Skip to content

Commit 8653dba

Browse files
dadrusdadrus
authored
ci: Workflows fixed, hardened and updated to allow automated releases (#109)
1 parent 1bbd173 commit 8653dba

7 files changed

Lines changed: 136 additions & 17 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 50 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,37 +5,56 @@ on:
55
branches: [ main ]
66
pull_request:
77
branches: [ main ]
8-
workflow_dispatch:
8+
9+
env:
10+
GO_VERSION: "1.25.0"
11+
GOLANGCI_LINT_VERSION: "v2.9.0"
12+
13+
permissions: {}
914

1015
jobs:
1116
lint-code:
1217
name: Run Linters
1318
runs-on: ubuntu-latest
1419
permissions:
20+
contents: read
1521
pull-requests: write
22+
timeout-minutes: 10
1623
steps:
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
26+
with:
27+
egress-policy: audit
1728
- name: Checkout repository
1829
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
1930
with:
20-
fetch-depth: 0
31+
persist-credentials: false
2132
- name: Review code
2233
uses: reviewdog/action-golangci-lint@c76cceaaab89abe74e649d2e34c6c9adc26662d2 # v2.10.0
2334
with:
24-
go_version: 1.25.0
25-
golangci_lint_version: v2.4.0
35+
go_version: "${{ env.GO_VERSION }}"
36+
golangci_lint_version: "${{ env.GOLANGCI_LINT_VERSION }}"
2637
reporter: github-pr-review
27-
fail_on_error: true
38+
fail_level: error
2839

2940
check-licenses:
3041
name: Check Licenses
3142
runs-on: ubuntu-latest
43+
permissions:
44+
contents: read
3245
steps:
46+
- name: Harden Runner
47+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
48+
with:
49+
egress-policy: audit
3350
- name: Checkout repository
3451
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
52+
with:
53+
persist-credentials: false
3554
- name: Set up Go
3655
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3756
with:
38-
go-version: 1.25.0
57+
go-version: "${{ env.GO_VERSION }}"
3958
- name: Get google/go-licenses package
4059
run: go install github.com/google/go-licenses@v1.6.0
4160
- name: Check the licenses
@@ -45,22 +64,41 @@ jobs:
4564
test:
4665
name: Run Tests
4766
runs-on: ubuntu-latest
67+
permissions:
68+
contents: read
4869
steps:
70+
- name: Harden Runner
71+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
72+
with:
73+
egress-policy: audit
4974
- name: Checkout repository
5075
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
5176
with:
52-
ref: ${{ github.head_ref }}
77+
persist-credentials: false
5378
fetch-depth: 0
5479
- name: Set up Go
5580
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
5681
with:
57-
go-version: 1.25.0
82+
go-version: "${{ env.GO_VERSION }}"
83+
- name: Install go-junit-report
84+
run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0
5885
- name: Execute tests
5986
run: |
60-
go test -v -gcflags=all=-l -cover ./... -coverprofile coverage.out -coverpkg ./...
61-
- name: Upload code coverage report
62-
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
87+
set -o pipefail
88+
go test -v -coverprofile=coverage.cov -coverpkg=./... ./... 2>&1 | \
89+
tee >(go-junit-report -set-exit-code > junit-report.xml)
90+
- name: Upload test results to Codecov
91+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
92+
if: always() && !cancelled()
93+
with:
94+
report_type: test_results
95+
files: junit-report.xml
96+
verbose: true
97+
token: ${{ secrets.CODECOV_TOKEN }}
98+
- name: Upload code coverage report to Codecov
99+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
63100
with:
64-
files: coverage.out
101+
report_type: coverage
102+
files: coverage.cov
65103
verbose: true
66104
token: ${{ secrets.CODECOV_TOKEN }}

‎.github/workflows/please-release.yaml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: please-release
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
8+
permissions: {}
9+
10+
jobs:
11+
create-release:
12+
runs-on: ubuntu-24.04
13+
permissions:
14+
pull-requests: write
15+
contents: write
16+
steps:
17+
- name: Harden Runner
18+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
19+
with:
20+
egress-policy: audit
21+
- name: Please Release
22+
id: create_release
23+
uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
24+
with:
25+
target-branch: ${{ github.ref_name }}
26+
token: ${{ secrets.RELEASE_TOKEN }}
27+
skip-github-pull-request: true
28+
- name: Please Release PR
29+
if: steps.create_release.outputs.release_created == false
30+
uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
31+
with:
32+
target-branch: ${{ github.ref_name }}
33+
token: ${{ secrets.GITHUB_TOKEN }}
34+
skip-github-release: true

‎.github/workflows/security.yaml‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
name: "Security Scan"
22

3+
env:
4+
GO_VERSION: "1.25.0"
5+
36
on:
47
push:
58
branches: [main]
@@ -8,17 +11,24 @@ on:
811
schedule:
912
- cron: '34 0 * * 6'
1013

11-
permissions: read-all
14+
permissions: {}
1215

1316
jobs:
1417
trivy-scan:
1518
name: Trivy Scan
1619
runs-on: ubuntu-24.04
1720
permissions:
21+
contents: read
1822
security-events: write
1923
steps:
24+
- name: Harden Runner
25+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
26+
with:
27+
egress-policy: audit
2028
- name: Checkout repository
2129
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
30+
with:
31+
persist-credentials: false
2232
- name: Run Trivy vulnerability scanner in repo mode
2333
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # master
2434
with:
@@ -37,14 +47,21 @@ jobs:
3747
name: CodeQL Scan
3848
runs-on: ubuntu-latest
3949
permissions:
50+
contents: read
4051
security-events: write
4152
steps:
53+
- name: Harden Runner
54+
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
55+
with:
56+
egress-policy: audit
4257
- name: Checkout repository
4358
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
59+
with:
60+
persist-credentials: false
4461
- name: Set up Go
4562
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
4663
with:
47-
go-version: 1.25.0
64+
go-version: "${{ env.GO_VERSION }}"
4865
- name: Initialize CodeQL
4966
uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
5067
with:

‎.release-please-manifest.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
".": "0.9.0"
3+
}

‎CHANGELOG.md‎

Whitespace-only changes.

‎release-please-config.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"bump-minor-pre-major": true,
3+
"draft": false,
4+
"release-type": "go",
5+
"changelog-sections": [
6+
{ "type": "feat", "section": "Features", "hidden": false },
7+
{ "type": "refactor", "section": "Code Refactorings", "hidden": true },
8+
{ "type": "perf", "section": "Performance Improvements", "hidden": false },
9+
{ "type": "fix", "section": "Bug Fixes", "hidden": false },
10+
{ "type": "docs", "section": "Documentation", "hidden": false },
11+
{ "type": "deps", "section": "Dependencies", "hidden": false }
12+
],
13+
"packages": {
14+
".": {}
15+
},
16+
"bootstrap-sha": "1bbd17383c654ec6c3885299826543f37f6aac9a"
17+
}

‎renovate.json‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
"config:recommended",
55
":semanticCommitScopeDisabled",
66
":semanticCommitTypeAll(chore)",
7+
"docker:pinDigests",
78
"helpers:pinGitHubActionDigests",
89
":pinDevDependencies"
910
],
@@ -13,12 +14,21 @@
1314
"golang"
1415
],
1516
"semanticCommitType": "deps"
17+
},
18+
{
19+
"matchManagers": [
20+
"github-actions"
21+
],
22+
"matchFileNames": [
23+
".github/workflows/release.yaml"
24+
],
25+
"matchPackageNames": [
26+
"slsa-framework/slsa-github-generator"
27+
],
28+
"pinDigests": false
1629
}
1730
],
1831
"configMigration": true,
19-
"baseBranchPatterns": [
20-
"main"
21-
],
2232
"assigneesFromCodeOwners": true,
2333
"addLabels": [
2434
"dependency"

0 commit comments

Comments
 (0)