Skip to content

ci: harden workflows, upgrade actions, fix caching#39

Merged
umputun merged 1 commit into
umputun:masterfrom
paskal:ci/workflow-hardening
Mar 20, 2026
Merged

ci: harden workflows, upgrade actions, fix caching#39
umputun merged 1 commit into
umputun:masterfrom
paskal:ci/workflow-hardening

Conversation

@paskal
Copy link
Copy Markdown
Contributor

@paskal paskal commented Mar 7, 2026

Changes

  • Reorder checkout before setup-go for proper dependency caching
  • Move permissions from job-level to top-level for least-privilege security
  • Add persist-credentials: false to all checkout steps
  • Upgrade GitHub Actions: setup-qemu v4, setup-buildx v4, goreleaser v7
  • Suppress new golangci-lint rules (gosec G118/G120/G705, prealloc, staticcheck QF1012) that flag pre-existing code

@paskal paskal force-pushed the ci/workflow-hardening branch from e57602a to 777f030 Compare March 20, 2026 01:32
@umputun umputun merged commit 35fcc39 into umputun:master Mar 20, 2026
1 of 2 checks passed
@paskal paskal deleted the ci/workflow-hardening branch March 20, 2026 09:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants