From acd4ee2eb2a0290cfb5a5a6690467394d720612c Mon Sep 17 00:00:00 2001 From: Hayden Blauzvern Date: Fri, 29 Sep 2023 14:38:29 +0000 Subject: [PATCH 1/4] Add codeql, scorecard, and verifying license Signed-off-by: Hayden Blauzvern --- .github/workflows/build.yml | 7 ++-- .github/workflows/codeql.yml | 53 ++++++++++++++++++++++++++++ .github/workflows/conformance.yml | 5 ++- .github/workflows/golangci-lint.yml | 13 ++++--- .github/workflows/scorecard.yml | 46 ++++++++++++++++++++++++ .github/workflows/verify_license.yml | 37 +++++++++++++++++++ .golangci.yaml | 2 +- 7 files changed, 152 insertions(+), 11 deletions(-) create mode 100644 .github/workflows/codeql.yml create mode 100644 .github/workflows/scorecard.yml create mode 100644 .github/workflows/verify_license.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 48c29523..14529ed7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,14 +19,17 @@ on: branches: [main] pull_request: {} +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest steps: - name: Checkout repository - uses: actions/checkout@v3 + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Install Go - uses: actions/setup-go@v4 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.2.0 with: go-version-file: go.mod - name: Run tests diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 00000000..10f63386 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,53 @@ +# Copyright 2023 The Sigstore Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#changing-the-languages-that-are-analyzed +name: CodeQL +on: + push: + branches: [ main ] + pull_request: + # The branches below must be a subset of the branches above + branches: [ main ] + schedule: + - cron: '45 10 * * 1' + +permissions: + contents: read + security-events: write + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + language: [ 'go' ] + steps: + - name: Checkout repository + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.1.26 + with: + languages: ${{ matrix.language }} + + - name: Autobuild + uses: github/codeql-action/autobuild@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.1.26 + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.1.26 diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml index c22b69df..8e712678 100644 --- a/.github/workflows/conformance.yml +++ b/.github/workflows/conformance.yml @@ -30,9 +30,8 @@ jobs: conformance: runs-on: ubuntu-latest steps: - - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 - - - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1 + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version-file: go.mod diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index ba0071b6..aff2eec9 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -29,14 +29,17 @@ jobs: name: lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v4 + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: - go-version-file: go.mod + go-version-file: './go.mod' + check-latest: true + - name: golangci-lint - uses: golangci/golangci-lint-action@v3 + uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0 with: - args: --timeout 3m --verbose + version: v1.54 + args: --timeout=5m --verbose # sometimes the pkg cache gets corrupted, skipping cache avoids this # https://github.com/golangci/golangci-lint-action/issues/23 skip-pkg-cache: true diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 00000000..8985b2af --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,46 @@ +# Copyright 2023 The Sigstore Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: Scorecards supply-chain security +on: + # (Optional) For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + # branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + # Weekly on Saturdays. + - cron: '30 1 * * 6' + push: + branches: [ main ] + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecards analysis + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + uses: sigstore/community/.github/workflows/reusable-scorecard.yml@d0c95c8803672313d0bf72e1a44021be5b583c24 # main + # (Optional) Disable publish results: + # with: + # publish_results: false + + # (Optional) Enable Branch-Protection check: + # secrets: + # scorecard_token: ${{ secrets.SCORECARD_TOKEN }} diff --git a/.github/workflows/verify_license.yml b/.github/workflows/verify_license.yml new file mode 100644 index 00000000..b33ef122 --- /dev/null +++ b/.github/workflows/verify_license.yml @@ -0,0 +1,37 @@ +# Copyright 2023 The Sigstore Authors. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: Verify + +on: [push, pull_request] + +permissions: + contents: read + +jobs: + license-check: + name: license boilerplate check + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 + - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 + with: + go-version-file: './go.mod' + check-latest: true + - name: Install addlicense + run: go install github.com/google/addlicense@v1.0.0 + - name: Check license headers + run: | + set -e + addlicense -check -l apache -c 'The Sigstore Authors' -ignore "third_party/**" -v * \ No newline at end of file diff --git a/.golangci.yaml b/.golangci.yaml index b82400d2..763df6af 100644 --- a/.golangci.yaml +++ b/.golangci.yaml @@ -14,7 +14,7 @@ run: timeout: 10m - go: '1.20' + go: '1.21' linters: enable: - revive From 8ebfec10a193185b3acbdb23a86e7a6da7aa126f Mon Sep 17 00:00:00 2001 From: Hayden B Date: Fri, 29 Sep 2023 07:39:26 -0700 Subject: [PATCH 2/4] Update build.yml Signed-off-by: Hayden B --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 14529ed7..cf35f89a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -29,7 +29,7 @@ jobs: - name: Checkout repository uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 - name: Install Go - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v2.2.0 + uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 with: go-version-file: go.mod - name: Run tests From 6d1c8d70a6560456f62e54db22c97548212165aa Mon Sep 17 00:00:00 2001 From: Hayden B Date: Fri, 29 Sep 2023 07:53:39 -0700 Subject: [PATCH 3/4] Update scorecard.yml Signed-off-by: Hayden B --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 8985b2af..0fa655ce 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -36,7 +36,7 @@ jobs: security-events: write # Needed to publish results and get a badge (see publish_results below). id-token: write - uses: sigstore/community/.github/workflows/reusable-scorecard.yml@d0c95c8803672313d0bf72e1a44021be5b583c24 # main + uses: sigstore/community/.github/workflows/reusable-scorecard.yml@main # (Optional) Disable publish results: # with: # publish_results: false From 8f0e8414292db98a9e62a9a27d2aa5172ce747b9 Mon Sep 17 00:00:00 2001 From: Hayden B Date: Fri, 29 Sep 2023 11:02:39 -0700 Subject: [PATCH 4/4] Remove path from linter Signed-off-by: Hayden B --- .github/workflows/golangci-lint.yml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml index aff2eec9..19442473 100644 --- a/.github/workflows/golangci-lint.yml +++ b/.github/workflows/golangci-lint.yml @@ -18,10 +18,6 @@ on: branches: - main pull_request: - paths: - - '**.go' - - 'go.mod' - - 'go.sum' permissions: contents: read jobs: