From 0aa2da5e49e376de946ab64086a50be08ad6a245 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 26 Oct 2026 08:50:19 -0600 Subject: [PATCH 1/3] feat!: add testing for pr 53 Signed-off-by: Sean Tronsen --- .github/workflows/govulncheck.yml | 6 +++++- README.md | 3 +++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index fca34aa..72828e8 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,11 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5a0ca6e79ffd9f8db2b517beb176039628d22095 # github-actions under test (seantronsen/feat/release-attestation) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@1ad5a2b3f96de5f175ac7c3ab4182aad203e0941 # github-actions under test (seantronsen/feat/sarif-govulncheck) + permissions: + contents: read # baseline for checkout + security-events: write # SARIF upload to GHAS + issues: write # vulnerabilities issue on the default branch govulncheck: if: ${{ always() }} diff --git a/README.md b/README.md index b5710f1..9a3ac79 100644 --- a/README.md +++ b/README.md @@ -68,5 +68,8 @@ the result; `make generate-check` is what CI runs. - **Release mode**: push a `v*` tag (e.g. `v0.0.1`). Tag freely. - **Docs links**: a PR that changes docs runs `lint-docs`; broken links show up as code scanning comments on the PR. On `main`, they go to an issue. +- **Go vulnerabilities**: `govulncheck` fails when a vulnerable symbol is + called; the call site shows up as a code scanning comment on the PR. On + `main`, they go to an issue. - **Another github-actions ref**: update the pinned SHA in `.github/workflows/*.yml`. From b1e45d617b4734824ecec2c06aae232726af3094 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 26 Oct 2026 08:50:53 -0600 Subject: [PATCH 2/3] feat: configure linting and security to run daily Signed-off-by: Sean Tronsen --- .github/workflows/govulncheck.yml | 2 ++ .github/workflows/lint.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 72828e8..1bb7731 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -7,6 +7,8 @@ on: push: branches: - main + schedule: + - cron: '23 3 * * *' # daily at 03:23 UTC permissions: contents: read diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 930537f..61f4da7 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -10,6 +10,8 @@ on: push: branches: - main + schedule: + - cron: '23 3 * * *' # daily at 03:23 UTC permissions: contents: read From 96f912ab1ed5c52bf85fc7a8a879b482684637a9 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 26 Oct 2026 08:51:31 -0600 Subject: [PATCH 3/3] fix: update to new version of lint-docs, ensure json schema validation Signed-off-by: Sean Tronsen --- .github/workflows/lint.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 61f4da7..35bceb4 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -40,7 +40,7 @@ jobs: go-version-file: go.mod lint-docs: - uses: OpenCHAMI/github-actions/.github/workflows/lint-docs.yml@04614d708f9f16283e4234412348b7814689c6e9 # github-actions under test (seantronsen/feat/lint-docs) + uses: OpenCHAMI/github-actions/.github/workflows/lint-docs.yml@1ad5a2b3f96de5f175ac7c3ab4182aad203e0941 # github-actions under test (seantronsen/feat/sarif-govulncheck) permissions: contents: read # baseline for checkout pull-requests: read # list the PR's changed files