yamlfmt-version.outputs.version }}
435440
steps:

‎.github/workflows/fortress-completion-finalize.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,8 @@ on:
4040
description: "Complete assembled report"
4141
value: ${{ jobs.finalize-report.outputs.report-content }}
4242

43-
# Security: Restrictive default permissions with job-level overrides for least privilege access
44-
permissions:
45-
contents: read
46-
actions: read # Required for artifact downloads
43+
# Security: Restrict default permissions (jobs must explicitly request what they need)
44+
permissions: {}
4745

4846
jobs:
4947
# ----------------------------------------------------------------------------------
@@ -53,6 +51,9 @@ jobs:
5351
name: ✅ Finalize Report
5452
runs-on: ubuntu-latest
5553
if: always()
54+
permissions:
55+
contents: read
56+
actions: read
5657
outputs:
5758
report-content: ${{ steps.set-output.outputs.content }}
5859
steps:

‎.github/workflows/fortress-completion-report.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -96,10 +96,8 @@ on:
9696
type: string
9797
default: "full"
9898

99-
# Security: Restrictive default permissions with job-level overrides for least privilege access
100-
permissions:
101-
contents: read
102-
actions: read # Required for artifact downloads
99+
# Security: Restrict default permissions (jobs must explicitly request what they need)
100+
permissions: {}
103101

104102
jobs:
105103
# ----------------------------------------------------------------------------------
@@ -109,6 +107,9 @@ jobs:
109107
name: 📊 Initialize Report Data
110108
runs-on: ${{ inputs.primary-runner }}
111109
if: always()
110+
permissions:
111+
contents: read
112+
actions: read
112113
outputs:
113114
timing-data: ${{ steps.calculate-timing.outputs.timing-json }}
114115
steps:
@@ -158,6 +159,9 @@ jobs:
158159
name: 📊 Process Statistics
159160
needs: initialize-report
160161
if: always()
162+
permissions:
163+
contents: read
164+
actions: read
161165
uses: ./.github/workflows/fortress-completion-statistics.yml
162166
with:
163167
timing-metrics: ${{ needs.initialize-report.outputs.timing-data }}
@@ -170,6 +174,9 @@ jobs:
170174
name: 🧪 Process Test Analysis
171175
needs: initialize-report
172176
if: always()
177+
permissions:
178+
contents: read
179+
actions: read
173180
uses: ./.github/workflows/fortress-completion-tests.yml
174181
with:
175182
test-suite-result: ${{ inputs.test-suite-result }}
@@ -182,6 +189,9 @@ jobs:
182189
name: ✅ Finalize Report
183190
needs: [initialize-report, process-statistics, process-tests]
184191
if: always()
192+
permissions:
193+
contents: read
194+
actions: read
185195
uses: ./.github/workflows/fortress-completion-finalize.yml
186196
with:
187197
all-inputs: ${{ toJSON(inputs) }}

‎.github/workflows/fortress-completion-statistics.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,8 @@ on:
4141
description: "Coverage metrics"
4242
value: ${{ jobs.process-statistics.outputs.coverage-data }}
4343

44-
# Security: Restrictive default permissions with job-level overrides for least privilege access
45-
permissions:
46-
contents: read
47-
actions: read # Required for artifact downloads
44+
# Security: Restrict default permissions (jobs must explicitly request what they need)
45+
permissions: {}
4846

4947
jobs:
5048
# ----------------------------------------------------------------------------------
@@ -54,6 +52,9 @@ jobs:
5452
name: 📊 Process Statistics
5553
runs-on: ubuntu-latest
5654
if: always()
55+
permissions:
56+
contents: read
57+
actions: read
5758
outputs:
5859
statistics-markdown: ${{ steps.set-output.outputs.content }}
5960
cache-data: ${{ steps.process-cache.outputs.cache-metrics }}

0 commit comments

Comments
 (0)