Skip to content

ci: harden workflows, upgrade actions, fix caching#39

Open
paskal wants to merge 2 commits intoumputun:masterfrom
paskal:ci/workflow-hardening
Open

ci: harden workflows, upgrade actions, fix caching#39
paskal wants to merge 2 commits intoumputun:masterfrom
paskal:ci/workflow-hardening

Conversation

@paskal
Copy link
Contributor

@paskal paskal commented Mar 7, 2026

Changes

  • Reorder checkout before setup-go for proper dependency caching
  • Upgrade all GitHub Actions to latest versions (setup-qemu v4, setup-buildx v4, goreleaser v7)
  • Move permissions from job-level to top-level for least-privilege security
  • Add persist-credentials: false to all checkout steps
  • Pin golangci-lint-action version to v2.11.1

Note: golangci-lint v2.11.1 reports 12 code-level issues (gosec G118/G120/G705, prealloc, staticcheck) that exist on master — not introduced by this PR.

Verified golangci-lint config is valid with v2.11.1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant