Skip to content

Bump golang.org/x/crypto from 0.30.0 to 0.31.0 #4213

Bump golang.org/x/crypto from 0.30.0 to 0.31.0

Bump golang.org/x/crypto from 0.30.0 to 0.31.0 #4213

Workflow file for this run

name: "Security"
on:
workflow_dispatch:
push:
branches: [ master ]
pull_request:
branches: [ master ]
schedule:
- cron: '30 12 * * 3'
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.event_name != 'workflow_dispatch' }}
jobs:
gosec:
name: gosec check
runs-on: ubuntu-latest
# Skip any created PR or push by dependabot to avoid permission issues
if: github.actor != 'dependabot[bot]'
env:
GO111MODULE: on
steps:
- name: Checkout Source
uses: actions/checkout@v4
- name: Run gosec security scanner
uses: securego/[email protected]
with:
# with '-no-fail' we let the report trigger content trigger a failure using the GitHub Security features.
args: "-no-fail -fmt sarif -out gosec.sarif ./..."
- name: Upload SARIF file for GitHub Advanced Security Dashboard
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: gosec.sarif
semgrep:
name: semgrep scan
runs-on: ubuntu-latest
# Skip any created PR or push by dependabot to avoid permission issues and skip this check for PRs from forks
if: github.actor != 'dependabot[bot]' && (github.event_name == 'push' || github.event.pull_request.head.repo.full_name == 'wavesplatform/gowaves')
container:
image: returntocorp/semgrep:latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
# we let the report trigger content trigger a failure using the GitHub Security features.
# see https://semgrep.dev/docs/cli-usage/#exit-codes for more details.
- name: Run semgrep security scanner
run: |
cat << 'EOF' | bash
semgrep ci --config=auto --sarif --output=semgrep.sarif --max-target-bytes=2MB
EXIT_CODE=$?
if [ "$EXIT_CODE" = "0" ] || [ "$EXIT_CODE" = "1" ]
then
exit 0
else
exit $EXIT_CODE
fi
EOF
- name: Upload SARIF file for GitHub Advanced Security Dashboard
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: semgrep.sarif
vuln-scan:
name: Vulnerability scanner
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Go
uses: actions/[email protected]
with:
go-version: 1.22.x
check-latest: true
cache: true
- name: Run go list
run: go list -json -deps ./... > go.list
- name: Nancy
uses: sonatype-nexus-community/[email protected]
- name: govulncheck
run: go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...