Bryan BeverlyandCursor
36f6f69707
Convert all GitHub Actions uses: refs from mutable tags to immutable SHA pins with version comments. This prevents tag-hijack supply chain attacks while preserving version tracking for Renovate. Part of the org-wide Dependency Strategy Unification (Step 2). Co-authored-by: Cursor <[email protected]>
65 lines
2.1 KiB
YAML
65 lines
2.1 KiB
YAML
name: Lint
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- v*
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
golangci-lint:
|
|
name: golangci-lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
|
|
with:
|
|
go-version: "1.25"
|
|
- name: golangci-lint
|
|
uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
|
|
with:
|
|
# NOTE: Version and args must match scripts/lint.sh
|
|
version: v2.11.4
|
|
args: --enable bodyclose,copyloopvar,misspell --timeout 10m
|
|
man-page-staleness:
|
|
name: man-page-staleness
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
|
|
with:
|
|
go-version: "1.25"
|
|
- name: Regenerate man page
|
|
run: make man
|
|
- name: Check for staleness
|
|
run: |
|
|
if ! git diff --exit-code docs/man/trufflehog.1; then
|
|
echo "::error::docs/man/trufflehog.1 is stale. Run 'make man' and commit the result."
|
|
exit 1
|
|
fi
|
|
semgrep:
|
|
name: semgrep
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: returntocorp/semgrep
|
|
if: (github.actor != 'dependabot[bot]')
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- run: semgrep --config=hack/semgrep-rules/detectors.yaml pkg/detectors/
|
|
checksecretparts:
|
|
# Reports detector packages that construct detectors.Result without
|
|
# populating SecretParts. See hack/checksecretparts/README.md.
|
|
name: checksecretparts
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
|
|
with:
|
|
go-version: "1.25"
|
|
- name: Run checksecretparts
|
|
run: go run ./hack/checksecretparts -fail ./pkg/detectors
|