From 20606066fe6667eb59b054850aecfb9bfca39436 Mon Sep 17 00:00:00 2001 From: Henry McConville Date: Sun, 1 Nov 2026 17:33:25 +0000 Subject: [PATCH 1/3] Improve GitHub workflows Test workflow: - Run on pushes to master as well as pull requests - Restrict the token to read-only and cancel superseded PR runs - Run tests with the race detector and replace go get with go mod download - Add a lint job with a go mod tidy check and golangci-lint - Add an image job that builds the Docker image and scans it with Trivy, failing on fixable high and critical vulnerabilities Container Scan workflow: - Pin the Trivy action to a commit SHA - Re-enable the workflow on each scheduled run, so the schedule isn't disabled after 60 days without repository activity Also add Dependabot config for GitHub Actions and Go modules. Co-Authored-By: Claude Opus 5.5 --- .github/dependabot.yml | 19 +++++++ .github/workflows/container-scan.yml | 17 ++++++- .github/workflows/main.yml | 76 +++++++++++++++++++++++++++- 3 files changed, 109 insertions(+), 3 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..7664278 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,19 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + groups: + github-actions: + patterns: + - "*" + + - package-ecosystem: gomod + directory: / + schedule: + interval: weekly + groups: + go-dependencies: + patterns: + - "*" diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml index eac4572..e442b3d 100644 --- a/.github/workflows/container-scan.yml +++ b/.github/workflows/container-scan.yml @@ -23,7 +23,7 @@ jobs: echo "version=$(cat VERSION)" >> $GITHUB_OUTPUT - name: Run Trivy - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@8f28faec26515256b6d22074d1d2a8986f4cbd87 # master env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db with: @@ -36,3 +36,18 @@ jobs: uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' + + # GitHub disables scheduled workflows after 60 days without repository + # activity, so re-enable this workflow on each scheduled run + keepalive: + name: Keep Schedule Enabled + if: github.event_name == 'schedule' + runs-on: ubuntu-latest + permissions: + actions: write + + steps: + - name: Enable workflow + env: + GH_TOKEN: ${{ github.token }} + run: gh api --method PUT "repos/$GITHUB_REPOSITORY/actions/workflows/container-scan.yml/enable" diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 7b1e760..1feb9eb 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,10 +1,20 @@ name: Test on: + push: + branches: + - master pull_request: branches: - master +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} + jobs: test: runs-on: ubuntu-latest @@ -18,10 +28,72 @@ jobs: go-version-file: 'go.mod' - name: Install dependencies - run: go get . + run: go mod download - name: Build run: go build -v ./... - name: Test - run: go test -v ./... + run: go test -v -race ./... + + lint: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v7 + + - name: Setup Go + uses: actions/setup-go@v7 + with: + go-version-file: 'go.mod' + + - name: Check go.mod and go.sum are tidy + run: go mod tidy -diff + + - name: Run golangci-lint + uses: golangci/golangci-lint-action@v9 + with: + version: v2.15.0 + + image: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v7 + + - name: Setup Go + uses: actions/setup-go@v7 + with: + go-version-file: 'go.mod' + cache: false + + # Matches the Go version selected by release-version.sh + - name: Get Go Version + id: get-go-version + run: | + echo "version=$(go mod edit -json | jq -r '.Toolchain // .Go' | sed 's/go//')" >> $GITHUB_OUTPUT + + - name: Setup Docker Buildx + uses: docker/setup-buildx-action@v4 + + - name: Build image + uses: docker/build-push-action@v7 + with: + context: . + platforms: linux/amd64 + load: true + tags: github-exporter:ci + build-args: | + GOLANG_VERSION=${{ steps.get-go-version.outputs.version }} + + - name: Run Trivy + uses: aquasecurity/trivy-action@8f28faec26515256b6d22074d1d2a8986f4cbd87 # master + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + with: + scan-type: image + image-ref: github-exporter:ci + format: table + exit-code: '1' + ignore-unfixed: true + severity: CRITICAL,HIGH From a7cdfcbfe6447750cff13acea87d52a9fe5b3edb Mon Sep 17 00:00:00 2001 From: Henry McConville Date: Sun, 1 Nov 2026 17:41:44 +0000 Subject: [PATCH 2/3] remove keepalive --- .github/workflows/container-scan.yml | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml index e442b3d..31eba8d 100644 --- a/.github/workflows/container-scan.yml +++ b/.github/workflows/container-scan.yml @@ -36,18 +36,3 @@ jobs: uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' - - # GitHub disables scheduled workflows after 60 days without repository - # activity, so re-enable this workflow on each scheduled run - keepalive: - name: Keep Schedule Enabled - if: github.event_name == 'schedule' - runs-on: ubuntu-latest - permissions: - actions: write - - steps: - - name: Enable workflow - env: - GH_TOKEN: ${{ github.token }} - run: gh api --method PUT "repos/$GITHUB_REPOSITORY/actions/workflows/container-scan.yml/enable" From 7ec04b3ae225f306c878c8545a89904181d8b385 Mon Sep 17 00:00:00 2001 From: Henry McConville Date: Sun, 1 Nov 2026 17:45:06 +0000 Subject: [PATCH 3/3] linting fixes --- exporter/prometheus_test.go | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/exporter/prometheus_test.go b/exporter/prometheus_test.go index dc00b03..5db24bd 100644 --- a/exporter/prometheus_test.go +++ b/exporter/prometheus_test.go @@ -6,6 +6,7 @@ import ( "crypto/x509" "encoding/pem" "os" + "path/filepath" "testing" "github.com/githubexporter/github-exporter/config" @@ -22,19 +23,14 @@ func writeTempRSAKey(t *testing.T) string { key, err := rsa.GenerateKey(rand.Reader, 2048) require.NoError(t, err) - f, err := os.CreateTemp("", "test-github-app-key-*.pem") - require.NoError(t, err) - defer f.Close() - - err = pem.Encode(f, &pem.Block{ + path := filepath.Join(t.TempDir(), "test-github-app-key.pem") + keyPEM := pem.EncodeToMemory(&pem.Block{ Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key), }) - require.NoError(t, err) - - t.Cleanup(func() { os.Remove(f.Name()) }) + require.NoError(t, os.WriteFile(path, keyPEM, 0o600)) - return f.Name() + return path } func newTestExporter(cfg config.Config) *Exporter {