fix: remediate reachable Go vulnerabilities

.github/dependabot.yml

@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directories:
+      - /
+      - /docs
+      - /driver/mysqlqueue
+      - /driver/natsqueue
+      - /driver/postgresqueue
+      - /driver/rabbitmqqueue
+      - /driver/redisqueue
+      - /driver/sqlitequeue
+      - /driver/sqlqueuecore
+      - /driver/sqsqueue
+      - /examples
+      - /integration
+    schedule:
+      interval: weekly
+    groups:
+      shared-dependencies:
+        group-by: dependency-name
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/scripts/check-all-modules.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+module_count=0
+while IFS= read -r -d '' module; do
+  module_dir="${module%/go.mod}"
+  [[ -n "${module_dir}" ]] || module_dir="."
+  (
+    cd "${module_dir}"
+    packages_output="$(GOWORK=off go list ./...)"
+    if [[ -n "${packages_output}" ]]; then
+      mapfile -t packages <<< "${packages_output}"
+      GOWORK=off go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 -test "${packages[@]}"
+    fi
+  ) < /dev/null
+  module_count=$((module_count + 1))
+done < <(find . -type f -name go.mod -not -path './.git/*' -not -path './node_modules/*' -not -path './vendor/*' -print0)
+
+[[ "${module_count}" -gt 0 ]]

.github/scripts/generate-sboms.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+set -euo pipefail
+output_dir="${1:?output directory is required}"
+mkdir -p "${output_dir}"
+output_dir="$(cd "${output_dir}" && pwd -P)"
+module_count=0
+lockfile_count=0
+while IFS= read -r -d '' module; do
+  module_dir="${module%/go.mod}"
+  [[ -n "${module_dir}" ]] || module_dir="."
+  output="${output_dir}/go-${module_count}.cdx.json"
+  (cd "${module_dir}" && GOWORK=off go run github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.12.0 mod -json -type library -test -output "${output}" .) < /dev/null
+  jq -e '.bomFormat == "CycloneDX" and .metadata.component.type == "library" and ((.components // []) | type == "array") and ([.components[]?.name] | index("..") | not)' "${output}" > /dev/null
+  module_count=$((module_count + 1))
+done < <(find . -type f -name go.mod -not -path './vendor/*' -print0)
+while IFS= read -r -d '' lockfile; do lockfile_count=$((lockfile_count + 1)); done < <(find . -type f -name package-lock.json -not -path './node_modules/*' -print0)
+[[ "${module_count}" -gt 0 ]]
+[[ "${module_count}" -eq "$(find "${output_dir}" -type f -name 'go-*.cdx.json' -print | wc -l | tr -d ' ')" ]]
+printf 'Go module SBOMs: %s\npackage-lock files: %s\n' "${module_count}" "${lockfile_count}"

.github/workflows/security.yml

@@ -0,0 +1,47 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+  vulnerability-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with: {go-version: stable, cache: false}
+      - run: .github/scripts/check-all-modules.sh
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with: {fetch-depth: 0}
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with: {go-version: stable, cache: false}
+      - run: |
+          mkdir -p "$RUNNER_TEMP/bin"
+          GOBIN="$RUNNER_TEMP/bin" go install github.com/zricethezav/gitleaks/v8@v8.30.1
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      - run: gitleaks git --log-opts="--all" --redact --no-banner
+  sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with: {go-version: stable, cache: false}
+      - run: .github/scripts/generate-sboms.sh "$RUNNER_TEMP/sbom"
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with: {name: cyclonedx-sbom, path: '${{ runner.temp }}/sbom/*.cdx.json', if-no-files-found: error}

.github/workflows/soak.yml

@@ -16,16 +16,19 @@ on:
         default: "5"
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   benchmark-smoke:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -50,7 +53,7 @@ jobs:
 
       - name: Upload benchmark smoke artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-smoke
           path: .artifacts/*
@@ -65,10 +68,10 @@ jobs:
         backend: [redis, mysql, postgres, sqlite, nats, sqs, rabbitmq]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -100,7 +103,7 @@ jobs:
 
       - name: Upload evidence logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: integration-evidence-${{ matrix.backend }}
           path: .artifacts/*
@@ -116,10 +119,10 @@ jobs:
         backend: [redis, mysql, postgres, sqlite, nats, sqs, rabbitmq]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -152,7 +155,7 @@ jobs:
 
       - name: Upload soak logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: integration-soak-${{ matrix.backend }}
           path: .artifacts/*
@@ -168,10 +171,10 @@ jobs:
         backend: [redis, rabbitmq]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -242,7 +245,7 @@ jobs:
 
       - name: Upload GA soak logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: soak-ga-${{ matrix.backend }}
           path: .artifacts/*
@@ -257,10 +260,10 @@ jobs:
         backend: [redis, mysql, postgres, sqlite, nats, sqs, rabbitmq]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -293,7 +296,7 @@ jobs:
 
       - name: Upload chaos logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: integration-chaos-${{ matrix.backend }}
           path: .artifacts/*
@@ -308,10 +311,10 @@ jobs:
         backend: [redis, rabbitmq, sqs]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -343,7 +346,7 @@ jobs:
 
       - name: Upload flake probe logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: integration-flake-repeat-${{ matrix.backend }}
           path: .artifacts/*

.github/workflows/test.yml

@@ -6,12 +6,15 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   integration-scenarios-contract-guard:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify integration scenarios contract coverage
         run: .github/scripts/check_integration_scenarios_contract.sh
@@ -20,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Ensure integration matrix covers all required backends
         run: |
@@ -50,13 +53,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Verify Codecov report freshness guard
         run: .github/scripts/test_wait_codecov_report.sh
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -80,7 +83,7 @@ jobs:
         run: ./scripts/coverage-codecov.sh unit
 
       - name: Preserve multi-module unit coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-unit
           path: |
@@ -104,10 +107,10 @@ jobs:
         minimum_go_version: ["1.27.0"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.minimum_go_version }}
           cache-dependency-path: |
@@ -162,10 +165,10 @@ jobs:
         race_module: [".", "driver/mysqlqueue", "driver/natsqueue", "driver/postgresqueue", "driver/rabbitmqqueue", "driver/redisqueue", "driver/sqlitequeue", "driver/sqlqueuecore", "driver/sqsqueue"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
           cache-dependency-path: |
@@ -203,10 +206,10 @@ jobs:
         backend: ["null", "sync", "workerpool", "redis", "mysql", "postgres", "sqlite", "nats", "sqs", "rabbitmq"]
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
@@ -220,7 +223,7 @@ jobs:
         run: ./scripts/coverage-codecov.sh integration
 
       - name: Preserve integration coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-integration-${{ matrix.backend }}
           path: coverage/coverage-integration-${{ matrix.backend }}.out
@@ -233,15 +236,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "stable"
 
       - name: Download coverage artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: coverage-*
           path: coverage-artifacts
@@ -257,7 +260,7 @@ jobs:
           echo "files=$profiles" >> "$GITHUB_OUTPUT"
 
       - name: Upload complete coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ${{ steps.coverage-files.outputs.files }}
           disable_search: true

docs/readme/testcounts/integration_count.json

@@ -1,5 +1,5 @@
 {
   "count": 618,
-  "source_hash": "sha256:f7ee227bc9d85ad4965b1db917f83ad94350a0ebf3ba9d2637f883b03c82af14",
+  "source_hash": "sha256:244f28df6d02b3709096a29cfa6a0e2fa3c4fe46b5b2af40e86adb7afc1a09a8",
   "backend_scope": "all"
 }

driver/mysqlqueue/go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/goforj/queue/driver/sqlqueuecore v0.0.0
 )
 
-require filippo.io/edwards25519 v1.1.0 // indirect
+require filippo.io/edwards25519 v1.1.1 // indirect
 
 replace github.com/goforj/queue => ../..