From f72aaca75010fdcf7a1928f4e24db74896ed56be Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 14:51:22 +0300 Subject: [PATCH 01/10] gh: fixed codeql build command in code-scan-cron.yml --- .github/workflows/code-scan-cron.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/code-scan-cron.yml b/.github/workflows/code-scan-cron.yml index 891bda8..9eeec7b 100644 --- a/.github/workflows/code-scan-cron.yml +++ b/.github/workflows/code-scan-cron.yml @@ -12,3 +12,6 @@ jobs: security-events: write uses: smallstep/workflows/.github/workflows/code-scan.yml@main secrets: inherit + with: + codeql-build-mode: manual # tell codeql we'll build; skips autobuild's Makefile heuristic + codeql-build-cmd: go build ./... From 47d8516058ef150539385857554bba20b207453a Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:02:32 +0300 Subject: [PATCH 02/10] README: amended an indentation issue --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9d94e65..32334c5 100644 --- a/README.md +++ b/README.md @@ -16,7 +16,7 @@ import ( "fmt" "os" - "github.com/smallstep/pkcs7" + "github.com/smallstep/pkcs7" ) func SignAndDetach(content []byte, cert *x509.Certificate, privkey *rsa.PrivateKey) (signed []byte, err error) { From 610630e5681f177622d8cde617720d4d14435fb2 Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:03:09 +0300 Subject: [PATCH 03/10] gh: added go 1.24 and 1.25 to the CI matrix --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f83f1e9..b26a998 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,7 +6,7 @@ jobs: name: Test strategy: matrix: - go: ['1.14', '1.15', '1.16', '1.21', '1.22', '1.23'] + go: ['1.14', '1.15', '1.16', '1.21', '1.22', '1.23', '1.24', '1.25'] runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 From 972612f46e294923ac5f74a69104c3b2f2922cea Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:04:10 +0300 Subject: [PATCH 04/10] gh: stopped CI from running twice for PRs --- .github/workflows/ci.yml | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b26a998..c890189 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,18 @@ name: CI -on: [push, pull_request] +on: + push: + tags-ignore: + - '**' + branches: + - main + pull_request: + types: + - opened + - synchronize + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true jobs: test: From d80e1bf110c1950cde8e18390c553b31500000be Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:08:47 +0300 Subject: [PATCH 05/10] gh: pinned actions to their current versions by checksum --- .github/workflows/ci.yml | 4 ++-- .github/workflows/dependabot-auto-merge.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c890189..9b2a3f9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -22,10 +22,10 @@ jobs: go: ['1.14', '1.15', '1.16', '1.21', '1.22', '1.23', '1.24', '1.25'] runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: fetch-depth: 0 - - uses: actions/setup-go@v4 + - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 with: go-version: ${{ matrix.go }} - name: Test diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 471eeda..6954835 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -12,7 +12,7 @@ jobs: steps: - name: Dependabot metadata id: metadata - uses: dependabot/fetch-metadata@v1.1.1 + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs From 99f3aa1212f7cf3e28ad3d36de2141dd8302df3c Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:10:26 +0300 Subject: [PATCH 06/10] gh: expanded the dependabot config --- .github/dependabot.yml | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index e0871f9..634debd 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,11 +1,32 @@ -# To get started with Dependabot version updates, you'll need to specify which -# package ecosystems to update and where the package manifests are located. -# Please see the documentation for all configuration options: # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates version: 2 updates: - - package-ecosystem: "gomod" # See documentation for possible values - directory: "/" # Location of package manifests + + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + cooldown: + default-days: 7 + groups: + all: + patterns: + - "*" + update-types: + - minor + - patch + + - package-ecosystem: github-actions + directory: / schedule: - interval: "weekly" + interval: weekly + cooldown: + default-days: 7 + groups: + all: + patterns: + - "*" + update-types: + - minor + - patch From ec9509c181d0cddf0f6959c97c88197268d52232 Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:16:10 +0300 Subject: [PATCH 07/10] added .editorconfig --- .editorconfig | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 .editorconfig diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..a844ad5 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,17 @@ +root = true + +[*] +charset = utf-8 +end_of_line = lf +indent_style = tab +insert_final_newline = true +tab_width = unset +trim_trailing_whitespace = true + +[*.{yml,yaml}] +indent_size = 2 +indent_style = space + +[*.md] +indent_size = 2 +indent_style = space From ea72d571b13fb57f4a2dcd84fa029f5c5006c16e Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:25:32 +0300 Subject: [PATCH 08/10] gh: let CI matrix legs finish independently --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9b2a3f9..44afe68 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,7 @@ jobs: test: name: Test strategy: + fail-fast: false matrix: go: ['1.14', '1.15', '1.16', '1.21', '1.22', '1.23', '1.24', '1.25'] runs-on: ubuntu-latest From badd6594e4aa397ec27d41a10e2330fb410e8753 Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:38:37 +0300 Subject: [PATCH 09/10] gh: rolled back go 1.24/1.25 from the CI matrix go 1.24 removed the x509sha1 GODEBUG option, so the SHA1 test cases fail on 1.24 and newer. --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 44afe68..8e6accc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,7 +20,7 @@ jobs: strategy: fail-fast: false matrix: - go: ['1.14', '1.15', '1.16', '1.21', '1.22', '1.23', '1.24', '1.25'] + go: ['1.14', '1.15', '1.16', '1.21', '1.22', '1.23'] runs-on: ubuntu-latest steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 From da4f6303b85851151841ed324cca74caf50510a3 Mon Sep 17 00:00:00 2001 From: Panagiotis Siatras Date: Wed, 15 Jul 2026 15:54:41 +0300 Subject: [PATCH 10/10] editorconfig: merged the space-indented sections --- .editorconfig | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.editorconfig b/.editorconfig index a844ad5..6e544d6 100644 --- a/.editorconfig +++ b/.editorconfig @@ -8,10 +8,6 @@ insert_final_newline = true tab_width = unset trim_trailing_whitespace = true -[*.{yml,yaml}] -indent_size = 2 -indent_style = space - -[*.md] +[*.{md,yml,yaml}] indent_size = 2 indent_style = space