From e54e85ed7f5d8202b7b23592a0a0e3a4880af1c2 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 16:22:35 +0000 Subject: [PATCH 1/3] chore(deps): update actions/setup-go action to v7 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/main.yml | 2 +- .github/workflows/release.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index d7cea2c4..1fb4feb6 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -41,7 +41,7 @@ jobs: uses: actions/checkout@v7 - name: Install Go - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 with: go-version: ${{ matrix.go-version }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ee6b1220..c86f20f9 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -25,7 +25,7 @@ jobs: - name: Git Fetch run: git fetch --force --tags - name: Setup go - uses: actions/setup-go@v6 + uses: actions/setup-go@v7 with: go-version: stable From 27ebe9ba1812136cbe74bacd997d1b8c36244a07 Mon Sep 17 00:00:00 2001 From: Andreas Turtschan Date: Fri, 31 Jul 2026 18:57:21 +0200 Subject: [PATCH 2/3] fixed semgrep finding: changed tags to commit hashes --- .github/workflows/main.yml | 8 ++++---- .github/workflows/release.yaml | 8 ++++---- .github/workflows/semgrep.yaml | 2 +- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 1fb4feb6..7333f94b 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -19,12 +19,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 # Gitleaks needs the full history to scan properly - name: Run Gitleaks - uses: gitleaks/gitleaks-action@v3 + uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} @@ -38,10 +38,10 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: ${{ matrix.go-version }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index c86f20f9..6aa6257c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -25,7 +25,7 @@ jobs: - name: Git Fetch run: git fetch --force --tags - name: Setup go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: stable @@ -33,20 +33,20 @@ jobs: - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - name: Set Up Docker Buildx - uses: docker/setup-buildx-action@v4 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - name: Set up Cosign uses: sigstore/cosign-installer@v4.1.2 - name: Login to Registry - uses: docker/login-action@v4 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: registry: ${{ env.REGISTRY }} username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Release with Goreleaser - uses: goreleaser/goreleaser-action@v7 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3 with: distribution: goreleaser version: latest diff --git a/.github/workflows/semgrep.yaml b/.github/workflows/semgrep.yaml index fb609e3d..ea13e5d0 100644 --- a/.github/workflows/semgrep.yaml +++ b/.github/workflows/semgrep.yaml @@ -14,7 +14,7 @@ jobs: image: semgrep/semgrep:1.172.0@sha256:65dcd4408adda7c183a6b4550cb1e9b19f7f627a6fbb7e0559bd466bedc44d7b steps: # Fetch project source - - uses: actions/checkout@v7 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Run Semgrep run: | From b5381481b850ecd9d8357128317c56e9055e5698 Mon Sep 17 00:00:00 2001 From: Andreas Turtschan Date: Fri, 31 Jul 2026 19:06:01 +0200 Subject: [PATCH 3/3] fixed semgrep finding: changed tags to commit hashes. removed sigstore/cosign-installer duplicate --- .github/workflows/release.yaml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 6aa6257c..4e831f30 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -29,15 +29,14 @@ jobs: with: go-version: stable - - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - name: Set up Cosign + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 + - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 - name: Set Up Docker Buildx uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 - - name: Set up Cosign - uses: sigstore/cosign-installer@v4.1.2 - - name: Login to Registry uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: