Skip to content

Commit 330df02

Browse files
jongioCopilot
jongio
and
Copilot
committed
feat: dispatch-parity quality improvements
- Pin all GitHub Actions to full commit SHAs - Add CODEOWNERS file - Add Dependabot for go modules and github-actions - Add concurrency control to CI/PR workflows - Add CodeQL security scanning workflow - Add govulncheck vulnerability scanning workflow - Standardize golangci-lint config with 30+ linters - Add dispatch-level linters (errname, exhaustive, forcetypeassert, etc.) - Add gofumpt strict formatting checks - Add deadcode detection - Add cosign code signing to release workflow - Add SBOM generation (SPDX + CycloneDX) to release workflow - Add comprehensive README badges (CI, CodeQL, Go Report Card, etc.) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 78697d8 commit 330df02

17 files changed

Lines changed: 399 additions & 69 deletions

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Default code owners for all files
2+
* @jongio

‎.github/dependabot.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "gomod"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
commit-message:
8+
prefix: "deps"
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
commit-message:
14+
prefix: "ci"

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ on:
1010
workflow_dispatch:
1111

1212
concurrency:
13-
group: ci-${{ github.ref }}
13+
group: ${{ github.workflow }}-${{ github.ref }}
1414
cancel-in-progress: true
1515

1616
defaults:
@@ -28,17 +28,17 @@ jobs:
2828

2929
steps:
3030
- name: Checkout code
31-
uses: actions/checkout@v4
31+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3232

3333
- name: Set up Go
34-
uses: actions/setup-go@v5
34+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
3535
with:
3636
go-version: '${{ env.GO_VERSION }}'
3737
cache: true
3838
cache-dependency-path: cli/go.sum
3939

4040
- name: Cache Go tools
41-
uses: actions/cache@v4
41+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
4242
with:
4343
path: ~/go/bin
4444
key: go-tools-${{ runner.os }}-${{ hashFiles('cli/go.sum') }}
@@ -53,7 +53,7 @@ jobs:
5353
run: go install golang.org/x/vuln/cmd/govulncheck@latest
5454

5555
- name: Set up Node.js
56-
uses: actions/setup-node@v4
56+
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
5757
with:
5858
node-version: '20'
5959

@@ -91,10 +91,10 @@ jobs:
9191

9292
steps:
9393
- name: Checkout code
94-
uses: actions/checkout@v4
94+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
9595

9696
- name: Set up Go
97-
uses: actions/setup-go@v5
97+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
9898
with:
9999
go-version: '${{ env.GO_VERSION }}'
100100
cache: true
@@ -112,7 +112,7 @@ jobs:
112112
113113
- name: Upload coverage to Codecov
114114
if: github.repository == 'jongio/azd-rest'
115-
uses: codecov/codecov-action@v4
115+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
116116
with:
117117
file: coverage/coverage.out
118118
flags: unittests
@@ -140,10 +140,10 @@ jobs:
140140

141141
steps:
142142
- name: Checkout code
143-
uses: actions/checkout@v4
143+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
144144

145145
- name: Set up Go
146-
uses: actions/setup-go@v5
146+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
147147
with:
148148
go-version: '${{ env.GO_VERSION }}'
149149
cache: true
@@ -158,7 +158,7 @@ jobs:
158158
GOOS=darwin GOARCH=arm64 go build -o bin/darwin-arm64/rest ./src/cmd/rest
159159
160160
- name: Upload artifacts
161-
uses: actions/upload-artifact@v4
161+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
162162
with:
163163
name: binaries
164164
path: cli/bin/

‎.github/workflows/codeql.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 0 * * 0' # Weekly on Sundays at midnight UTC
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions:
16+
contents: read
17+
security-events: write
18+
actions: read
19+
20+
jobs:
21+
analyze:
22+
name: Analyze
23+
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
security-events: write
27+
actions: read
28+
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
32+
33+
- name: Set up Go
34+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
35+
with:
36+
go-version: '1.26.0'
37+
cache: true
38+
39+
- name: Initialize CodeQL
40+
uses: github/codeql-action/init@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
41+
with:
42+
languages: go
43+
44+
- name: Autobuild
45+
uses: github/codeql-action/autobuild@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
46+
47+
- name: Perform CodeQL Analysis
48+
uses: github/codeql-action/analyze@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
49+
continue-on-error: true
50+
with:
51+
upload: false
52+
53+
- name: Upload SARIF (if Code Scanning enabled)
54+
uses: github/codeql-action/upload-sarif@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
55+
continue-on-error: true
56+
with:
57+
sarif_file: ../results

‎.github/workflows/govulncheck.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Go Vulnerability Check
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 0 * * 0' # Weekly on Sundays at midnight UTC
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
govulncheck:
20+
name: Run govulncheck
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: Checkout code
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
26+
27+
- name: Set up Go
28+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
29+
with:
30+
go-version: '1.26.0'
31+
cache: true
32+
33+
- name: Install govulncheck
34+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
35+
36+
- name: Run govulncheck
37+
run: govulncheck ./...

‎.github/workflows/pr-build.yml‎

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ on:
1717
required: false
1818
type: number
1919

20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.ref }}
22+
cancel-in-progress: true
23+
2024
env:
2125
GO_VERSION: '1.26.1'
2226

@@ -44,7 +48,7 @@ jobs:
4448
steps:
4549
- name: Check if build is allowed
4650
id: check
47-
uses: actions/github-script@v7
51+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
4852
with:
4953
script: |
5054
let allowed = false;
@@ -149,7 +153,7 @@ jobs:
149153
steps:
150154
- name: Get PR details
151155
id: pr
152-
uses: actions/github-script@v7
156+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
153157
with:
154158
script: |
155159
let prNumber = '${{ needs.check-permission.outputs.pr_number }}';
@@ -183,12 +187,12 @@ jobs:
183187
core.setOutput('title', pr.data.title);
184188
185189
- name: Checkout code
186-
uses: actions/checkout@v4
190+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
187191
with:
188192
ref: ${{ steps.pr.outputs.sha }}
189193

190194
- name: Set up Go
191-
uses: actions/setup-go@v5
195+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
192196
with:
193197
go-version: '${{ env.GO_VERSION }}'
194198
cache: true
@@ -309,7 +313,7 @@ jobs:
309313
EOF
310314
311315
- name: Comment on PR
312-
uses: actions/github-script@v7
316+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
313317
with:
314318
script: |
315319
const fs = require('fs');

‎.github/workflows/release.yml‎

Lines changed: 59 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -30,17 +30,17 @@ jobs:
3030

3131
steps:
3232
- name: Checkout code
33-
uses: actions/checkout@v4
33+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3434

3535
- name: Set up Go
36-
uses: actions/setup-go@v5
36+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
3737
with:
3838
go-version: '${{ env.GO_VERSION }}'
3939
cache: true
4040
cache-dependency-path: cli/go.sum
4141

4242
- name: Cache Go tools
43-
uses: actions/cache@v4
43+
uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
4444
with:
4545
path: ~/go/bin
4646
key: go-tools-${{ runner.os }}-${{ hashFiles('cli/go.sum') }}
@@ -95,10 +95,10 @@ jobs:
9595

9696
steps:
9797
- name: Checkout code
98-
uses: actions/checkout@v4
98+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
9999

100100
- name: Set up Go
101-
uses: actions/setup-go@v5
101+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
102102
with:
103103
go-version: '${{ env.GO_VERSION }}'
104104
cache: true
@@ -116,7 +116,7 @@ jobs:
116116
117117
- name: Upload coverage to Codecov
118118
if: github.repository == 'jongio/azd-rest'
119-
uses: codecov/codecov-action@v4
119+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
120120
with:
121121
file: coverage/coverage.out
122122
flags: unittests
@@ -125,21 +125,8 @@ jobs:
125125
fail_ci_if_error: false
126126
verbose: true
127127

128-
build:
129-
name: Build
130-
runs-on: ubuntu-latest
131-
needs: [preflight, test]
132-
timeout-minutes: 30
133-
defaults:
134-
run:
135-
working-directory: cli
136-
137-
steps:
138-
- name: Checkout code
139-
uses: actions/checkout@v4
140-
141128
- name: Set up Go
142-
uses: actions/setup-go@v5
129+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
143130
with:
144131
go-version: '${{ env.GO_VERSION }}'
145132
cache: true
@@ -154,7 +141,7 @@ jobs:
154141
GOOS=darwin GOARCH=arm64 go build -o bin/darwin-arm64/rest ./src/cmd/rest
155142
156143
- name: Upload artifacts
157-
uses: actions/upload-artifact@v4
144+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
158145
with:
159146
name: binaries
160147
path: cli/bin/
@@ -167,15 +154,16 @@ jobs:
167154
permissions:
168155
contents: write
169156
pull-requests: write
157+
id-token: write # Required for cosign OIDC signing
170158

171159
steps:
172160
- name: Checkout
173-
uses: actions/checkout@v4
161+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
174162
with:
175163
fetch-depth: 0
176164

177165
- name: Set up Go
178-
uses: actions/setup-go@v5
166+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
179167
with:
180168
go-version: '${{ env.GO_VERSION }}'
181169
cache: true
@@ -401,6 +389,54 @@ jobs:
401389
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
402390
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
403391

392+
- name: Install cosign
393+
uses: sigstore/cosign-installer@3454372be43e8ddeec39df0f73bb47954da3a1f1 # v3
394+
395+
- name: Install syft
396+
uses: anchore/sbom-action/download-syft@e11c554f704a0b820cbf8c51673f6945e0731532 # v0
397+
398+
- name: Sign release artifacts with cosign
399+
working-directory: cli
400+
run: |
401+
VERSION="${{ steps.version.outputs.next }}"
402+
TAG_NAME="azd-ext-jongio-azd-rest_${VERSION}"
403+
echo "Signing release artifacts for ${TAG_NAME}..."
404+
405+
# Download release assets
406+
gh release download "${TAG_NAME}" --dir /tmp/release-assets --repo "${{ github.repository }}" || true
407+
408+
# Sign each artifact
409+
if [ -d /tmp/release-assets ]; then
410+
for file in /tmp/release-assets/*; do
411+
if [ -f "$file" ]; then
412+
echo "Signing $(basename $file)..."
413+
cosign sign-blob --yes "$file" --output-signature "${file}.sig" --output-certificate "${file}.pem"
414+
fi
415+
done
416+
417+
# Upload signatures and certificates to the release
418+
gh release upload "${TAG_NAME}" /tmp/release-assets/*.sig /tmp/release-assets/*.pem --repo "${{ github.repository }}" || true
419+
echo "✅ All artifacts signed with cosign (keyless/OIDC)"
420+
fi
421+
env:
422+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
423+
424+
- name: Generate SBOM
425+
working-directory: cli
426+
run: |
427+
VERSION="${{ steps.version.outputs.next }}"
428+
TAG_NAME="azd-ext-jongio-azd-rest_${VERSION}"
429+
echo "Generating SBOM for ${TAG_NAME}..."
430+
431+
# Generate SBOM for the Go module
432+
syft . -o spdx-json=/tmp/sbom-spdx.json -o cyclonedx-json=/tmp/sbom-cyclonedx.json
433+
434+
# Upload SBOM to the release
435+
gh release upload "${TAG_NAME}" /tmp/sbom-spdx.json /tmp/sbom-cyclonedx.json --repo "${{ github.repository }}" || true
436+
echo "✅ SBOM generated and uploaded (SPDX + CycloneDX)"
437+
env:
438+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
439+
404440
- name: Update registry
405441
working-directory: cli
406442
run: |

0 commit comments

Comments
 (0)