2fd44174ce
Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [github/codeql-action](https://github.com/github/codeql-action) | `3.28.8` | `3.28.9` | | [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) | `6.3.2` | `6.5.0` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.1.0` | `6.2.1` | | [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) | `3.3.0` | `3.4.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.7.0` | `3.8.0` | | [slsa-framework/slsa-verifier](https://github.com/slsa-framework/slsa-verifier) | `2.6.0` | `2.7.0` | Updates `github/codeql-action` from 3.28.8 to 3.28.9 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/dd746615b3b9d728a6a37ca2045b68ca76d4841a...9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0) Updates `golangci/golangci-lint-action` from 6.3.2 to 6.5.0 - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/051d91933864810ecd5e2ea2cfd98f6a5bca5347...2226d7cb06a077cd73e56eedd38eecad18e5d837) Updates `goreleaser/goreleaser-action` from 6.1.0 to 6.2.1 - [Release notes](https://github.com/goreleaser/goreleaser-action/releases) - [Commits](https://github.com/goreleaser/goreleaser-action/compare/9ed2f89a662bf1735a48bc8557fd212fa902bebf...90a3faa9d0182683851fbfa97ca1a2cb983bfca3) Updates `docker/setup-qemu-action` from 3.3.0 to 3.4.0 - [Release notes](https://github.com/docker/setup-qemu-action/releases) - [Commits](https://github.com/docker/setup-qemu-action/compare/53851d14592bedcffcf25ea515637cff71ef929a...4574d27a4764455b42196d70a065bc6853246a25) Updates `sigstore/cosign-installer` from 3.7.0 to 3.8.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da...c56c2d3e59e4281cc41dea2217323ba5694b171e) Updates `slsa-framework/slsa-verifier` from 2.6.0 to 2.7.0 - [Release notes](https://github.com/slsa-framework/slsa-verifier/releases) - [Changelog](https://github.com/slsa-framework/slsa-verifier/blob/main/RELEASE.md) - [Commits](https://github.com/slsa-framework/slsa-verifier/compare/3714a2a4684014deb874a0e737dffa0ee02dd647...6657aada084353c65e5dde35394b1a010289fab0) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: github-actions - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: goreleaser/goreleaser-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/setup-qemu-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: sigstore/cosign-installer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: slsa-framework/slsa-verifier dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
47 lines
1.3 KiB
YAML
47 lines
1.3 KiB
YAML
name: Code Scanning
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- '!dependabot/**'
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: "0 0 * * 0"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
CodeQL-Build:
|
|
permissions:
|
|
actions: read # for github/codeql-action/init to get workflow details
|
|
contents: read # for actions/checkout to fetch code
|
|
security-events: write # for github/codeql-action/analyze to upload SARIF results
|
|
runs-on: ubuntu-24.04
|
|
if: ${{ !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Check out code
|
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
|
|
- name: setup go
|
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: true
|
|
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
|
|
with:
|
|
languages: go
|
|
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
|