From 8e695545394ef2c0d1761ce8c0404090068047e0 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 27 Aug 2026 22:04:15 -0700 Subject: [PATCH 1/6] CI: bump actions and codespell - actions/checkout: v6.0.2 -> v7.0.1 - actions/setup-go: v6.3.0 -> v7.0.0 - codecov/codecov-action: v5.5.3 -> v7.0.0 - codespell: 2.3.0 -> 2.4.3 The action bumps are major releases, but the only user-visible change is the move to node24 (and ESM), which all the runners we use support. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index bc94561..eec1dc9 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,9 +28,9 @@ jobs: shell: bash steps: - name: Checkout code - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ matrix.go-version }} # Disable caching as we don't have top-level go.sum needed for @@ -87,7 +87,7 @@ jobs: uname -a make test - name: Send to Codecov - uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: token: ${{ secrets.CODECOV_TOKEN }} # used to upload coverage reports: https://github.com/moby/buildkit/pull/4660#issue-2142122533 @@ -95,6 +95,6 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 10 # guardrails timeout for the whole job steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - run: pip install --break-system-packages codespell==v2.3.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - run: pip install --break-system-packages codespell==v2.4.3 - run: codespell From a83ee35b76f8c0a91d48b16701c9f05c729a612c Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 27 Aug 2026 22:04:15 -0700 Subject: [PATCH 2/6] CI: add dependabot config for github actions Let dependabot keep the pinned action digests (and their version comments) up to date, so they do not get stale again. Grouped into a single PR to avoid the noise; Go modules are not included as those are maintained manually. Signed-off-by: Kir Kolyshkin --- .github/dependabot.yml | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..ef06a44 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,13 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + groups: + github-actions: + patterns: + - "*" From 52b4f6c85c486a50d459f6f7524088561b04d3c8 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 27 Aug 2026 22:05:59 -0700 Subject: [PATCH 3/6] CI: do not persist credentials on checkout By default actions/checkout leaves the GITHUB_TOKEN in the local git config, where any later step (or anything that archives the workspace) can pick it up. Nothing here pushes back to the repository, so turn it off, as suggested by zizmor's "artipacked" audit. Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index eec1dc9..b66b8e2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -29,6 +29,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install Go uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: @@ -96,5 +98,7 @@ jobs: timeout-minutes: 10 # guardrails timeout for the whole job steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - run: pip install --break-system-packages codespell==v2.4.3 - run: codespell From c0850c26232b63c11c33b13d0470dd3759b61248 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 28 Aug 2026 00:54:07 -0700 Subject: [PATCH 4/6] CI: add zizmor Add a job running zizmor, a static analyzer for GitHub Actions workflows, to catch common CI misconfigurations and security issues (such as the credential persistence fixed in the previous commit). Signed-off-by: Kir Kolyshkin --- .github/workflows/test.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b66b8e2..611cc0b 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -102,3 +102,18 @@ jobs: persist-credentials: false - run: pip install --break-system-packages codespell==v2.4.3 - run: codespell + + zizmor: + runs-on: ubuntu-24.04 + timeout-minutes: 10 # guardrails timeout for the whole job + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + # Report findings as workflow annotations rather than uploading + # them to the repository's security tab (which needs additional + # permissions and GitHub Advanced Security to be enabled). + advanced-security: false + annotations: true From 5c347c466234ae55e13139d5d821d2115d6d6387 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 28 Aug 2026 01:03:49 -0700 Subject: [PATCH 5/6] CI: add actionlint Add a workflow running actionlint, a static checker for GitHub Actions workflow files. It complements zizmor: where zizmor looks for security issues, actionlint validates the workflow syntax itself, the expressions and the runner labels, and runs shellcheck over the run: scripts. Signed-off-by: Kir Kolyshkin --- .github/workflows/actionlint.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/actionlint.yml diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml new file mode 100644 index 0000000..f0887ed --- /dev/null +++ b/.github/workflows/actionlint.yml @@ -0,0 +1,26 @@ +name: Actionlint + +# Default to 'contents: read', which grants actions to read commits. +# +# If any permission is set, any permission not included in the list is +# implicitly set to "none". +# +# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +on: [push, pull_request] + +jobs: + actionlint: + runs-on: ubuntu-24.04 + timeout-minutes: 10 # guardrails timeout for the whole job + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: devops-actions/actionlint@ec02b36684b2f574f1d219ad0a43b082e46bf3e4 # v0.1.13 From cc9d1ea9e37b97e643d53f3468633cf917482300 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Fri, 28 Aug 2026 01:04:06 -0700 Subject: [PATCH 6/6] CI: add ubuntu-26.04 to the test matrix Ubuntu 26.04 runners are still in public preview, but let's start testing on them early. As actionlint does not know about the ubuntu-26.04 runner label yet, add an actionlint config declaring it, to be removed once a release with the label lands. Signed-off-by: Kir Kolyshkin --- .github/actionlint.yaml | 5 +++++ .github/workflows/test.yml | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000..7c9b483 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,5 @@ +# ubuntu-26.04 is still in public preview, and actionlint does not know +# about it yet; remove this once it does. +self-hosted-runner: + labels: + - ubuntu-26.04 diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 611cc0b..491cdb6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -20,7 +20,7 @@ jobs: strategy: matrix: go-version: [1.18.x, oldstable, stable] - platform: [ubuntu-22.04, ubuntu-24.04, windows-2022, windows-2025, macos-15, macos-26] + platform: [ubuntu-22.04, ubuntu-24.04, ubuntu-26.04, windows-2022, windows-2025, macos-15, macos-26] runs-on: ${{ matrix.platform }} timeout-minutes: 10 # guardrails timeout for the whole job defaults: