Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update github workflows #784

Merged
merged 1 commit into from
Aug 1, 2023
Merged

Update github workflows #784

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 8 additions & 11 deletions .github/workflows/go.yml → .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
name: Go
name: Main Workflow

on:
pull_request: {}
push:
branches:
- main
pull_request:
branches: [ "main" ]


concurrency:
group: one-at-time
Expand All @@ -22,17 +22,14 @@ jobs:
uses: actions/checkout@v3

- name: Set up Go
uses: actions/setup-go@v3
uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true

- name: Check that docs were generated
run: make check-docs

- name: Check for go vulnerabilities
run: make check-vuln

- name: Check for linting errors
uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # pin@3.6.0
with:
Expand All @@ -47,7 +44,7 @@ jobs:
uses: actions/checkout@v3

- name: Set up Go
uses: actions/setup-go@v3
uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
Expand Down Expand Up @@ -76,7 +73,7 @@ jobs:
fetch-depth: 2

- name: Set up Go
uses: actions/setup-go@v3
uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
Expand Down Expand Up @@ -112,7 +109,7 @@ jobs:
uses: actions/checkout@v3

- name: Set up Go
uses: actions/setup-go@v3
uses: actions/setup-go@v4
with:
go-version-file: go.mod
check-latest: true
Expand Down
14 changes: 0 additions & 14 deletions .github/workflows/pull-request-target.trigger-deferred.yml
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: goreleaser
name: Release

on:
push:
Expand Down
33 changes: 33 additions & 0 deletions .github/workflows/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: Security

on:
pull_request: {}
push:
branches: [ "main" ]
schedule:
- cron: "30 0 1,15 * *"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be running on a cron?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, as otherwise it would only trigger when there is activity on this repo. But in case there isn't any, we still want to trigger this security check so we can get alerted if any dependencies have had vulnerabilities discovered.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the clarification.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't that be done by Dependabot and Snyk anyway?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's done also by Dependabot and Snyk, correct. From my understanding we need both snyk, semgrep and govulncheck to maximize the chance of being alerted on issues, so we don't have just a single point of failure for security checks.

I'll cc: @evansims and @poovamraj tho to confirm.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👋 Yup! Snyk is excellent, but its handling of Go has not proven to be the most reliable in our past experiences. On the other hand, Govulncheck has proven quite reliable. Having it as an additional security filter here makes sense. 👍

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @evansims!


permissions:
contents: read

jobs:
semgrep:
name: Semgrep Scan
runs-on: ubuntu-latest
container:
image: returntocorp/semgrep

steps:
- uses: actions/checkout@v3
- run: semgrep ci
env:
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

govulncheck:
name: Vulnerabilities Scan
runs-on: ubuntu-latest
steps:
- name: Scan for vulnerabilities in go code
uses: golang/govulncheck-action@dd3ead030e4f2cf713062f7a3395191802364e13 # pin@1.0.0
with:
check-latest: true
28 changes: 0 additions & 28 deletions .github/workflows/semgrep.yml
View file
Open in desktop

This file was deleted.

Loading