Skip to content

chore(deps): update golang version (batch update) to v1.23.1 #1721

chore(deps): update golang version (batch update) to v1.23.1

chore(deps): update golang version (batch update) to v1.23.1 #1721

Workflow file for this run

name: Security
on:
workflow_dispatch:
schedule:
- cron: '0 12 * * *'
push:
branches:
- 'main'
- 'renovate/**'
tags:
- 'v*.*.*'
pull_request:
branches:
- 'main'
permissions:
contents: read
jobs:
govulncheck:
name: Govulncheck
runs-on: ubuntu-latest
steps:
- name: Checkout GitHub Repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Analyze source code
uses: golang/govulncheck-action@dd0578b371c987f96d1185abb54344b44352bd58 # v1.0.3
with:
go-version-file: './go.mod'
repo-checkout: false
trivy:
name: Trivy
if: ${{ github.event.schedule || (github.event_name == 'push' && github.ref_name == 'main') }}
runs-on: ubuntu-latest
permissions:
# For actions/checkout to fetch code
contents: read
# For github/codeql-action/upload-sarif to upload SARIF results
security-events: write
steps:
- name: Checkout GitHub Repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Build image from Dockerfile
run: |
docker build --tag juanjjaramillo/testbed:${{ github.sha }} .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
with:
image-ref: 'juanjjaramillo/testbed:${{ github.sha }}'
ignore-unfixed: true
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
with:
sarif_file: 'trivy-results.sarif'
openssf:
name: OpenSSF Scorecard
if: ${{ github.event.schedule || (github.event_name == 'push' && github.ref_name == 'main') }}
runs-on: ubuntu-latest
permissions:
# Needed to publish results and get a badge (see publish_results below)
id-token: write
# For actions/checkout to fetch code
contents: read
# For github/codeql-action/upload-sarif to upload SARIF results
security-events: write
steps:
- name: Checkout GitHub Repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
with:
persist-credentials: false
- name: Run analysis
uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
with:
results_file: results.sarif
results_format: sarif
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
# - you want to enable the Branch-Protection check on a *public* repository, or
# - you are installing Scorecard on a *private* repository
# To create the PAT, follow the steps in
# https://github.com/ossf/scorecard-action#authentication-with-pat
repo_token: ${{ secrets.SCORECARD_TOKEN }}
# Public repositories:
# - Publish results to OpenSSF REST API for easy access by consumers
# - Allows the repository to include the Scorecard badge.
# - See https://github.com/ossf/scorecard-action#publishing-results
# For private repositories:
# - `publish_results` will always be set to `false`, regardless
# of the value entered here
publish_results: true
- name: Upload artifact
uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
with:
name: SARIF file
path: results.sarif
retention-days: 5
- name: Upload OSSF Scorecard scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@4fa2a7953630fd2f3fb380f21be14ede0169dd4f # v3.25.12
with:
sarif_file: results.sarif