From 919634fd7bb30fbfc3c9187f6123e54b0cddf7be Mon Sep 17 00:00:00 2001 From: theghost5800 Date: Fri, 23 Oct 2026 13:14:30 +0300 Subject: [PATCH 1/3] Upgrade GitHub Actions to latest versions, migrate golangci-lint config to v2 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump all GitHub Actions steps to their latest stable versions, pinned to exact commit SHAs with version comments for supply-chain security. Migrate .golangci.yml to v2 format required by golangci-lint-action v9. Changes per workflow: - codeql.yml: checkout v4→v7.0.1, codeql-action/* v4→v4.39.1 - pull-request-build.yml: checkout v3→v7.0.1, setup-go v3→v7.0.0 - sonar-scan.yml: checkout v4.2.2→v7.0.1, setup-go v3→v7.0.0, golangci-lint-action v6.1.1→v9.3.0, sonarqube-scan-action v5.1.0→v8.3.0 - check-commit-message.yml: github-script v6→v9.0.0 Config change: - .golangci.yml: added `version: 2` (required for golangci-lint CLI v2) - pull-request-build.yml: download go 1.27.2 as this is minimum required version now - sonar-scan.yml: download go 1.27.2 as this is minimum required version now All SHAs verified against the upstream GitHub repositories. JIRA:LMCROSSITXSADEPLOY-3714 --- .github/workflows/check-commit-message.yml | 2 +- .github/workflows/codeql.yml | 6 +++--- .github/workflows/pull-request-build.yml | 6 +++--- .github/workflows/sonar-scan.yml | 12 ++++++------ .golangci.yml | 9 +++++---- sonar-project.properties | 2 +- 6 files changed, 19 insertions(+), 18 deletions(-) diff --git a/.github/workflows/check-commit-message.yml b/.github/workflows/check-commit-message.yml index 32bad8f..63edc3d 100644 --- a/.github/workflows/check-commit-message.yml +++ b/.github/workflows/check-commit-message.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Check Commit Message id: commits - uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6 + uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 with: script: | const prNumber = context.payload.pull_request.number; diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 080214c..8b2bd21 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -59,7 +59,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # Add any setup steps before running the `github/codeql-action/init` action. # This includes steps like installing compilers or runtimes (`actions/setup-node` @@ -69,7 +69,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4 + uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} @@ -97,6 +97,6 @@ jobs: exit 1 - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4 + uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/pull-request-build.yml b/.github/workflows/pull-request-build.yml index de521e6..a562bfa 100644 --- a/.github/workflows/pull-request-build.yml +++ b/.github/workflows/pull-request-build.yml @@ -12,12 +12,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Set up Go - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.25.4' + go-version: '1.27.2' - name: Download dependencies run: go get -d -t ./... diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml index 9ac0570..a7532c2 100644 --- a/.github/workflows/sonar-scan.yml +++ b/.github/workflows/sonar-scan.yml @@ -14,15 +14,15 @@ jobs: build: runs-on: ubuntu-latest steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: # Full history so SonarCloud can compute new-code and blame data. fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: '1.25.4' + go-version: '1.27.2' - name: Build and Test with Coverage run: | @@ -30,13 +30,13 @@ jobs: go test -coverprofile=coverage.out ./... - name: golangci-lint - uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: - args: --output.json.path=golangci-report.json + args: --output.checkstyle.path=golangci-report.xml continue-on-error: true - name: Sonar Scan - uses: SonarSource/sonarqube-scan-action@aa494459d7c39c106cc77b166de8b4250a32bb97 # v5.1.0 + uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} diff --git a/.golangci.yml b/.golangci.yml index 6c1b111..bca8c82 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,13 +1,14 @@ +version: "2" + # golangci-lint configuration for multiapps-cli-plugin # Runs a standard set of Go linters; JSON output is uploaded to SonarCloud. run: timeout: 5m -issues: - exclude-dirs: - - test_resources - linters: + exclusions: + paths: + - test_resources enable: - govet - staticcheck diff --git a/sonar-project.properties b/sonar-project.properties index ad66137..b04c95b 100644 --- a/sonar-project.properties +++ b/sonar-project.properties @@ -11,4 +11,4 @@ sonar.exclusions=\ # Go analysis inputs sonar.go.coverage.reportPaths=coverage.out -sonar.go.golangci-lint.reportPaths=golangci-report.json +sonar.go.golangci-lint.reportPaths=golangci-report.xml From 35ca2f8f0a49053acb0118a945905ccc52a67ac9 Mon Sep 17 00:00:00 2001 From: theghost5800 Date: Mon, 26 Oct 2026 15:54:47 +0200 Subject: [PATCH 2/3] Configure dependabot to scan for new go modules and github-actions --- .github/dependabot.yml | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 5990d9c..02a3e1b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,11 +1,17 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: -# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file - version: 2 updates: - - package-ecosystem: "" # See documentation for possible values - directory: "/" # Location of package manifests + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "cron" + # 1st and 3rd Wednesday of every month (biweekly approximation): + # days 1-7 guarantee the 1st Wednesday, days 15-21 guarantee the 3rd Wednesday + cronjob: "0 0 1-7,15-21 * 3" + + - package-ecosystem: "github-actions" + directory: "/" schedule: - interval: "weekly" + interval: "cron" + # 1st and 3rd Wednesday of every month (biweekly approximation): + # days 1-7 guarantee the 1st Wednesday, days 15-21 guarantee the 3rd Wednesday + cronjob: "0 0 1-7,15-21 * 3" From a2ca250d08a69ce1141fe819f5cffa1bd8119b63 Mon Sep 17 00:00:00 2001 From: theghost5800 Date: Wed, 28 Oct 2026 13:33:15 +0200 Subject: [PATCH 3/3] Change dependabot scan to monthly --- .github/dependabot.yml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 02a3e1b..f21be2e 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,15 +3,9 @@ updates: - package-ecosystem: "gomod" directory: "/" schedule: - interval: "cron" - # 1st and 3rd Wednesday of every month (biweekly approximation): - # days 1-7 guarantee the 1st Wednesday, days 15-21 guarantee the 3rd Wednesday - cronjob: "0 0 1-7,15-21 * 3" + interval: "monthly" - package-ecosystem: "github-actions" directory: "/" schedule: - interval: "cron" - # 1st and 3rd Wednesday of every month (biweekly approximation): - # days 1-7 guarantee the 1st Wednesday, days 15-21 guarantee the 3rd Wednesday - cronjob: "0 0 1-7,15-21 * 3" + interval: "monthly"