Pin CI actions to commit SHAs and fix golangci-lint version#82
Merged
Conversation
Unpinned major-version tags (@v4, @v5, @v6) let a compromised or force-moved upstream tag run arbitrary code in CI, and the release workflow holds contents: write. golangci-lint-action's version: latest also let lint rules change under the project without a commit. Pin actions/checkout, actions/setup-go, golangci-lint-action, and goreleaser-action to full commit SHAs (tag noted in a trailing comment), and pin golangci-lint itself to v2.5.0, the version already verified to lint this repo cleanly. Closes #73
golangci-lint-action@v6 (pinned in the previous commit) rejects any
v2.x version string outright ("golangci-lint v2 is not supported by
golangci-lint-action v6, you must update to golangci-lint-action v7"),
which broke CI. Use v1.64.8 instead, the latest v1.x release, verified
locally to lint this repo with 0 issues.
golangci-lint's v1 line is no longer where new releases land upstream (latest is v1.64.8, several versions behind current v2.x), so pinning to it would mean starting this fix already on an aging branch. golangci-lint-action v7 supports v2 exclusively (v6 only supported v1), with no other breaking changes per its changelog. Verified v2.12.2 lints this repo with 0 issues locally via `go install`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/checkout,actions/setup-go,golangci/golangci-lint-action(inci.yml) andactions/checkout,actions/setup-go,goreleaser/goreleaser-action(inrelease.yml) to full commit SHAs, with the resolved tag kept as a trailing comment for readability. This closes the supply-chain gap where a compromised or force-moved major-version tag (@v4/@v5/@v6/@v7) could run arbitrary code in CI — notably inrelease.yml, which holdscontents: write.golangci-lint-action'sversion: latestwith an explicitversion: v2.12.2, so lint rules no longer change under the project without a commit. Also bumped the action itself fromv6tov7.0.1, sincev6only supports golangci-lint v1 (its v1 line is no longer where upstream releases land — latest isv1.64.8) whilev7supports v2 exclusively, with no other breaking changes per the action's changelog. Verified locally (go install .../golangci-lint@v2.12.2+golangci-lint run) that this reports 0 issues against the current codebase, and confirmed green in CI on this branch.goreleaser-action's ownversion: latestinput (the GoReleaser CLI version, not the action) was left unchanged — it's outside this issue's stated scope and its behavior inrelease.ymlcan't be exercised in this environment (needs a real tag push +GITHUB_TOKEN).Related Issue
Closes #73
Checklist
go test ./...passes locally) — N/A, workflow-only change; existing suite still passes.go vet ./...andgolangci-lint runare cleandocs/API.md), configuration (README.md,packaging/pimonitor.example.yaml), or installation/packaging (packaging/install.sh, systemd units) — N/A, no such changes./api/v1/...response shapes, or a new API version was introduced instead — N/A, no API changes.