Skip to content

Commit 5d19154

Browse files
aminuezaaminueza
authored
deps: bump Go dependencies and CI actions (#796)
1 parent 9b2bf71 commit 5d19154

11 files changed

+301
-239
lines changed

‎.github/golangci.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,18 @@ linters:
2727
- path: import_.*\.go
2828
linters:
2929
- errcheck
30+
# TODO: migrate aws-sdk-go v1 to v2
31+
- text: "SA1019:.*aws-sdk-go.*is deprecated"
32+
linters:
33+
- staticcheck
34+
# TODO: migrate SetPolicy to AttachPolicy/DetachPolicy
35+
- text: "SA1019:.*SetPolicy is deprecated"
36+
linters:
37+
- staticcheck
38+
# TODO: migrate InfoCannedPolicy to InfoCannedPolicyV2
39+
- text: "SA1019:.*InfoCannedPolicy is deprecated"
40+
linters:
41+
- staticcheck
3042

3143
settings:
3244
errcheck:

‎.github/workflows/close-stale-issues-and-pull-requests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
stale:
1212
runs-on: ubuntu-latest
1313
steps:
14-
- uses: actions/stale@v10
14+
- uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
1515
with:
1616
days-before-issue-stale: 30
1717
stale-issue-message: "This issue has been automatically marked as stale due to inactivity. It will be closed in 7 days if no further activity occurs. Please comment or remove the stale label to keep it open."

‎.github/workflows/create-release-tag.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
tag: ${{ steps.version.outputs.new }}
3030
steps:
3131
- name: Checkout
32-
uses: actions/checkout@v6
32+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
3333
with:
3434
fetch-depth: 0
3535

‎.github/workflows/docs.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
if: github.event_name == 'pull_request'
2020
steps:
2121
- name: Check out code
22-
uses: actions/checkout@v6
22+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
2323

2424
- name: Verify all resources and data sources have doc templates
2525
run: |
@@ -65,13 +65,13 @@ jobs:
6565
GOOS: linux
6666
steps:
6767
- name: Check out code
68-
uses: actions/checkout@v6
68+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
6969
with:
7070
ref: ${{ github.head_ref || github.ref }}
7171
fetch-depth: 1
7272

7373
- name: Set up Go
74-
uses: actions/setup-go@v6
74+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
7575
with:
7676
go-version-file: "go.mod"
7777
cache: true
@@ -99,11 +99,11 @@ jobs:
9999
GOOS: linux
100100
steps:
101101
- name: Check out code
102-
uses: actions/checkout@v6
102+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
103103
with:
104104
fetch-depth: 1
105105

106106
- name: Markdown Link Validation
107-
uses: tcort/github-action-markdown-link-check@v1
107+
uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # v1
108108
with:
109109
config-file: "./.github/github-action-markdown-link-check-config.json"

‎.github/workflows/go.yml‎

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
security-events: write
2424
steps:
2525
- name: Check out the repository
26-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
26+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
2727

2828
- name: Set up Go
2929
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
@@ -38,16 +38,32 @@ jobs:
3838
args: --config .github/golangci.yml
3939

4040
- name: Run Gosec Security Scanner
41-
uses: securego/gosec@424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f # v2.22.11
41+
id: gosec
42+
uses: securego/gosec@bb17e422fc34bf4c0a2e5cab9d07dc45a68c040c # v2.24.7
43+
continue-on-error: true
4244
with:
43-
args: -fmt sarif -out gosec.sarif ./
45+
args: -fmt sarif -out gosec.sarif -exclude-dir=vendor -tests=false -exclude=G101 ./
4446

4547
- name: Upload security scan results to GitHub Security tab
46-
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
47-
if: always()
48+
uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
49+
if: always() && hashFiles('gosec.sarif') != ''
4850
with:
4951
sarif_file: gosec.sarif
5052

53+
- name: Fail on Gosec findings
54+
if: always() && steps.gosec.outcome == 'failure'
55+
run: |
56+
echo "## Gosec Security Scanner Found Issues" >> $GITHUB_STEP_SUMMARY
57+
echo "" >> $GITHUB_STEP_SUMMARY
58+
if [ -f gosec.sarif ]; then
59+
echo "| Rule | File | Line | Description |" >> $GITHUB_STEP_SUMMARY
60+
echo "|------|------|------|-------------|" >> $GITHUB_STEP_SUMMARY
61+
jq -r '.runs[0].results[] | "| \(.ruleId) | \(.locations[0].physicalLocation.artifactLocation.uri) | \(.locations[0].physicalLocation.region.startLine) | \(.message.text) |"' gosec.sarif >> $GITHUB_STEP_SUMMARY
62+
fi
63+
echo "" >> $GITHUB_STEP_SUMMARY
64+
echo "See the **Security** tab for full details." >> $GITHUB_STEP_SUMMARY
65+
exit 1
66+
5167
test:
5268
name: Test
5369
runs-on: ubuntu-latest
@@ -58,7 +74,7 @@ jobs:
5874
GOOS: linux
5975
steps:
6076
- name: Check out the repository
61-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
77+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
6278

6379
- name: Set up Go
6480
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
@@ -70,7 +86,7 @@ jobs:
7086
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
7187

7288
- name: Cache Docker layers
73-
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
89+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
7490
with:
7591
path: /tmp/.buildx-cache
7692
key: ${{ runner.os }}-buildx-${{ github.sha }}

‎.github/workflows/release.yml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -31,26 +31,26 @@ jobs:
3131
RELEASE_TAG: ${{ inputs.tag || github.ref_name }}
3232
steps:
3333
- name: Checkout
34-
uses: actions/checkout@v6
34+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
3535
with:
3636
fetch-depth: 0
3737
ref: ${{ env.RELEASE_TAG }}
3838

3939
- name: Set up Go
40-
uses: actions/setup-go@v6
40+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
4141
with:
4242
go-version-file: "go.mod"
4343
cache: true
4444

4545
- name: Import GPG key
4646
id: import_gpg
47-
uses: crazy-max/ghaction-import-gpg@v6.3.0
47+
uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0
4848
with:
4949
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
5050
passphrase: ${{ secrets.PASSPHRASE }}
5151

5252
- name: Run GoReleaser
53-
uses: goreleaser/goreleaser-action@v6
53+
uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
5454
with:
5555
version: "~> v2"
5656
args: release --clean --config .github/goreleaser.yml
@@ -60,14 +60,14 @@ jobs:
6060
GORELEASER_TAG: ${{ env.RELEASE_TAG }}
6161

6262
- name: Generate SBOM
63-
uses: anchore/sbom-action@v0
63+
uses: anchore/sbom-action@17ae1740179002c89186b61233e0f892c3118b11 # v0
6464
with:
6565
path: ./dist
6666
format: spdx-json
6767
output-file: sbom.spdx.json
6868

6969
- name: Upload SBOM to release
70-
uses: softprops/action-gh-release@v2
70+
uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2
7171
with:
7272
files: sbom.spdx.json
7373
tag_name: ${{ env.RELEASE_TAG }}

‎.github/workflows/security.yml‎

Lines changed: 47 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424

2525
steps:
2626
- name: Check out the repository
27-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
27+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
2828
with:
2929
fetch-depth: 0
3030

@@ -35,42 +35,73 @@ jobs:
3535
cache: true
3636

3737
- name: Run Gosec Security Scanner
38-
uses: securego/gosec@424fc4cd9c82ea0fd6bee9cd49c2db2c3cc0c93f # v2.22.11
38+
id: gosec
39+
uses: securego/gosec@bb17e422fc34bf4c0a2e5cab9d07dc45a68c040c # v2.24.7
40+
continue-on-error: true
3941
with:
40-
args: "-fmt sarif -out gosec.sarif ./..."
41-
config: .github/codeql/codeql-config.yml
42+
args: "-fmt sarif -out gosec.sarif -exclude-dir=vendor -tests=false -exclude=G101 ./..."
4243

43-
- name: Upload SARIF file
44-
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
45-
if: always()
44+
- name: Upload Gosec SARIF file
45+
uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
46+
if: always() && hashFiles('gosec.sarif') != ''
4647
with:
4748
sarif_file: gosec.sarif
48-
config-file: .github/codeql/codeql-config.yml
49+
50+
- name: Fail on Gosec findings
51+
if: always() && steps.gosec.outcome == 'failure'
52+
run: |
53+
echo "## Gosec Security Scanner Found Issues" >> $GITHUB_STEP_SUMMARY
54+
echo "" >> $GITHUB_STEP_SUMMARY
55+
if [ -f gosec.sarif ]; then
56+
echo "| Rule | File | Line | Description |" >> $GITHUB_STEP_SUMMARY
57+
echo "|------|------|------|-------------|" >> $GITHUB_STEP_SUMMARY
58+
jq -r '.runs[0].results[] | "| \(.ruleId) | \(.locations[0].physicalLocation.artifactLocation.uri) | \(.locations[0].physicalLocation.region.startLine) | \(.message.text) |"' gosec.sarif >> $GITHUB_STEP_SUMMARY
59+
fi
60+
echo "" >> $GITHUB_STEP_SUMMARY
61+
echo "See the **Security** tab for full details." >> $GITHUB_STEP_SUMMARY
62+
exit 1
4963
5064
- name: Run Trivy vulnerability scanner
51-
uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # 0.18.0
65+
id: trivy
66+
uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
67+
continue-on-error: true
5268
with:
5369
scan-type: "fs"
5470
scan-ref: "."
71+
version: "v0.69.2"
5572
format: "sarif"
5673
output: "trivy-results.sarif"
5774
ignore-unfixed: true
5875
severity: "CRITICAL,HIGH"
5976

60-
- name: Upload Trivy scan results to GitHub Security tab
61-
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
62-
if: always()
77+
- name: Upload Trivy SARIF file
78+
uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
79+
if: always() && hashFiles('trivy-results.sarif') != ''
6380
with:
6481
sarif_file: "trivy-results.sarif"
6582

83+
- name: Fail on Trivy findings
84+
if: always() && steps.trivy.outcome == 'failure'
85+
run: |
86+
echo "## Trivy Vulnerability Scanner Found Issues" >> $GITHUB_STEP_SUMMARY
87+
echo "" >> $GITHUB_STEP_SUMMARY
88+
if [ -f trivy-results.sarif ]; then
89+
echo "| Rule | File | Severity | Description |" >> $GITHUB_STEP_SUMMARY
90+
echo "|------|------|----------|-------------|" >> $GITHUB_STEP_SUMMARY
91+
jq -r '.runs[0].results[]? | "| \(.ruleId) | \(.locations[0].physicalLocation.artifactLocation.uri) | \(.level) | \(.message.text[:100]) |"' trivy-results.sarif >> $GITHUB_STEP_SUMMARY
92+
fi
93+
echo "" >> $GITHUB_STEP_SUMMARY
94+
echo "See the **Security** tab for full details." >> $GITHUB_STEP_SUMMARY
95+
exit 1
96+
6697
dependency-check:
6798
name: Dependency Security Check
6899
runs-on: ubuntu-latest
69100
timeout-minutes: 15
70101

71102
steps:
72103
- name: Check out the repository
73-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
104+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
74105

75106
- name: Set up Go
76107
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
@@ -99,7 +130,7 @@ jobs:
99130

100131
steps:
101132
- name: Check out the repository
102-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
133+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
103134
with:
104135
fetch-depth: 0
105136

@@ -130,7 +161,7 @@ jobs:
130161

131162
steps:
132163
- name: Checkout repository
133-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
164+
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v6.0.2
134165
with:
135166
persist-credentials: false
136167

@@ -142,7 +173,7 @@ jobs:
142173
publish_results: true
143174

144175
- name: Upload SARIF results to GitHub
145-
uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
176+
uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4.32.5
146177
with:
147178
sarif_file: results.sarif
148179

0 commit comments

Comments
 (0)