fix: update go modules (patch) #236
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Checks | |
| # Same shape as lint.yaml: scoped on PR via path detection, runs everything | |
| # when called from another workflow (e.g. release). | |
| on: | |
| pull_request: | |
| workflow_call: | |
| # Read-only by default — every job here just scans the source tree and | |
| # reports findings. Override at the job level if a future job ever | |
| # needs to write back (it shouldn't). | |
| permissions: | |
| contents: read | |
| # Silence Dagger's Cloud upload and analytics paths globally. | |
| env: | |
| DAGGER_NO_NAG: "1" | |
| DAGGER_CLOUD_TOKEN: "" | |
| DO_NOT_TRACK: "1" | |
| # Every job here only checks out + scans; none push or need git write | |
| # access, so each checkout sets `persist-credentials: false` to keep the | |
| # GITHUB_TOKEN out of the workspace's .git/config (zizmor "artipacked"). | |
| jobs: | |
| changes: | |
| name: Detect changed paths | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| go: ${{ steps.filter.outputs.go }} | |
| deps: ${{ steps.filter.outputs.deps }} | |
| chart: ${{ steps.filter.outputs.chart }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4 | |
| id: filter | |
| with: | |
| filters: | | |
| go: | |
| - '**/*.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - 'dagger/**' | |
| deps: | |
| - 'go.mod' | |
| - 'go.sum' | |
| - 'dagger/**' | |
| chart: | |
| - 'chart/**' | |
| - 'dagger/**' | |
| # Secret leak detection. Always runs — any file can leak. Routed | |
| # through the Dagger Module's `Gitleaks` function (see CLAUDE.md for | |
| # why this isn't gitleaks-action). | |
| secrets: | |
| name: Secret leaks (Gitleaks) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| # gitleaks scans the working tree, not git history — shallow. | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8 | |
| with: | |
| version: latest | |
| dagger-flags: --progress=logs | |
| verb: call | |
| args: gitleaks | |
| # Reachability-based vulnerability check for Go code. Routed through | |
| # the Dagger Module so the govulncheck version + flags stay aligned | |
| # with `task security:govulncheck` locally — single source of truth | |
| # in dagger/security.go (the `govulncheckPath` const in dagger/base.go). | |
| govulncheck: | |
| name: Reachable vulnerabilities (govulncheck) | |
| needs: changes | |
| if: | | |
| always() && | |
| (github.event_name != 'pull_request' || needs.changes.outputs.go == 'true') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8 | |
| with: | |
| version: latest | |
| dagger-flags: --progress=logs | |
| verb: call | |
| args: govulncheck | |
| # Filesystem scan: Go module deps + lockfiles. Catches CVEs that | |
| # govulncheck would miss because they don't lie on a reachable path. | |
| # Routed through the Dagger Module's `Trivy` function — same Trivy | |
| # version + same flags locally and in CI. | |
| vuln-deps: | |
| name: Vulnerable dependencies (Trivy) | |
| needs: changes | |
| if: | | |
| always() && | |
| (github.event_name != 'pull_request' || needs.changes.outputs.deps == 'true') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8 | |
| with: | |
| version: latest | |
| dagger-flags: --progress=logs | |
| verb: call | |
| args: trivy --scan-type=fs | |
| # Helm/Kubernetes misconfig scan against the rendered chart. | |
| chart-misconfig: | |
| name: Chart misconfiguration (Trivy) | |
| needs: changes | |
| if: | | |
| always() && | |
| (github.event_name != 'pull_request' || needs.changes.outputs.chart == 'true') | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8 | |
| with: | |
| version: latest | |
| dagger-flags: --progress=logs | |
| verb: call | |
| args: trivy --scan-type=config --scan-ref=chart |