From 0f2bb7f4b783271c64076675b33c8417717bdd3a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 3 May 2026 12:07:29 +0000 Subject: [PATCH 1/4] feat: add code-scanning workflow with golangci-lint and govulncheck Agent-Logs-Url: https://github.com/maansaake/locksmith/sessions/cab7cd0c-23c5-4406-9bc5-efdac08a26ae Co-authored-by: maansaake <15028979+maansaake@users.noreply.github.com> --- .github/dependabot.yml | 12 ++++++++ .github/workflows/code-scanning.yml | 47 +++++++++++++++++++++++++++++ Makefile | 3 ++ tools/go.mod | 14 +++++++++ tools/go.sum | 22 ++++++++++++++ 5 files changed, 98 insertions(+) create mode 100644 .github/workflows/code-scanning.yml create mode 100644 tools/go.mod create mode 100644 tools/go.sum diff --git a/.github/dependabot.yml b/.github/dependabot.yml index f62880c..1f75259 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -13,6 +13,18 @@ updates: update-types: - patch + - package-ecosystem: gomod + directory: /tools + schedule: + interval: weekly + groups: + minor: + update-types: + - minor + patches: + update-types: + - patch + - package-ecosystem: docker directory: / schedule: diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml new file mode 100644 index 0000000..236e0c7 --- /dev/null +++ b/.github/workflows/code-scanning.yml @@ -0,0 +1,47 @@ +name: Code Scanning + +on: + push: + branches: [main] + pull_request: + branches: [main] + schedule: + - cron: "0 0 * * 1" + +jobs: + golangci-lint: + name: golangci-lint + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + - uses: golangci/golangci-lint-action@v9 + with: + args: --output-formats=sarif:golangci-lint.sarif + - uses: github/codeql-action/upload-sarif@v4 + if: always() + with: + sarif_file: golangci-lint.sarif + + govulncheck: + name: govulncheck + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + steps: + - uses: actions/checkout@v6 + - uses: actions/setup-go@v6 + with: + go-version-file: go.mod + - name: Run govulncheck + run: go tool -modfile tools/go.mod govulncheck -format sarif ./... > govulncheck.sarif + - uses: github/codeql-action/upload-sarif@v4 + if: always() + with: + sarif_file: govulncheck.sarif diff --git a/Makefile b/Makefile index a644e69..634a2be 100644 --- a/Makefile +++ b/Makefile @@ -11,3 +11,6 @@ lint: unit-test: go test ./... -failfast + +govulncheck: + go tool -modfile tools/go.mod govulncheck ./... diff --git a/tools/go.mod b/tools/go.mod new file mode 100644 index 0000000..667e5c9 --- /dev/null +++ b/tools/go.mod @@ -0,0 +1,14 @@ +module github.com/maansaake/locksmith/tools + +go 1.25.0 + +tool golang.org/x/vuln/cmd/govulncheck + +require ( + golang.org/x/mod v0.35.0 // indirect + golang.org/x/sync v0.20.0 // indirect + golang.org/x/sys v0.43.0 // indirect + golang.org/x/telemetry v0.0.0-20260421165255-392afab6f40e // indirect + golang.org/x/tools v0.44.0 // indirect + golang.org/x/vuln v1.3.0 // indirect +) diff --git a/tools/go.sum b/tools/go.sum new file mode 100644 index 0000000..6035320 --- /dev/null +++ b/tools/go.sum @@ -0,0 +1,22 @@ +github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU= +github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o= +github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= +github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA= +github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI= +golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= +golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= +golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= +golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/telemetry v0.0.0-20260421165255-392afab6f40e h1:OXgN37M6hqjaAvb7CJK9vJ+7Z/6lvIm5bXho5poo/Wk= +golang.org/x/telemetry v0.0.0-20260421165255-392afab6f40e/go.mod h1:kHjTxDEnAu6/Nl9lDkzjWpR+bmKfxeiRuSDlsMb70gE= +golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= +golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= +golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM= +golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM= +golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8= +golang.org/x/vuln v1.3.0 h1:hZYzR8uRhYhDSX88d+40TWbKAVw7BIvRWm26rtEn8jw= +golang.org/x/vuln v1.3.0/go.mod h1:MIY2PaR1y52stzZM3uHBboUAdVJvSVMl5nP3OQrwQaE= From 25e89b6470a13cc7c9512f142f9d76fdfc1b8fb7 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 3 May 2026 12:14:57 +0000 Subject: [PATCH 2/4] fix: address review comments on code-scanning workflow Agent-Logs-Url: https://github.com/maansaake/locksmith/sessions/c980782a-58b4-48ee-a368-2e52319f40bb Co-authored-by: maansaake <15028979+maansaake@users.noreply.github.com> --- .github/workflows/code-scanning.yml | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml index 236e0c7..9646b03 100644 --- a/.github/workflows/code-scanning.yml +++ b/.github/workflows/code-scanning.yml @@ -5,8 +5,6 @@ on: branches: [main] pull_request: branches: [main] - schedule: - - cron: "0 0 * * 1" jobs: golangci-lint: @@ -20,10 +18,11 @@ jobs: - uses: actions/setup-go@v6 with: go-version-file: go.mod - - uses: golangci/golangci-lint-action@v9 + - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 with: + version: v2.12.1 args: --output-formats=sarif:golangci-lint.sarif - - uses: github/codeql-action/upload-sarif@v4 + - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 if: always() with: sarif_file: golangci-lint.sarif @@ -41,7 +40,7 @@ jobs: go-version-file: go.mod - name: Run govulncheck run: go tool -modfile tools/go.mod govulncheck -format sarif ./... > govulncheck.sarif - - uses: github/codeql-action/upload-sarif@v4 + - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 if: always() with: sarif_file: govulncheck.sarif From b1ac4b49cab124a3e01a7a6b2a0df37cfac318f5 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sun, 3 May 2026 12:16:56 +0000 Subject: [PATCH 3/4] fix: pin actions/checkout and actions/setup-go to commit SHAs Agent-Logs-Url: https://github.com/maansaake/locksmith/sessions/566d056a-adfe-44fc-a240-647fb39c2cf6 Co-authored-by: maansaake <15028979+maansaake@users.noreply.github.com> --- .github/workflows/code-scanning.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml index 9646b03..857f4a0 100644 --- a/.github/workflows/code-scanning.yml +++ b/.github/workflows/code-scanning.yml @@ -14,8 +14,8 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: go.mod - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 @@ -34,8 +34,8 @@ jobs: contents: read security-events: write steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 with: go-version-file: go.mod - name: Run govulncheck From 94cad6913aefafceb2d763c4ac7230717c1c5643 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?M=C3=A5ns=20Th=C3=B6rnvik?= Date: Sun, 3 May 2026 16:43:49 +0200 Subject: [PATCH 4/4] fix --- .github/workflows/code-scanning.yaml | 20 ++++++++++++ .github/workflows/code-scanning.yml | 46 ---------------------------- 2 files changed, 20 insertions(+), 46 deletions(-) delete mode 100644 .github/workflows/code-scanning.yml diff --git a/.github/workflows/code-scanning.yaml b/.github/workflows/code-scanning.yaml index e9df2ac..0dbfc3f 100644 --- a/.github/workflows/code-scanning.yaml +++ b/.github/workflows/code-scanning.yaml @@ -31,3 +31,23 @@ jobs: uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.53.3 with: sarif_file: results.sarif + + govulncheck: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Set up Golang stable + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 + with: + go-version: stable + cache-dependency-path: tools/go.sum + + - name: Run govulncheck + run: go tool -modfile tools/go.mod govulncheck -format sarif ./... > results.sarif + + - name: Upload SARIF report + if: always() + uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 + with: + sarif_file: results.sarif diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml deleted file mode 100644 index 857f4a0..0000000 --- a/.github/workflows/code-scanning.yml +++ /dev/null @@ -1,46 +0,0 @@ -name: Code Scanning - -on: - push: - branches: [main] - pull_request: - branches: [main] - -jobs: - golangci-lint: - name: golangci-lint - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 - with: - go-version-file: go.mod - - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0 - with: - version: v2.12.1 - args: --output-formats=sarif:golangci-lint.sarif - - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 - if: always() - with: - sarif_file: golangci-lint.sarif - - govulncheck: - name: govulncheck - runs-on: ubuntu-latest - permissions: - contents: read - security-events: write - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 - with: - go-version-file: go.mod - - name: Run govulncheck - run: go tool -modfile tools/go.mod govulncheck -format sarif ./... > govulncheck.sarif - - uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3 - if: always() - with: - sarif_file: govulncheck.sarif