mirror of
https://github.com/hanzokv/go.git
synced 2026-10-30 14:45:54 +00:00
zeekayandHanzo Dev
096f96835b
The purpose-prefixed labels (hanzo-build-*, hanzo-deploy-*, hanzo-docs-build-*) are retired in favour of the bare <os>-<arch> every runner already advertises. They were not a capability, only a habit, and the habit cost builds: papers asked for hanzo-build-linux-amd64, no online runner offered it, and two idle linux-amd64 runners sat beside the queue while the build simply never ran. The lux tree lost three days to lux-linux-amd64 the same way. What a job is FOR is the workflow's name. runs-on is the machine it needs. Co-authored-by: Hanzo Dev <[email protected]>
68 lines
1.4 KiB
YAML
68 lines
1.4 KiB
YAML
name: govulncheck
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [master, v9, v9.7, v9.8, "ndyakov/**", "ofekshenawa/**", "ce/**"]
|
|
push:
|
|
branches: [master, v9, "v9.*"]
|
|
schedule:
|
|
- cron: "0 6 * * 1"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: govulncheck-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
govulncheck:
|
|
name: govulncheck
|
|
runs-on: linux-amd64
|
|
timeout-minutes: 15
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v6
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@v6
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Install govulncheck
|
|
run: go install golang.org/x/vuln/cmd/[email protected]
|
|
|
|
- name: Run govulncheck (all modules)
|
|
shell: bash
|
|
run: |
|
|
set -u -o pipefail
|
|
|
|
status=0
|
|
found=0
|
|
|
|
while IFS= read -r gomod; do
|
|
found=1
|
|
mod=$(dirname "$gomod")
|
|
echo "Scanning module: $mod"
|
|
|
|
if ! (
|
|
cd "$mod" && govulncheck ./...
|
|
); then
|
|
status=1
|
|
fi
|
|
done < <(
|
|
find . \
|
|
-type f -name go.mod \
|
|
-not -path '*/vendor/*' \
|
|
-not -path '*/.git/*' \
|
|
| sort -u
|
|
)
|
|
|
|
if [ "$found" -eq 0 ]; then
|
|
echo "No Go modules found to scan."
|
|
exit 1
|
|
fi
|
|
|
|
exit "$status" |