apko/.github/workflows/verify.yaml at main · chainguard-dev/apko · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: verify

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

permissions: {}

jobs:
  golangci:
    name: lint
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
        with:
          egress-policy: block
          allowed-endpoints: >
            *.blob.core.windows.net:443
            *.githubapp.com:443
            api.github.com:443
            dl.google.com:443
            github.com:443
            go.dev:443
            golangci-lint.run:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            raw.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            storage.googleapis.com:443
            sum.golang.org:443

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: './go.mod'
          check-latest: true

      - name: golangci-lint
        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          version: v2.11

      - run: |
          make generate
          go mod tidy
          git diff --exit-code