Skip to content

Commit d837608

Browse files
apham0001apham0001
committed
feat: modernize CI pipelines, add Trivy scanning, update CodeQL
- Update all GitHub Actions to latest versions (v4/v5/v6) - Fix CodeQL from deprecated v1 to v3 - Add Trivy filesystem vulnerability scanning - Add QEMU + Buildx for multi-arch Docker builds (amd64 + arm64) - Add GHCR as additional registry - Add security-events permission for SARIF upload - Update .goreleaser.yaml for multi-arch docker manifests
1 parent f3b78af commit d837608

6 files changed

Lines changed: 120 additions & 66 deletions

File tree

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 15 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,62 +1,35 @@
1-
# For most projects, this workflow file will not need changing; you simply need
2-
# to commit it to your repository.
3-
#
4-
# You may wish to alter this file to override the set of languages analyzed,
5-
# or to provide custom queries or build logic.
61
name: "CodeQL"
7-
82
on:
93
push:
10-
branches: [ main ]
4+
branches: [main]
115
pull_request:
12-
# The branches below must be a subset of the branches above
13-
branches: [ main ]
6+
branches: [main]
147
schedule:
158
- cron: '0 17 * * 2'
16-
179
jobs:
1810
analyze:
1911
name: Analyze
2012
runs-on: ubuntu-latest
21-
13+
permissions:
14+
security-events: write
2215
strategy:
2316
fail-fast: false
2417
matrix:
25-
# Override automatic language detection by changing the below list
26-
# Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
27-
language: [ 'go' ]
28-
# Learn more...
29-
# https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
30-
18+
language: ['go']
3119
steps:
3220
- name: Checkout repository
33-
uses: actions/checkout@v2
34-
35-
# Initializes the CodeQL tools for scanning.
21+
uses: actions/checkout@v4
22+
- name: Set up Go
23+
uses: actions/setup-go@v5
24+
with:
25+
go-version: '1.25'
26+
- name: Run go generate
27+
run: go generate ./...
3628
- name: Initialize CodeQL
37-
uses: github/codeql-action/init@v1
29+
uses: github/codeql-action/init@v3
3830
with:
3931
languages: ${{ matrix.language }}
40-
# If you wish to specify custom queries, you can do so here or in a config file.
41-
# By default, queries listed here will override any specified in a config file.
42-
# Prefix the list here with "+" to use these queries and those in the config file.
43-
# queries: ./path/to/local/query, your-org/your-repo/queries@main
44-
45-
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
46-
# If this step fails, then you should remove it and run the build manually (see below)
4732
- name: Autobuild
48-
uses: github/codeql-action/autobuild@v1
49-
50-
# ℹ️ Command-line programs to run using the OS shell.
51-
# 📚 https://git.io/JvXDl
52-
53-
# ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
54-
# and modify them (or add more) to build your code if your project
55-
# uses a compiled language
56-
57-
#- run: |
58-
# make bootstrap
59-
# make release
60-
33+
uses: github/codeql-action/autobuild@v3
6134
- name: Perform CodeQL Analysis
62-
uses: github/codeql-action/analyze@v1
35+
uses: github/codeql-action/analyze@v3

‎.github/workflows/lint.yml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,20 @@ on:
33
push:
44
pull_request:
55
jobs:
6-
test:
6+
lint:
77
name: Run lint
88
runs-on: ubuntu-latest
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v2
11+
uses: actions/checkout@v4
1212
- name: Set up Go
13-
uses: actions/setup-go@v2
13+
uses: actions/setup-go@v5
1414
with:
15-
go-version: 1.23
15+
go-version: '1.25'
1616
- name: Run go generate
17-
run: go generate
17+
run: go generate ./...
1818
- name: Run golangci-lint
19-
uses: golangci/golangci-lint-action@v3
19+
uses: golangci/golangci-lint-action@v6
2020
with:
21-
version: v1.62
21+
version: latest
2222
args: -E asciicheck -E bodyclose -E dupl -E errorlint -E copyloopvar -E funlen
23-
skip-pkg-cache: true
24-
skip-build-cache: true

‎.github/workflows/release.yml‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,38 +3,53 @@ on:
33
push:
44
branches:
55
- main
6+
tags:
7+
- 'v*'
68
jobs:
79
release:
810
name: Release
911
runs-on: ubuntu-latest
12+
permissions:
13+
contents: write
14+
packages: write
1015
steps:
1116
- name: Checkout
12-
uses: actions/checkout@v2
17+
uses: actions/checkout@v4
1318
- name: Set up Go
14-
uses: actions/setup-go@v2
19+
uses: actions/setup-go@v5
1520
with:
16-
go-version: 1.23
21+
go-version: '1.25'
22+
- name: Set up QEMU
23+
uses: docker/setup-qemu-action@v3
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@v3
1726
- name: Login to Docker Hub
18-
uses: docker/login-action@v1
27+
uses: docker/login-action@v3
1928
with:
2029
username: ${{ secrets.DOCKER_USERNAME }}
2130
password: ${{ secrets.DOCKER_PASSWORD }}
2231
- name: Login to Quay.io
23-
uses: docker/login-action@v1
32+
uses: docker/login-action@v3
2433
with:
2534
registry: quay.io
2635
username: ${{ secrets.QUAY_USERNAME }}
2736
password: ${{ secrets.QUAY_PASSWORD }}
37+
- name: Login to GHCR
38+
uses: docker/login-action@v3
39+
with:
40+
registry: ghcr.io
41+
username: ${{ github.actor }}
42+
password: ${{ secrets.GITHUB_TOKEN }}
2843
- name: Import signing key
2944
run: echo "${GPG_KEY}" | base64 -d | gpg --batch --import && echo "${GPG_KEY}" | base64 -d >/tmp/signing.gpg
3045
env:
3146
GPG_KEY: ${{ secrets.GPG_KEY }}
3247
- name: Install packages
3348
run: sudo apt-get install dpkg-sig rpm
3449
- name: Run GoReleaser
35-
uses: goreleaser/goreleaser-action@v2
50+
uses: goreleaser/goreleaser-action@v6
3651
with:
3752
version: latest
38-
args: release --rm-dist
53+
args: release --clean
3954
env:
4055
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@ jobs:
88
runs-on: ubuntu-latest
99
steps:
1010
- name: Checkout
11-
uses: actions/checkout@v2
11+
uses: actions/checkout@v4
1212
- name: Set up Go
13-
uses: actions/setup-go@v2
13+
uses: actions/setup-go@v5
1414
with:
15-
go-version: 1.23
15+
go-version: '1.25'
1616
- name: Run go generate
17-
run: go generate
17+
run: go generate ./...
1818
- name: Run go tests
1919
run: go test -cover -p 1 -v ./...

‎.github/workflows/trivy.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Trivy Security Scan
2+
on:
3+
push:
4+
branches: [main]
5+
pull_request:
6+
branches: [main]
7+
schedule:
8+
- cron: '0 6 * * 1'
9+
jobs:
10+
trivy-fs:
11+
name: Trivy Filesystem Scan
12+
runs-on: ubuntu-latest
13+
permissions:
14+
security-events: write
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
- name: Run Trivy vulnerability scanner (filesystem)
19+
uses: aquasecurity/trivy-action@master
20+
with:
21+
scan-type: 'fs'
22+
scan-ref: '.'
23+
format: 'sarif'
24+
output: 'trivy-fs-results.sarif'
25+
severity: 'CRITICAL,HIGH'
26+
- name: Upload Trivy scan results to GitHub Security tab
27+
uses: github/codeql-action/upload-sarif@v3
28+
if: always()
29+
with:
30+
sarif_file: 'trivy-fs-results.sarif'

‎.goreleaser.yaml‎

Lines changed: 42 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ builds:
1010
- windows
1111
goarch:
1212
- amd64
13+
- arm64
1314
env:
1415
- CGO_ENABLED=0
1516
archives:
@@ -57,11 +58,48 @@ nfpms:
5758
bindir: /usr/bin
5859
dockers:
5960
- image_templates:
60-
- "containerssh/agent:latest"
61-
- "containerssh/agent:{{ .Tag }}"
62-
- "quay.io/containerssh/agent:latest"
63-
- "quay.io/containerssh/agent:{{ .Tag }}"
61+
- "containerssh/agent:{{ .Tag }}-amd64"
62+
- "quay.io/containerssh/agent:{{ .Tag }}-amd64"
63+
- "ghcr.io/containerssh/agent:{{ .Tag }}-amd64"
6464
dockerfile: Dockerfile
65+
use: buildx
66+
build_flag_templates:
67+
- "--platform=linux/amd64"
68+
goarch: amd64
69+
- image_templates:
70+
- "containerssh/agent:{{ .Tag }}-arm64"
71+
- "quay.io/containerssh/agent:{{ .Tag }}-arm64"
72+
- "ghcr.io/containerssh/agent:{{ .Tag }}-arm64"
73+
dockerfile: Dockerfile
74+
use: buildx
75+
build_flag_templates:
76+
- "--platform=linux/arm64"
77+
goarch: arm64
78+
docker_manifests:
79+
- name_template: "containerssh/agent:{{ .Tag }}"
80+
image_templates:
81+
- "containerssh/agent:{{ .Tag }}-amd64"
82+
- "containerssh/agent:{{ .Tag }}-arm64"
83+
- name_template: "containerssh/agent:latest"
84+
image_templates:
85+
- "containerssh/agent:{{ .Tag }}-amd64"
86+
- "containerssh/agent:{{ .Tag }}-arm64"
87+
- name_template: "quay.io/containerssh/agent:{{ .Tag }}"
88+
image_templates:
89+
- "quay.io/containerssh/agent:{{ .Tag }}-amd64"
90+
- "quay.io/containerssh/agent:{{ .Tag }}-arm64"
91+
- name_template: "quay.io/containerssh/agent:latest"
92+
image_templates:
93+
- "quay.io/containerssh/agent:{{ .Tag }}-amd64"
94+
- "quay.io/containerssh/agent:{{ .Tag }}-arm64"
95+
- name_template: "ghcr.io/containerssh/agent:{{ .Tag }}"
96+
image_templates:
97+
- "ghcr.io/containerssh/agent:{{ .Tag }}-amd64"
98+
- "ghcr.io/containerssh/agent:{{ .Tag }}-arm64"
99+
- name_template: "ghcr.io/containerssh/agent:latest"
100+
image_templates:
101+
- "ghcr.io/containerssh/agent:{{ .Tag }}-amd64"
102+
- "ghcr.io/containerssh/agent:{{ .Tag }}-arm64"
65103
source:
66104
enabled: true
67105
name_template: 'containerssh-agent-{{ .Version }}-source'

0 commit comments

Comments
 (0)