Skip to content

build(deps): bump the go-mod group across 1 directory with 14 updates #964

build(deps): bump the go-mod group across 1 directory with 14 updates

build(deps): bump the go-mod group across 1 directory with 14 updates #964

Workflow file for this run

---
name: "Lint"
on: # yamllint disable-line rule:truthy
push:
branches:
- "!dependabot/*"
- "main"
pull_request:
branches: ["*"]
merge_group:
types:
- "checks_requested"
jobs:
go-lint:
name: "Lint Go"
runs-on: "ubuntu-latest"
steps:
- uses: "actions/checkout@v4"
- uses: "authzed/actions/setup-go@main"
- uses: "authzed/actions/gofumpt@main"
- uses: "authzed/actions/go-mod-tidy@main"
- uses: "authzed/actions/go-generate@main"
- uses: "authzed/actions/golangci-lint@main"
extra-lint:
name: "Lint YAML & Markdown"
runs-on: "ubuntu-latest"
steps:
- uses: "actions/checkout@v4"
- uses: "authzed/actions/yaml-lint@main"
- uses: "authzed/actions/markdown-lint@main"
codeql:
name: "Analyze with CodeQL"
runs-on: "ubuntu-latest"
permissions:
actions: "read"
contents: "read"
security-events: "write"
strategy:
fail-fast: false
matrix:
language: ["go"]
steps:
- uses: "actions/checkout@v4"
- uses: "authzed/actions/setup-go@main"
- uses: "authzed/actions/codeql@main"
trivy-fs:
name: "Analyze FS with Trivy"
runs-on: "ubuntu-latest"
steps:
- uses: "actions/checkout@v4"
- uses: "aquasecurity/trivy-action@master"
with:
scan-type: "fs"
ignore-unfixed: true
format: "table"
exit-code: "1"
severity: "CRITICAL,HIGH,MEDIUM"
env:
TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db"
TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db"
trivy-image:
name: "Analyze Release Image with Trivy"
runs-on: "ubuntu-latest"
steps:
- uses: "actions/checkout@v4"
- uses: "authzed/actions/setup-go@main"
# Workaround until goreleaser release supports --single-target
# makes the build faster by not building everything
- name: "modify goreleaser config to skip building all targets"
run: |
echo "partial:
by: target" >> .goreleaser.docker.yml
- uses: "goreleaser/goreleaser-action@v6"
id: "goreleaser"
with:
distribution: "goreleaser-pro"
version: "2.3.2"
args: "release -f .goreleaser.docker.yml --clean --split --snapshot"
env:
GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
- name: "Obtain container image to scan"
run: 'echo "IMAGE_VERSION=$(jq .version dist/linux_amd64_v1/metadata.json --raw-output)" >> $GITHUB_ENV'
- name: "run trivy on release image"
run: "docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image --format table --exit-code 1 --ignore-unfixed --vuln-type os,library --no-progress --severity CRITICAL,HIGH,MEDIUM authzed/zed:v${{ env.IMAGE_VERSION }}-amd64 --db-repository public.ecr.aws/aquasecurity/trivy-db --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db"