Skip to content

Commit 373b2ae

Browse files
vmfuncvmfunc
committed
ci: overhaul workflows — lint, security scanning, release hardening
- add golangci-lint job to go.yml (parallel with build+test) - add Go 1.23/1.24 version matrix, coverage only on 1.24 - upgrade setup-go@v4→v5, codecov@v4→v5 across all workflows - fix check-large-files bug (find|while never exits 1), exclude .git/ - add concurrency groups to push+PR workflows (no duplicate runs) - lowercase all workflow names to match project voice - add gosec, errorlint, gocognit, nilnil, wastedassign, tenv linters - remove deprecated exportloopref (Go 1.22 fixed loop var capture) - new: codeql.yml — semantic SAST with SARIF upload - new: govulncheck.yml — Go vuln scanner with call-graph analysis - new: scorecard.yml — OpenSSF supply chain scorecard - new: dependabot.yml — auto-update Go deps + Actions versions - release: SHA256 checksums + SBOM generation for all artifacts - add CODEOWNERS
1 parent 9faae54 commit 373b2ae

19 files changed

+232
-50
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @vmfunc

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 5
8+
labels:
9+
- deps
10+
11+
- package-ecosystem: github-actions
12+
directory: /
13+
schedule:
14+
interval: weekly
15+
open-pull-requests-limit: 5
16+
labels:
17+
- deps

‎.github/workflows/automatic-rebase.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Automatic Rebase
1+
name: automatic rebase
22
on:
33
issue_comment:
44
types: [created]
@@ -12,7 +12,7 @@ jobs:
1212
uses: actions/checkout@v4
1313
with:
1414
fetch-depth: 0
15-
- name: Automatic Rebase
15+
- name: automatic rebase
1616
uses: cirrus-actions/rebase@1.8
1717
env:
1818
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/check-large-files.yml‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,26 @@
1-
name: Check Large Files
1+
name: check large files
22

33
on:
44
pull_request:
55
push:
66
branches: [main]
77

8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
812
jobs:
913
check-large-files:
10-
name: Check for large files
14+
name: check for large files
1115
runs-on: ubuntu-latest
1216
steps:
1317
- uses: actions/checkout@v4
14-
- name: Check for large files
18+
- name: check for large files
1519
run: |
16-
find . -type f -size +5M | while read file; do
17-
echo "::error file=${file}::File ${file} is larger than 5MB"
18-
done
20+
large_files=$(find . -path ./.git -prune -o -type f -size +5M -print)
21+
if [ -n "$large_files" ]; then
22+
echo "$large_files" | while read -r file; do
23+
echo "::error file=${file}::File ${file} is larger than 5MB"
24+
done
25+
exit 1
26+
fi

‎.github/workflows/code_quality.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
1-
name: Qodana
1+
name: qodana
22
on:
33
workflow_dispatch:
44
pull_request:
55
push:
66
branches:
77
- main
88

9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
913
jobs:
1014
qodana:
1115
runs-on: ubuntu-latest

‎.github/workflows/codeql.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: codeql
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: "0 6 * * 1" # monday 06:00 UTC
10+
11+
permissions:
12+
actions: read
13+
contents: read
14+
security-events: write
15+
16+
jobs:
17+
analyze:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v4
21+
- name: set up go
22+
uses: actions/setup-go@v5
23+
with:
24+
go-version: "1.24"
25+
- name: initialize codeql
26+
uses: github/codeql-action/init@v3
27+
with:
28+
languages: go
29+
- name: autobuild
30+
uses: github/codeql-action/autobuild@v3
31+
- name: perform codeql analysis
32+
uses: github/codeql-action/analyze@v3
33+
with:
34+
category: "/language:go"

‎.github/workflows/dependency-review.yml‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: "Dependency Review"
1+
name: dependency review
22
on:
33
pull_request:
44
push:
@@ -7,16 +7,20 @@ on:
77
permissions:
88
contents: read
99

10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
1014
jobs:
1115
dependency-review:
1216
runs-on: ubuntu-latest
1317
steps:
14-
- name: "Checkout Repository"
18+
- name: checkout repository
1519
uses: actions/checkout@v4
16-
- name: "Dependency Review"
20+
- name: dependency review
1721
uses: actions/dependency-review-action@v4
1822
continue-on-error: ${{ github.event_name == 'push' }}
19-
- name: "Check Dependency Review Outcome"
23+
- name: check dependency review outcome
2024
if: github.event_name == 'push' && failure()
2125
run: |
2226
echo "::warning::Dependency review failed. Please check the dependencies for potential issues."

‎.github/workflows/go.yml‎

Lines changed: 31 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,47 @@
1-
name: Go
1+
name: go
2+
23
on:
34
push:
45
branches: ["main"]
56
pull_request:
67
branches: ["main"]
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
713
jobs:
8-
build:
14+
lint:
915
runs-on: ubuntu-latest
1016
steps:
1117
- uses: actions/checkout@v4
12-
- name: Set up Go
13-
uses: actions/setup-go@v4
18+
- name: set up go
19+
uses: actions/setup-go@v5
1420
with:
1521
go-version: "1.24"
16-
- name: Build
22+
- name: golangci-lint
23+
uses: golangci/golangci-lint-action@v6
24+
with:
25+
version: latest
26+
27+
build:
28+
runs-on: ubuntu-latest
29+
strategy:
30+
matrix:
31+
go-version: ["1.23", "1.24"]
32+
steps:
33+
- uses: actions/checkout@v4
34+
- name: set up go
35+
uses: actions/setup-go@v5
36+
with:
37+
go-version: ${{ matrix.go-version }}
38+
- name: build
1739
run: make
18-
- name: Run tests with coverage
40+
- name: run tests with coverage
1941
run: go test -race -coverprofile=coverage.out -covermode=atomic ./...
20-
- name: Upload coverage to Codecov
21-
uses: codecov/codecov-action@v4
42+
- name: upload coverage to codecov
43+
if: matrix.go-version == '1.24'
44+
uses: codecov/codecov-action@v5
2245
with:
2346
files: ./coverage.out
2447
fail_ci_if_error: false

‎.github/workflows/govulncheck.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: govulncheck
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: "0 6 * * 1" # monday 06:00 UTC
10+
11+
jobs:
12+
govulncheck:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@v4
16+
- name: set up go
17+
uses: actions/setup-go@v5
18+
with:
19+
go-version: "1.24"
20+
- name: install govulncheck
21+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
22+
- name: run govulncheck
23+
run: govulncheck ./...

‎.github/workflows/language.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Mind your language
1+
name: mind your language
22
on:
33
issues:
44
types:

0 commit comments

Comments
 (0)