chore(deps): bump actions/upload-artifact from 4 to 7 #13
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Gating race-test job, dedicated to the security workflow so it can be a | |
| # required status check independent of the coverage job in ci.yml. | |
| race-test: | |
| name: go test -race | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: go test -race ./... | |
| run: go test -race ./... | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: go | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:go" | |
| gosec: | |
| name: gosec (badgeverify) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| # Scoped to the crown-jewel badge crypto. The rest of the module | |
| # carries pre-existing G104 findings (unhandled Close()/Set() errors) | |
| # tracked as follow-up; scoping keeps this gate meaningful and green | |
| # without rewriting unrelated packages in this PR. | |
| - name: gosec | |
| run: go run github.com/securego/gosec/v2/cmd/gosec@v2.22.5 -fmt=text ./badgeverify/... | |
| govulncheck: | |
| name: govulncheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| - name: govulncheck | |
| run: go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./... | |
| gitleaks: | |
| name: gitleaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| # The gitleaks GitHub Action requires a paid GITLEAKS_LICENSE secret on | |
| # organization repos. The gitleaks CLI itself is OSS and unrestricted, | |
| # so we run the pinned binary directly — full-history secret scan, no | |
| # license gate, fails the job on any finding. | |
| - name: Install gitleaks | |
| run: | | |
| set -euo pipefail | |
| VERSION=8.21.2 | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VERSION}/gitleaks_${VERSION}_linux_x64.tar.gz" \ | |
| | tar -xz -C /usr/local/bin gitleaks | |
| gitleaks version | |
| - name: Scan repository history | |
| run: gitleaks detect --source . --redact --verbose --exit-code 1 | |
| fuzz: | |
| name: badgeverify fuzz | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: '1.25' | |
| cache: true | |
| # Bounded fuzz window over every badgeverify target. Seed corpora are | |
| # deterministic; this re-runs the seeds and explores new inputs for a | |
| # short, CI-friendly slice per target. | |
| - name: Fuzz parsers and verifiers | |
| run: | | |
| set -euo pipefail | |
| targets="FuzzParseBadge FuzzParseEnrollment FuzzParseRecovery FuzzVerify FuzzVerifyEnrollment FuzzVerifyRecovery" | |
| for t in $targets; do | |
| echo "::group::$t" | |
| go test -run='^$' -fuzz="^${t}$" -fuzztime=30s ./badgeverify/ | |
| echo "::endgroup::" | |
| done |