Makefile.maker.yaml config

.github/renovate.json

@@ -0,0 +1,48 @@
+{
+  "extends": [
+    "config:base",
+    "default:pinDigestsDisabled",
+    "github>whitesource/merge-confidence:beta",
+    "docker:disable"
+  ],
+  "assignees": [
+    "notque"
+  ],
+  "commitMessageAction": "Renovate: Update",
+  "constraints": {
+    "go": "1.21"
+  },
+  "postUpdateOptions": [
+    "gomodTidy",
+    "gomodUpdateImportPaths"
+  ],
+  "packageRules": [
+    {
+      "matchPackageNames": [
+        "golang"
+      ],
+      "allowedVersions": "1.21.x"
+    },
+    {
+      "matchPackagePatterns": [
+        "^github\\.com\\/sapcc\\/.*"
+      ],
+      "automerge": true,
+      "groupName": "github.com/sapcc"
+    },
+    {
+      "excludePackagePatterns": [
+        "^github\\.com\\/sapcc\\/.*"
+      ],
+      "matchPackagePatterns": [
+        ".*"
+      ],
+      "groupName": "External dependencies"
+    }
+  ],
+  "prHourlyLimit": 0,
+  "schedule": [
+    "before 8am on Friday"
+  ],
+  "semanticCommits": "disabled"
+}

.github/workflows/ci.yaml

@@ -1,60 +1,69 @@
+################################################################################
+# This file is AUTOGENERATED with <https://github.com/sapcc/go-makefile-maker> #
+# Edit Makefile.maker.yaml instead.                                            #
+################################################################################
+
 name: CI
 "on":
-  pull_request:
+  push:
     branches:
-    - '*'
+      - master
     paths-ignore:
-    - '**.md'
-  push:
+      - '**.md'
+  pull_request:
     branches:
-    - master
+      - '*'
     paths-ignore:
-    - '**.md'
+      - '**.md'
+permissions:
+  contents: read
 jobs:
   build:
     name: Build
     needs:
-    - lint
+      - lint
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-    - name: Set up Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: "1.21"
-    - name: Make all check
-      run: make build-all check
+      - name: Check out code
+        uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Make build
+        run: make build-all
   lint:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-    - name: Set up Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: "1.21"
-    - name: Run gofmt, go vet, staticcheck
-      run: make static-check
+      - name: Check out code
+        uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: latest
   test:
     name: Test
     needs:
-    - build
+      - build
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-    - name: Set up Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: "1.21"
-    - name: Run tests and generate coverage report
-      run: make build/cover.out
-    - name: Upload coverage report to Coveralls
-      env:
-        COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GIT_BRANCH: ${{ github.head_ref }}
-      run: |
-        go install github.com/mattn/goveralls@latest
-        goveralls -service=github -coverprofile=build/cover.out
+      - name: Check out code
+        uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Run tests and generate coverage report
+        run: make build/cover.out
+      - name: Upload coverage report to Coveralls
+        env:
+          COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_BRANCH: ${{ github.head_ref }}
+        run: |
+          go install github.com/mattn/goveralls@latest
+          goveralls -service=github -coverprofile=build/cover.out

.github/workflows/codeql.yaml

@@ -1,28 +1,38 @@
+################################################################################
+# This file is AUTOGENERATED with <https://github.com/sapcc/go-makefile-maker> #
+# Edit Makefile.maker.yaml instead.                                            #
+################################################################################
+
 name: CodeQL
 "on":
   push:
     branches:
       - master
-    paths-ignore:
-      - '**.md'
   pull_request:
     branches:
       - master
-    paths-ignore:
-      - '**.md'
   schedule:
     - cron: '00 07 * * 1'
+permissions:
+  actions: read
+  contents: read
+  security-events: write
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v2
         with:
           languages: go
-          queries: security-and-quality
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v2

.github/workflows/dependency-review.yaml

@@ -0,0 +1,24 @@
+################################################################################
+# This file is AUTOGENERATED with <https://github.com/sapcc/go-makefile-maker> #
+# Edit Makefile.maker.yaml instead.                                            #
+################################################################################
+
+name: Dependency Review
+"on":
+  pull_request:
+    branches:
+      - '*'
+permissions:
+  contents: read
+jobs:
+  review:
+    name: Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v3
+        with:
+          deny-licenses: AGPL-1.0, AGPL-3.0, GPL-1.0, GPL-2.0, GPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0
+          fail-on-severity: high

.github/workflows/license.yaml

@@ -1,27 +1,31 @@
+################################################################################
+# This file is AUTOGENERATED with <https://github.com/sapcc/go-makefile-maker> #
+# Edit Makefile.maker.yaml instead.                                            #
+################################################################################
+
 name: License
 "on":
-  pull_request:
-    branches:
-    - '*'
-    paths-ignore:
-    - '**.md'
   push:
     branches:
-    - master
-    paths-ignore:
-    - '**.md'
+      - master
+  pull_request:
+    branches:
+      - '*'
+permissions:
+  contents: read
 jobs:
   addlicense:
     name: Check
     runs-on: ubuntu-latest
     steps:
-    - name: Check out code
-      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
-    - name: Set up Go
-      uses: actions/setup-go@v4
-      with:
-        go-version: "1.17"
-    - name: Check if source code files have license header
-      run: |
-        go install github.com/google/addlicense@latest
-        find * \( -name vendor -type d -prune \) -o \( -name \*.go -exec addlicense --check -- {} + \)
+      - name: Check out code
+        uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.21"
+      - name: Check if source code files have license header
+        run: |
+          shopt -s globstar
+          go install github.com/google/addlicense@latest
+          addlicense --check -ignore "vendor/**" -- **/*.go

Makefile.maker.yaml

@@ -13,3 +13,18 @@ dockerfile:
 
 golangciLint:
   createConfig: true
+
+githubWorkflow:
+  ci:
+    enabled: true
+    coveralls: true
+    ignorePaths:
+      - "**.md" # all Markdown files
+  license:
+    enabled: true
+  securityChecks:
+    enabled: true
+renovate:
+  enabled: true
+  assignees:
+    - notque