go/goreleaser
go/goreleaser
1
0
Fork 0
mirror of https://github.com/goreleaser/goreleaser.git synced 2025-01-26 04:22:05 +02:00
Code Issues Releases Activity
goreleaser/.github/workflows/codeql.yml

26 lines
687 B
YAML
Raw Normal View History

chore(ci): run codeql analysis (#2740) Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2021-12-06 09:45:28 -03:00
name: "codeql"
on:
push:
branches: [ main ]
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
contents: read
steps:
chore(deps): bump actions/checkout from 3.1.0 to 3.2.0 (#3636) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.1.0 to 3.2.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v3.2.0</h2> <h2>What's Changed</h2> <ul> <li>Add GitHub Action to perform release by <a href="https://github.com/rentziass"><code>@​rentziass</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/942">actions/checkout#942</a></li> <li>Fix status badge by <a href="https://github.com/ScottBrenner"><code>@​ScottBrenner</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/967">actions/checkout#967</a></li> <li>Replace datadog/squid with ubuntu/squid Docker image by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/1002">actions/checkout#1002</a></li> <li>Wrap pipeline commands for submoduleForeach in quotes by <a href="https://github.com/jokreliable"><code>@​jokreliable</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/964">actions/checkout#964</a></li> <li>Update <code>@​actions/io</code> to 1.1.2 by <a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/1029">actions/checkout#1029</a></li> <li>Upgrading version to 3.2.0 by <a href="https://github.com/vmjoseph"><code>@​vmjoseph</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/1039">actions/checkout#1039</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/ScottBrenner"><code>@​ScottBrenner</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/967">actions/checkout#967</a></li> <li><a href="https://github.com/cory-miller"><code>@​cory-miller</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/1002">actions/checkout#1002</a></li> <li><a href="https://github.com/jokreliable"><code>@​jokreliable</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/964">actions/checkout#964</a></li> <li><a href="https://github.com/vmjoseph"><code>@​vmjoseph</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/1039">actions/checkout#1039</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3...v3.2.0">https://github.com/actions/checkout/compare/v3...v3.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/755da8c3cf115ac066823e79a1e1788f8940201b"><code>755da8c</code></a> 3.2.0 (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/1039">#1039</a>)</li> <li><a href="https://github.com/actions/checkout/commit/26d48e8ea150211a9bc3b1f0c20448599687d926"><code>26d48e8</code></a> Update <code>@​actions/io</code> to 1.1.2 (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/1029">#1029</a>)</li> <li><a href="https://github.com/actions/checkout/commit/bf085276cecdb0cc76fbbe0687a5a0e786646936"><code>bf08527</code></a> wrap pipeline commands for submoduleForeach in quotes (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/964">#964</a>)</li> <li><a href="https://github.com/actions/checkout/commit/5c3ccc22eb2c950a0fa5bc7c47190d8e3f7e681a"><code>5c3ccc2</code></a> Replace datadog/squid with ubuntu/squid Docker image (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/1002">#1002</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1f9a0c22da41e6ebfa534300ef656657ea2c6707"><code>1f9a0c2</code></a> README - fix status badge (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/967">#967</a>)</li> <li><a href="https://github.com/actions/checkout/commit/8230315d06ad95c617244d2f265d237a1682d445"><code>8230315</code></a> Add workflow to update a main version (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/942">#942</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8...755da8c3cf115ac066823e79a1e1788f8940201b">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=3.1.0&new-version=3.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-13 09:44:45 -03:00
- uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
chore(deps): bump actions/setup-go from 3.3.1 to 3.4.0 (#3616) [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3.3.1 to 3.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>Add support for go.work and pass the token input through on GHES</h2> <p>In scope of this release we added <a href="https://github-redirect.dependabot.com/actions/setup-go/pull/283">support for go.work file to pass it in go-version-file input</a>.</p> <pre lang="yaml"><code>steps: - uses: actions/checkout@v3 - uses: actions/setup-go@v3 with: go-version-file: go.work - run: go run hello.go </code></pre> <p>Besides, we added support to <a href="https://github-redirect.dependabot.com/actions/setup-go/pull/277">pass the token input through on GHES</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/d0a58c1c4d2b25278816e339b944508c875f3613"><code>d0a58c1</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/setup-go/issues/294">#294</a> from JamesMGreene/patch-1</li> <li><a href="https://github.com/actions/setup-go/commit/3dcd9d6eb339e94c0879d6d7e8fb170515ae48aa"><code>3dcd9d6</code></a> Update to latest <code>actions/publish-action</code></li> <li><a href="https://github.com/actions/setup-go/commit/e983b65a44843e966b4f802da5afe51c501fed7c"><code>e983b65</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/setup-go/issues/283">#283</a> from koba1t/add_support_gowork_for_go-version-file</li> <li><a href="https://github.com/actions/setup-go/commit/27b43e1b0d324a64f8fcc14f931e45ae178f6b19"><code>27b43e1</code></a> Pass the token input through on GHES (<a href="https://github-redirect.dependabot.com/actions/setup-go/issues/277">#277</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/7678c83214c8f844360ea3f399163b0010119bf9"><code>7678c83</code></a> add support gowork for go-version-file</li> <li>See full diff in <a href="https://github.com/actions/setup-go/compare/c4a742cab115ed795e34d4513e2cf7d472deb55f...d0a58c1c4d2b25278816e339b944508c875f3613">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-go&package-manager=github_actions&previous-version=3.3.1&new-version=3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-02 09:09:52 -03:00
- uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3
fix(ci): codeql use go 1.19 (#3570) Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-11-18 01:02:33 -03:00
with:
go-version: '>=1.19.3'
cache: true
chore(deps): bump github/codeql-action from 2.1.35 to 2.1.36 (#3629) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.35 to 2.1.36. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>2.1.36 - 08 Dec 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.5. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1412">#1412</a></li> <li>Add a step that tries to upload a SARIF file for the workflow run when that workflow run fails. This will help better surface failed code scanning workflow runs. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1393">#1393</a></li> <li>Python automatic dependency installation will no longer consider dependecy code installed in venv as user-written, for projects using Poetry that specify <code>virtualenvs.in-project = true</code> in their <code>poetry.toml</code>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1419">#1419</a>.</li> </ul> <h2>2.1.35 - 01 Dec 2022</h2> <p>No user facing changes.</p> <h2>2.1.34 - 25 Nov 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.4. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1391">#1391</a></li> <li>Fixed a bug where some the <code>init</code> action and the <code>analyze</code> action would have different sets of experimental feature flags enabled. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1384">#1384</a></li> </ul> <h2>2.1.33 - 16 Nov 2022</h2> <ul> <li>Go is now analyzed in the same way as other compiled languages such as C/C++, C#, and Java. This completes the rollout of the feature described in <a href="https://github.com/github/codeql-action/blob/main/#2127---06-oct-2022">CodeQL Action version 2.1.27</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1322">#1322</a></li> <li>Bump the minimum CodeQL bundle version to 2.6.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1358">#1358</a></li> </ul> <h2>2.1.32 - 14 Nov 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1348">#1348</a></li> <li>Update the ML-powered additional query pack for JavaScript to version 0.4.0. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1351">#1351</a></li> </ul> <h2>2.1.31 - 04 Nov 2022</h2> <ul> <li>The <code>rb/weak-cryptographic-algorithm</code> Ruby query has been updated to no longer report uses of hash functions such as <code>MD5</code> and <code>SHA1</code> even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. For more information, see the corresponding change in the <a href="https://github-redirect.dependabot.com/github/codeql/pull/11129">github/codeql repository</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1344">#1344</a></li> </ul> <h2>2.1.30 - 02 Nov 2022</h2> <ul> <li>Improve the error message when using CodeQL bundle version 2.7.2 and earlier in a workflow that runs on a runner image such as <code>ubuntu-22.04</code> that uses glibc version 2.34 and later. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1334">#1334</a></li> </ul> <h2>2.1.29 - 26 Oct 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.2. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1320">#1320</a></li> </ul> <h2>2.1.28 - 18 Oct 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.1. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1294">#1294</a></li> <li>Replace uses of GitHub Actions command <code>set-output</code> because it is now deprecated. See more information in the <a href="https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/">GitHub Changelog</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1301">#1301</a></li> </ul> <h2>2.1.27 - 06 Oct 2022</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/a669cc5936cc5e1b6a362ec1ff9e410dc570d190"><code>a669cc5</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1428">#1428</a> from github/update-v2.1.36-2b971a70</li> <li><a href="https://github.com/github/codeql-action/commit/aab7a26877ad9a1c82db0d9dd00ce18a8927be53"><code>aab7a26</code></a> Update changelog for v2.1.36</li> <li><a href="https://github.com/github/codeql-action/commit/2b971a70bb71cb7c7a27fac253a74bd56dd14a15"><code>2b971a7</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1426">#1426</a> from github/dependabot/pip/python-setup/tests/poetry...</li> <li><a href="https://github.com/github/codeql-action/commit/bf944d782bab2be2b7335e39e4bc27e214931a01"><code>bf944d7</code></a> Bump certifi in /python-setup/tests/poetry/requests-3</li> <li><a href="https://github.com/github/codeql-action/commit/566a5e672777f8b509fa512365fd37118bf27e78"><code>566a5e6</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1424">#1424</a> from github/dependabot/pip/python-setup/tests/pipenv...</li> <li><a href="https://github.com/github/codeql-action/commit/10c89976dc22c40837591c50e0e43d2161f873e1"><code>10c8997</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1421">#1421</a> from github/cklin/fix-update-required-checks-sha</li> <li><a href="https://github.com/github/codeql-action/commit/8121f62c544108b9fc029af80c1305c04e50d34d"><code>8121f62</code></a> Bump certifi in /python-setup/tests/pipenv/python-3.8</li> <li><a href="https://github.com/github/codeql-action/commit/104319fe986f1f3523b3489de5eeed3f4b7f9ad1"><code>104319f</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1423">#1423</a> from github/dependabot/pip/python-setup/tests/pipenv...</li> <li><a href="https://github.com/github/codeql-action/commit/aba18b82f7b4e8934e2197dd1f1ea61adba24a39"><code>aba18b8</code></a> Bump certifi in /python-setup/tests/pipenv/requests-3</li> <li><a href="https://github.com/github/codeql-action/commit/4a5ad5af185095095ba8a89c81625ec054e3e533"><code>4a5ad5a</code></a> update-required-checks.sh: ignore check-expected-release-files</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/b2a92eb56d8cb930006a1c6ed86b0782dd8a4297...a669cc5936cc5e1b6a362ec1ff9e410dc570d190">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.1.35&new-version=2.1.36)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-09 13:53:16 -03:00
- uses: github/codeql-action/init@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2
- uses: github/codeql-action/autobuild@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2
- uses: github/codeql-action/analyze@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2
Reference in New Issue Copy Permalink