Skip to content

Commit dc83a4c

Browse files
mrz1836mrz1836
authored
[Sync] Update project files from source repository (ec82cd5) (#92)
* sync: bump tool versions in env configs and actions * chore(deps): update dependabot configuration for GitHub Actions
1 parent 0025e59 commit dc83a4c

7 files changed

Lines changed: 113 additions & 29 deletions

File tree

‎.github/actions/setup-goreleaser/action.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ runs:
105105
# --------------------------------------------------------------------
106106
- name: ✅ Install GoReleaser (cache miss)
107107
if: steps.check-existing.outputs.exists != 'true' && steps.goreleaser-cache.outputs.cache-hit != 'true'
108-
uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c # v7.1.0
108+
uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
109109
with:
110110
distribution: goreleaser
111111
version: ${{ inputs.goreleaser-version }}

‎.github/dependabot.yml‎

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,7 @@
22
# Dependabot Configuration
33
#
44
# Purpose:
5-
# • Keep Go modules, GitHub Actions and DevContainer images/features
6-
# base images up‑to‑date with zero‑day security patches and semantic‑version
7-
# upgrades.
5+
# • Keep GitHub Actions updated with the latest security patches and features.
86
# • Reduce attack surface by limiting outdated dependencies.
97
# • Minimise PR noise via smart grouping and sane pull‑request limits.
108
#
@@ -13,13 +11,13 @@
1311
# https://docs.github.com/en/code-security/dependabot/configuration-options-for-dependency-updates
1412
#
1513
# Security Hardened Defaults:
16-
# • Weekly cadence (Monday 09:00 America/New_York) – align with CVE dump cycle.
14+
# • Weekly cadence (Tuesday 11:00 America/New_York) – align with typical maintenance windows.
1715
# • Direct dependencies only – prevents unsolicited transitive churn.
18-
# • PRs labeled, assigned, and target the protected "master" branch.
16+
# • PRs labeled, assigned, and target the protected master branch.
1917
# • PR titles prefixed with chore(scope): – conventional commits.
2018
# • Force‑push and delete‑branch disabled via branch‑protection rules.
2119
# • PR limit = 10 to avoid queue flooding.
22-
# • All dependency PRs require passing CI + CODEOWNERS review.
20+
# • All dependency PRs require passing CI checks before merging.
2321
# ────────────────────────────────────────────────────────────────
2422

2523
version: 2
@@ -33,19 +31,15 @@ updates:
3331
target-branch: "master"
3432
schedule:
3533
interval: "weekly"
36-
day: "monday"
37-
time: "09:00"
34+
day: "tuesday"
35+
time: "11:00"
3836
timezone: "America/New_York"
3937
allow:
4038
- dependency-type: "direct"
4139
groups:
42-
security-deps:
43-
patterns:
44-
- "*crypto*"
45-
- "*security*"
46-
- "*auth*"
47-
- "*jwt*"
48-
- "*oauth*"
40+
gomod-all:
41+
applies-to: version-updates
42+
patterns: ["*"]
4943
update-types: ["minor", "patch"]
5044
open-pull-requests-limit: 10
5145
assignees: ["mrz1836"]
@@ -62,8 +56,8 @@ updates:
6256
target-branch: "master"
6357
schedule:
6458
interval: "weekly"
65-
day: "monday"
66-
time: "09:15"
59+
day: "tuesday"
60+
time: "11:15"
6761
timezone: "America/New_York"
6862
allow:
6963
- dependency-type: "direct"
@@ -85,8 +79,8 @@ updates:
8579
target-branch: "master"
8680
schedule:
8781
interval: "weekly"
88-
day: "monday"
89-
time: "09:30"
82+
day: "tuesday"
83+
time: "11:30"
9084
timezone: "America/New_York"
9185
allow:
9286
- dependency-type: "direct"

‎.github/env/10-coverage.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ GO_COVERAGE_PROVIDER=internal
3232
CODECOV_TOKEN_REQUIRED=false
3333

3434
# Go Coverage Tool Version
35-
GO_COVERAGE_VERSION=v1.3.8
35+
GO_COVERAGE_VERSION=v1.3.9
3636
GO_COVERAGE_USE_LOCAL=false
3737

3838
# ================================================================================================

‎.github/env/10-mage-x.env‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
# ================================================================================================
3737

3838
# MAGE-X version
39-
MAGE_X_VERSION=v1.20.15
39+
MAGE_X_VERSION=v1.20.16
4040

4141
# For mage-x development, set to 'true' to use local version instead of downloading from releases
4242
MAGE_X_USE_LOCAL=false
@@ -62,7 +62,7 @@ MAGE_X_FORMAT_EXCLUDE_PATHS=vendor,node_modules,.git,.idea
6262
MAGE_X_GITLEAKS_VERSION=8.30.1
6363
MAGE_X_GOFUMPT_VERSION=v0.9.2
6464
MAGE_X_GOLANGCI_LINT_VERSION=v2.11.4
65-
MAGE_X_GORELEASER_VERSION=v2.15.3
65+
MAGE_X_GORELEASER_VERSION=v2.15.4
6666
MAGE_X_GOVULNCHECK_VERSION=v1.1.4
6767
MAGE_X_GO_SECONDARY_VERSION=1.24.x
6868
MAGE_X_GO_VERSION=1.24.x
@@ -72,7 +72,7 @@ MAGE_X_STATICCHECK_VERSION=2026.1
7272
MAGE_X_SWAG_VERSION=v1.16.6
7373
MAGE_X_YAMLFMT_VERSION=v0.21.0
7474
MAGE_X_BENCHSTAT_VERSION=v0.0.0-20260409210113-8e83ce0f7b1c
75-
MAGE_X_MAGE_VERSION=v1.17.1
75+
MAGE_X_MAGE_VERSION=v1.17.2
7676

7777
# ================================================================================================
7878
# 📝 RUNTIME VARIABLES (set by setup-goreleaser action)

‎.github/env/10-pre-commit.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
# 🪝 PRE-COMMIT TOOL VERSION
2727
# ================================================================================================
2828

29-
GO_PRE_COMMIT_VERSION=v1.8.1
29+
GO_PRE_COMMIT_VERSION=v1.8.2
3030
GO_PRE_COMMIT_USE_LOCAL=false
3131

3232
# ================================================================================================

‎.github/workflows/fortress-security-scans.yml‎

Lines changed: 93 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,20 @@ jobs:
160160
if [[ $NANCY_EXIT_CODE -eq 0 ]]; then
161161
echo "nancy-status=success" >> $GITHUB_OUTPUT
162162
echo "✅ Nancy scan completed - no vulnerabilities found"
163+
elif grep -qi "rate limited by OSS Index" nancy-output.log; then
164+
# OSS Index rate-limited the scan; treat as inconclusive, NOT as a CI failure.
165+
# Add OSSI_USERNAME and OSSI_TOKEN secrets to authenticate and lift the limit.
166+
echo "nancy-status=rate-limited" >> $GITHUB_OUTPUT
167+
echo "⚠️ Nancy scan inconclusive - OSS Index rate-limited the request (not failing CI)."
168+
echo " Configure OSSI_USERNAME and OSSI_TOKEN secrets to authenticate and lift the limit."
169+
echo " Register at https://ossindex.sonatype.org/user/register"
170+
elif grep -qi "402 Payment Required" nancy-output.log; then
171+
# OSS Index returned 402 (free-tier quota exhausted / paid plan required);
172+
# treat as inconclusive, NOT as a CI failure.
173+
echo "nancy-status=payment-required" >> $GITHUB_OUTPUT
174+
echo "⚠️ Nancy scan inconclusive - OSS Index returned 402 Payment Required (not failing CI)."
175+
echo " Configure OSSI_USERNAME and OSSI_TOKEN secrets to authenticate against your OSS Index account."
176+
echo " Register at https://ossindex.sonatype.org/user/register"
163177
else
164178
echo "nancy-status=failure" >> $GITHUB_OUTPUT
165179
echo "❌ Nancy scan completed - vulnerabilities detected (exit code: $NANCY_EXIT_CODE)"
@@ -168,11 +182,27 @@ jobs:
168182
# --------------------------------------------------------------------
169183
# Create GitHub Annotations for failures
170184
# --------------------------------------------------------------------
171-
- name: 📋 Create GitHub Annotations
185+
- name: 📋 Create GitHub Annotations (vulnerabilities)
172186
if: always() && steps.run-nancy.outputs.nancy-status == 'failure'
173187
run: |
174188
echo "::error title=Nancy Security Scan Failed::Vulnerabilities detected in Go dependencies - see job summary for details"
175189
190+
# --------------------------------------------------------------------
191+
# Create GitHub Annotations for rate-limited scans (warning, not error)
192+
# --------------------------------------------------------------------
193+
- name: 📋 Create GitHub Annotations (rate-limited)
194+
if: always() && steps.run-nancy.outputs.nancy-status == 'rate-limited'
195+
run: |
196+
echo "::warning title=Nancy Rate Limited::OSS Index rate-limited the scan; results inconclusive. Add OSSI_USERNAME and OSSI_TOKEN secrets to authenticate and lift the limit."
197+
198+
# --------------------------------------------------------------------
199+
# Create GitHub Annotations for 402 Payment Required (warning, not error)
200+
# --------------------------------------------------------------------
201+
- name: 📋 Create GitHub Annotations (payment-required)
202+
if: always() && steps.run-nancy.outputs.nancy-status == 'payment-required'
203+
run: |
204+
echo "::warning title=Nancy Payment Required::OSS Index returned 402 Payment Required; results inconclusive. Add OSSI_USERNAME and OSSI_TOKEN secrets to authenticate against your OSS Index account."
205+
176206
# --------------------------------------------------------------------
177207
# Summary of Nancy results
178208
# --------------------------------------------------------------------
@@ -192,6 +222,10 @@ jobs:
192222
193223
if [[ "$NANCY_STATUS" == "success" ]]; then
194224
echo "| **Result** | ✅ No vulnerabilities found |" >> $GITHUB_STEP_SUMMARY
225+
elif [[ "$NANCY_STATUS" == "rate-limited" ]]; then
226+
echo "| **Result** | ⚠️ Rate limited by OSS Index — scan inconclusive (CI not failed) |" >> $GITHUB_STEP_SUMMARY
227+
elif [[ "$NANCY_STATUS" == "payment-required" ]]; then
228+
echo "| **Result** | ⚠️ OSS Index returned 402 Payment Required — scan inconclusive (CI not failed) |" >> $GITHUB_STEP_SUMMARY
195229
else
196230
echo "| **Result** | ❌ Vulnerabilities detected |" >> $GITHUB_STEP_SUMMARY
197231
fi
@@ -201,8 +235,58 @@ jobs:
201235
echo "The following vulnerabilities were excluded from the scan:" >> $GITHUB_STEP_SUMMARY
202236
echo "${{ env.NANCY_EXCLUDES }}" >> $GITHUB_STEP_SUMMARY
203237
204-
# Show failure details if applicable
205-
if [[ "$NANCY_STATUS" != "success" ]] && [[ -f nancy-output.log ]]; then
238+
# Rate-limited: explain clearly that CI was NOT failed and how to remediate
239+
if [[ "$NANCY_STATUS" == "rate-limited" ]]; then
240+
echo "" >> $GITHUB_STEP_SUMMARY
241+
echo "### ⚠️ OSS Index Rate Limit" >> $GITHUB_STEP_SUMMARY
242+
echo "" >> $GITHUB_STEP_SUMMARY
243+
echo "Sonatype's OSS Index rate-limited this request before Nancy could complete the scan." >> $GITHUB_STEP_SUMMARY
244+
echo "**This is not a vulnerability detection** and CI has **not** been failed for this run." >> $GITHUB_STEP_SUMMARY
245+
echo "" >> $GITHUB_STEP_SUMMARY
246+
echo "**To remediate (recommended):**" >> $GITHUB_STEP_SUMMARY
247+
echo "" >> $GITHUB_STEP_SUMMARY
248+
echo "1. Register a free account at <https://ossindex.sonatype.org/user/register>." >> $GITHUB_STEP_SUMMARY
249+
echo "2. Retrieve your username (email) and API token from <https://ossindex.sonatype.org/user/settings>." >> $GITHUB_STEP_SUMMARY
250+
echo "3. Add them as repository secrets named \`OSSI_USERNAME\` and \`OSSI_TOKEN\`." >> $GITHUB_STEP_SUMMARY
251+
echo "" >> $GITHUB_STEP_SUMMARY
252+
echo "Authenticated requests have a substantially higher rate limit and avoid this state." >> $GITHUB_STEP_SUMMARY
253+
if [[ -f nancy-output.log ]]; then
254+
echo "" >> $GITHUB_STEP_SUMMARY
255+
echo "<details>" >> $GITHUB_STEP_SUMMARY
256+
echo "<summary>Click to expand Nancy output</summary>" >> $GITHUB_STEP_SUMMARY
257+
echo "" >> $GITHUB_STEP_SUMMARY
258+
echo '```' >> $GITHUB_STEP_SUMMARY
259+
head -50 nancy-output.log >> $GITHUB_STEP_SUMMARY
260+
echo '```' >> $GITHUB_STEP_SUMMARY
261+
echo "</details>" >> $GITHUB_STEP_SUMMARY
262+
fi
263+
# Payment-required (402): explain clearly that CI was NOT failed and how to remediate
264+
elif [[ "$NANCY_STATUS" == "payment-required" ]]; then
265+
echo "" >> $GITHUB_STEP_SUMMARY
266+
echo "### ⚠️ OSS Index Payment Required (402)" >> $GITHUB_STEP_SUMMARY
267+
echo "" >> $GITHUB_STEP_SUMMARY
268+
echo "Sonatype's OSS Index returned **402 Payment Required**, indicating the free-tier quota for unauthenticated requests has been exhausted." >> $GITHUB_STEP_SUMMARY
269+
echo "**This is not a vulnerability detection** and CI has **not** been failed for this run." >> $GITHUB_STEP_SUMMARY
270+
echo "" >> $GITHUB_STEP_SUMMARY
271+
echo "**To remediate (recommended):**" >> $GITHUB_STEP_SUMMARY
272+
echo "" >> $GITHUB_STEP_SUMMARY
273+
echo "1. Register a free account at <https://ossindex.sonatype.org/user/register>." >> $GITHUB_STEP_SUMMARY
274+
echo "2. Retrieve your username (email) and API token from <https://ossindex.sonatype.org/user/settings>." >> $GITHUB_STEP_SUMMARY
275+
echo "3. Add them as repository secrets named \`OSSI_USERNAME\` and \`OSSI_TOKEN\`." >> $GITHUB_STEP_SUMMARY
276+
echo "" >> $GITHUB_STEP_SUMMARY
277+
echo "Authenticated requests have a higher quota and avoid this state." >> $GITHUB_STEP_SUMMARY
278+
if [[ -f nancy-output.log ]]; then
279+
echo "" >> $GITHUB_STEP_SUMMARY
280+
echo "<details>" >> $GITHUB_STEP_SUMMARY
281+
echo "<summary>Click to expand Nancy output</summary>" >> $GITHUB_STEP_SUMMARY
282+
echo "" >> $GITHUB_STEP_SUMMARY
283+
echo '```' >> $GITHUB_STEP_SUMMARY
284+
head -50 nancy-output.log >> $GITHUB_STEP_SUMMARY
285+
echo '```' >> $GITHUB_STEP_SUMMARY
286+
echo "</details>" >> $GITHUB_STEP_SUMMARY
287+
fi
288+
# Real vulnerability failure: keep existing details section
289+
elif [[ "$NANCY_STATUS" == "failure" ]] && [[ -f nancy-output.log ]]; then
206290
echo "" >> $GITHUB_STEP_SUMMARY
207291
echo "### 🚨 Vulnerability Details" >> $GITHUB_STEP_SUMMARY
208292
echo "" >> $GITHUB_STEP_SUMMARY
@@ -252,6 +336,12 @@ jobs:
252336

253337
# --------------------------------------------------------------------
254338
# Fail job if vulnerabilities found
339+
#
340+
# Only fires when nancy-status == 'failure' (real vulnerabilities).
341+
# The 'rate-limited' status is intentionally excluded: an OSS Index rate
342+
# limit produces an inconclusive scan, not a vulnerability finding, and
343+
# must not red-X CI. See the run-nancy step above for the rate-limit
344+
# detection logic.
255345
# --------------------------------------------------------------------
256346
- name: 🚨 Fail job if vulnerabilities found
257347
if: always() && steps.run-nancy.outputs.nancy-status == 'failure'

‎.github/workflows/fortress.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# ------------------------------------------------------------------------------------
22
# 🏰 GoFortress - Enterprise-grade CI/CD fortress for Go applications
33
#
4-
# Version: 1.7.2 | Released: 2026-03-09
4+
# Version: 1.7.3 | Released: 2026-04-28
55
#
66
# Built Strong. Tested Harder.
77
#

0 commit comments

Comments
 (0)