go/goreleaser
go/goreleaser
1
0
Fork 0
mirror of https://github.com/goreleaser/goreleaser.git synced 2025-01-26 04:22:05 +02:00
Code Issues Releases Activity
goreleaser/.github/workflows/codeql.yml

26 lines
687 B
YAML
Raw Normal View History

chore(ci): run codeql analysis (#2740) Signed-off-by: Carlos A Becker <caarlos0@gmail.com>
2021-12-06 09:45:28 -03:00
name: "codeql"
on:
push:
branches: [ main ]
jobs:
analyze:
name: analyze
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
contents: read
steps:
chore(deps): bump actions/checkout from 3.0.2 to 3.1.0 (#3441) Bumps [actions/checkout](https://github.com/actions/checkout) from 3.0.2 to 3.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v3.1.0</h2> <h2>What's Changed</h2> <ul> <li>Inject GitHub host to be able to clone from another GitHub instance by <a href="https://github.com/peter-murray"><code>@​peter-murray</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/922">actions/checkout#922</a></li> <li>Bump <code>@​actions/core</code> to 1.10.0 by <a href="https://github.com/rentziass"><code>@​rentziass</code></a> in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/939">actions/checkout#939</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/peter-murray"><code>@​peter-murray</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/922">actions/checkout#922</a></li> <li><a href="https://github.com/rentziass"><code>@​rentziass</code></a> made their first contribution in <a href="https://github-redirect.dependabot.com/actions/checkout/pull/939">actions/checkout#939</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v3.0.2...v3.1.0">https://github.com/actions/checkout/compare/v3.0.2...v3.1.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v3.1.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/939">Use <code>@​actions/core</code> <code>saveState</code> and <code>getState</code></a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/922">Add <code>github-server-url</code> input</a></li> </ul> <h2>v3.0.2</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/770">Add input <code>set-safe-directory</code></a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/762">Fixed an issue where checkout failed to run in container jobs due to the new git setting <code>safe.directory</code></a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/744">Bumped various npm package versions</a></li> </ul> <h2>v3.0.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/689">Update to node 16</a></li> </ul> <h2>v2.3.1</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/284">Fix default branch resolution for .wiki and when using SSH</a></li> </ul> <h2>v2.3.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/278">Fallback to the default branch</a></li> </ul> <h2>v2.2.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/258">Fetch all history for all tags and branches when fetch-depth=0</a></li> </ul> <h2>v2.1.1</h2> <ul> <li>Changes to support GHES (<a href="https://github-redirect.dependabot.com/actions/checkout/pull/236">here</a> and <a href="https://github-redirect.dependabot.com/actions/checkout/pull/248">here</a>)</li> </ul> <h2>v2.1.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/191">Group output</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/199">Changes to support GHES alpha release</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/184">Persist core.sshCommand for submodules</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/163">Add support ssh</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/179">Convert submodule SSH URL to HTTPS, when not using SSH</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/157">Add submodule support</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/144">Follow proxy settings</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/141">Fix ref for pr closed event when a pr is merged</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/128">Fix issue checking detached when git less than 2.22</a></li> </ul> <h2>v2.0.0</h2> <ul> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/108">Do not pass cred on command line</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/107">Add input persist-credentials</a></li> <li><a href="https://github-redirect.dependabot.com/actions/checkout/pull/104">Fallback to REST API to download repo</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8"><code>93ea575</code></a> Prepare release v3.1.0 (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/940">#940</a>)</li> <li><a href="https://github.com/actions/checkout/commit/6a84743051be17cee477b0a26bd866b5dba996e4"><code>6a84743</code></a> Bump <code>@​actions/core</code> to 1.10.0 (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/939">#939</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e6d535c99c374d0c3f6d8cd8086a57b43c6c700a"><code>e6d535c</code></a> Inject GitHub host to be able to clone from another GitHub instance (<a href="https://github-redirect.dependabot.com/actions/checkout/issues/922">#922</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/2541b1294d2704b0964813337f33b291d3f8596b...93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=3.0.2&new-version=3.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-10-05 09:38:34 -03:00
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3
chore(deps): bump actions/setup-go from 3.3.1 to 3.4.0 (#3616) [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3.3.1 to 3.4.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>Add support for go.work and pass the token input through on GHES</h2> <p>In scope of this release we added <a href="https://github-redirect.dependabot.com/actions/setup-go/pull/283">support for go.work file to pass it in go-version-file input</a>.</p> <pre lang="yaml"><code>steps: - uses: actions/checkout@v3 - uses: actions/setup-go@v3 with: go-version-file: go.work - run: go run hello.go </code></pre> <p>Besides, we added support to <a href="https://github-redirect.dependabot.com/actions/setup-go/pull/277">pass the token input through on GHES</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/d0a58c1c4d2b25278816e339b944508c875f3613"><code>d0a58c1</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/setup-go/issues/294">#294</a> from JamesMGreene/patch-1</li> <li><a href="https://github.com/actions/setup-go/commit/3dcd9d6eb339e94c0879d6d7e8fb170515ae48aa"><code>3dcd9d6</code></a> Update to latest <code>actions/publish-action</code></li> <li><a href="https://github.com/actions/setup-go/commit/e983b65a44843e966b4f802da5afe51c501fed7c"><code>e983b65</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/actions/setup-go/issues/283">#283</a> from koba1t/add_support_gowork_for_go-version-file</li> <li><a href="https://github.com/actions/setup-go/commit/27b43e1b0d324a64f8fcc14f931e45ae178f6b19"><code>27b43e1</code></a> Pass the token input through on GHES (<a href="https://github-redirect.dependabot.com/actions/setup-go/issues/277">#277</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/7678c83214c8f844360ea3f399163b0010119bf9"><code>7678c83</code></a> add support gowork for go-version-file</li> <li>See full diff in <a href="https://github.com/actions/setup-go/compare/c4a742cab115ed795e34d4513e2cf7d472deb55f...d0a58c1c4d2b25278816e339b944508c875f3613">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-go&package-manager=github_actions&previous-version=3.3.1&new-version=3.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-02 09:09:52 -03:00
- uses: actions/setup-go@d0a58c1c4d2b25278816e339b944508c875f3613 # v3
fix(ci): codeql use go 1.19 (#3570) Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com> Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
2022-11-18 01:02:33 -03:00
with:
go-version: '>=1.19.3'
cache: true
chore(deps): bump github/codeql-action from 2.1.33 to 2.1.35 (#3614) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.33 to 2.1.35. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>2.1.35 - 01 Dec 2022</h2> <p>No user facing changes.</p> <h2>2.1.34 - 25 Nov 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.4. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1391">#1391</a></li> <li>Fixed a bug where some the <code>init</code> action and the <code>analyze</code> action would have different sets of experimental feature flags enabled. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1384">#1384</a></li> </ul> <h2>2.1.33 - 16 Nov 2022</h2> <ul> <li>Go is now analyzed in the same way as other compiled languages such as C/C++, C#, and Java. This completes the rollout of the feature described in <a href="https://github.com/github/codeql-action/blob/main/#2127---06-oct-2022">CodeQL Action version 2.1.27</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1322">#1322</a></li> <li>Bump the minimum CodeQL bundle version to 2.6.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1358">#1358</a></li> </ul> <h2>2.1.32 - 14 Nov 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.3. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1348">#1348</a></li> <li>Update the ML-powered additional query pack for JavaScript to version 0.4.0. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1351">#1351</a></li> </ul> <h2>2.1.31 - 04 Nov 2022</h2> <ul> <li>The <code>rb/weak-cryptographic-algorithm</code> Ruby query has been updated to no longer report uses of hash functions such as <code>MD5</code> and <code>SHA1</code> even if they are known to be weak. These hash algorithms are used very often in non-sensitive contexts, making the query too imprecise in practice. For more information, see the corresponding change in the <a href="https://github-redirect.dependabot.com/github/codeql/pull/11129">github/codeql repository</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1344">#1344</a></li> </ul> <h2>2.1.30 - 02 Nov 2022</h2> <ul> <li>Improve the error message when using CodeQL bundle version 2.7.2 and earlier in a workflow that runs on a runner image such as <code>ubuntu-22.04</code> that uses glibc version 2.34 and later. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1334">#1334</a></li> </ul> <h2>2.1.29 - 26 Oct 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.2. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1320">#1320</a></li> </ul> <h2>2.1.28 - 18 Oct 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.1. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1294">#1294</a></li> <li>Replace uses of GitHub Actions command <code>set-output</code> because it is now deprecated. See more information in the <a href="https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/">GitHub Changelog</a>. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1301">#1301</a></li> </ul> <h2>2.1.27 - 06 Oct 2022</h2> <ul> <li>We are rolling out a feature of the CodeQL Action in October 2022 that changes the way that Go code is analyzed to be more consistent with other compiled languages like C/C++, C#, and Java. You do not need to alter your code scanning workflows. If you encounter any problems, please <a href="https://github.com/github/codeql-action/issues">file an issue</a> or open a private ticket with GitHub Support and request an escalation to engineering.</li> </ul> <h2>2.1.26 - 29 Sep 2022</h2> <ul> <li>Update default CodeQL bundle version to 2.11.0. <a href="https://github-redirect.dependabot.com/github/codeql-action/pull/1267">#1267</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b2a92eb56d8cb930006a1c6ed86b0782dd8a4297"><code>b2a92eb</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1406">#1406</a> from github/update-v2.1.35-9af9a11d</li> <li><a href="https://github.com/github/codeql-action/commit/075b74d36ee9e2f9d15c425aba1ede7f00d370dd"><code>075b74d</code></a> Update changelog for v2.1.35</li> <li><a href="https://github.com/github/codeql-action/commit/9af9a11da83a6f53a3b16f63fe26bfc65983895a"><code>9af9a11</code></a> Stop running fallback Go autobuild if database is finalized (<a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1405">#1405</a>)</li> <li><a href="https://github.com/github/codeql-action/commit/a631f4b0160a57d549a79d3bd5c377cefdd8518f"><code>a631f4b</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1400">#1400</a> from github/aeisenberg/fix-test-error</li> <li><a href="https://github.com/github/codeql-action/commit/1384ce4ab3af5272707c00d7e8d750973c64e840"><code>1384ce4</code></a> Fixes spurious error messages in tests</li> <li><a href="https://github.com/github/codeql-action/commit/160613c380ece8936349330e7b7b51ba4ea53698"><code>160613c</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1402">#1402</a> from github/rasmuswl/new-virtualenv</li> <li><a href="https://github.com/github/codeql-action/commit/caf1c5057b627542f1ddab85460b685193428121"><code>caf1c50</code></a> python-setup: Remove outdated comment</li> <li><a href="https://github.com/github/codeql-action/commit/c62445de22d4593ca0f8ae1c1c6d1cb4f88cf250"><code>c62445d</code></a> python-setup: rely on new <code>virtualenv</code> for venv creation in Ubuntu 22.04</li> <li><a href="https://github.com/github/codeql-action/commit/9dac9f748a23bc6702673c2ca9f5c9edff8db684"><code>9dac9f7</code></a> Merge pull request <a href="https://github-redirect.dependabot.com/github/codeql-action/issues/1396">#1396</a> from github/mergeback/v2.1.34-to-main-312e093a</li> <li><a href="https://github.com/github/codeql-action/commit/c6e756bb395e8dbf98912cf05a950f29e5170568"><code>c6e756b</code></a> Update checked-in dependencies</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/678fc3afe258fb2e0cdc165ccf77b85719de7b3c...b2a92eb56d8cb930006a1c6ed86b0782dd8a4297">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.1.33&new-version=2.1.35)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-12-02 09:08:17 -03:00
- uses: github/codeql-action/init@b2a92eb56d8cb930006a1c6ed86b0782dd8a4297 # v2
- uses: github/codeql-action/autobuild@b2a92eb56d8cb930006a1c6ed86b0782dd8a4297 # v2
- uses: github/codeql-action/analyze@b2a92eb56d8cb930006a1c6ed86b0782dd8a4297 # v2
Reference in New Issue Copy Permalink