chore(deps): upgrade syft to v1.45.1 and grype to v0.114.0 #147
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: '15 4 * * 3' # Wednesday 04:15 UTC | |
| permissions: read-all | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| name: Analyze Go | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| - name: Detect changed file types | |
| id: changes | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [ "${{ github.event_name }}" = "schedule" ]; then | |
| echo "go=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| BASE="${{ github.event.pull_request.base.sha }}" | |
| git cat-file -e "$BASE" 2>/dev/null || git fetch --no-tags --depth=1 origin "$BASE" | |
| CHANGED=$(git diff --name-only "$BASE...HEAD") | |
| else | |
| BASE="${{ github.event.before }}" | |
| if [ -n "$BASE" ] && [ "$BASE" != "0000000000000000000000000000000000000000" ] && git cat-file -e "$BASE" 2>/dev/null; then | |
| CHANGED=$(git diff --name-only "$BASE" HEAD) | |
| else | |
| CHANGED=$(git diff --name-only HEAD~1 HEAD 2>/dev/null || git ls-files) | |
| fi | |
| fi | |
| echo "Changed files:" | |
| echo "$CHANGED" | |
| go=false | |
| if grep -E '(\.go$|^go\.(mod|sum)$)' <<<"$CHANGED" >/dev/null; then go=true; fi | |
| # //go:embed inputs (see internal/report/html.go) — changes here | |
| # alter the compiled binary even when no .go file changes. | |
| if grep -E '^internal/report/(templates|assets)/' <<<"$CHANGED" >/dev/null; then go=true; fi | |
| if grep -E '^\.github/workflows/codeql\.yaml$' <<<"$CHANGED" >/dev/null; then go=true; fi | |
| echo "go=$go" >> "$GITHUB_OUTPUT" | |
| - name: Setup Go | |
| if: steps.changes.outputs.go == 'true' | |
| uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| cache-dependency-path: go.sum | |
| - name: Initialize CodeQL | |
| if: steps.changes.outputs.go == 'true' | |
| uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | |
| with: | |
| languages: go | |
| - name: Autobuild | |
| if: steps.changes.outputs.go == 'true' | |
| uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | |
| - name: Perform CodeQL analysis | |
| if: steps.changes.outputs.go == 'true' | |
| uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 |