Skip to content

Commit 46f2961

Browse files
ldezldez
authored
chore: improve GHA workflows (#6500)
1 parent b525820 commit 46f2961

8 files changed

Lines changed: 53 additions & 28 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@ jobs:
3636
steps:
3737
- name: Checkout repository
3838
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
39+
with:
40+
persist-credentials: false
3941

4042
# Initializes the CodeQL tools for scanning.
4143
- name: Initialize CodeQL

‎.github/workflows/deploy-documentation.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ jobs:
1010
doc:
1111
name: Build and deploy documentation
1212
runs-on: ubuntu-latest
13+
permissions:
14+
contents: write
1315
env:
1416
# https://github.com/actions/setup-go#supported-version-syntax
1517
# ex:
@@ -20,6 +22,8 @@ jobs:
2022
CGO_ENABLED: 0
2123
steps:
2224
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25+
with:
26+
persist-credentials: false
2327
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2428
with:
2529
go-version: ${{ env.GO_VERSION }}
@@ -39,4 +43,4 @@ jobs:
3943
with:
4044
publish_dir: docs/public
4145
force_orphan: true
42-
github_token: ${{ secrets.GOLANGCI_LINT_TOKEN }}
46+
github_token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/new-linter-checklist.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
runs-on: ubuntu-latest
1717
steps:
1818
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
19+
with:
20+
persist-credentials: false
1921
- name: Add checklist
2022
run: |
2123
# Avoid adding multiple comments for the same PR.

‎.github/workflows/post-release.yml‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,17 @@ env:
1111
# - 1.18rc1 -> 1.18.0-rc.1
1212
GO_VERSION: '1.26'
1313

14+
permissions:
15+
contents: read
16+
1417
jobs:
1518
update-gha-assets:
1619
name: "Update GitHub Action assets"
1720
runs-on: ubuntu-latest
18-
env:
19-
GITHUB_TOKEN: ${{ secrets.GOLANGCI_LINT_TOKEN }}
2021
steps:
2122
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
2225
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2326
with:
2427
go-version: ${{ env.GO_VERSION }}
@@ -30,18 +33,20 @@ jobs:
3033
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
3134
with:
3235
base: main
33-
token: ${{ secrets.GOLANGCI_LINT_TOKEN }}
36+
token: ${{ secrets.RELEASER_TOKEN }}
37+
push-to-fork: golangci-releaser/golangci-lint
38+
author: GolangCI-Lint Releaser <65486276+golangci-releaser@users.noreply.github.com>
3439
branch-suffix: timestamp
3540
title: "docs: update GitHub Action assets"
3641
delete-branch: true
3742

3843
update-assets:
3944
name: "Update documentation assets"
4045
runs-on: ubuntu-latest
41-
env:
42-
GITHUB_TOKEN: ${{ secrets.GOLANGCI_LINT_TOKEN }}
4346
steps:
4447
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
48+
with:
49+
persist-credentials: false
4550
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
4651
with:
4752
go-version: ${{ env.GO_VERSION }}
@@ -59,7 +64,9 @@ jobs:
5964
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
6065
with:
6166
base: main
62-
token: ${{ secrets.GOLANGCI_LINT_TOKEN }}
67+
token: ${{ secrets.RELEASER_TOKEN }}
68+
push-to-fork: golangci-releaser/golangci-lint
69+
author: GolangCI-Lint Releaser <65486276+golangci-releaser@users.noreply.github.com>
6370
branch-suffix: timestamp
6471
title: "docs: update documentation assets"
6572
delete-branch: true

‎.github/workflows/pr-checks.yml‎

Lines changed: 8 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
- main
66
pull_request:
77

8+
permissions: {}
9+
810
env:
911
# https://github.com/actions/setup-go#supported-version-syntax
1012
# ex:
@@ -18,6 +20,8 @@ jobs:
1820
runs-on: ubuntu-latest
1921
steps:
2022
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
2125
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2226
with:
2327
go-version: ${{ env.GO_VERSION }}
@@ -27,23 +31,6 @@ jobs:
2731
git diff --exit-code go.mod
2832
git diff --exit-code go.sum
2933
30-
# This check is disabled because of GitHub API instability: 504 Gateway Timeout.
31-
# Checks: GitHub action assets
32-
# check-generated:
33-
# runs-on: ubuntu-latest
34-
# steps:
35-
# - uses: actions/checkout@v6
36-
# with:
37-
# fetch-depth: 0
38-
# - uses: actions/setup-go@v6
39-
# with:
40-
# go-version: ${{ env.GO_VERSION }}
41-
# - name: Check generated files are up-to-date
42-
# run: make fast_check_generated
43-
# env:
44-
# # needed for github-action-config.json generation
45-
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
46-
4734
check-local-install-script:
4835
name: Installation script (local)
4936
strategy:
@@ -52,6 +39,8 @@ jobs:
5239
runs-on: ${{ matrix.os }}
5340
steps:
5441
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
42+
with:
43+
persist-credentials: false
5544
- name: Check installation script
5645
run: cat ./install.sh | sh -s -- -d -b "./install-golangci-lint"
5746

@@ -60,6 +49,8 @@ jobs:
6049
runs-on: ubuntu-latest
6150
steps:
6251
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
52+
with:
53+
persist-credentials: false
6354
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
6455
with:
6556
go-version: ${{ env.GO_VERSION }}

‎.github/workflows/pr-documentation.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ name: Check Documentation
33
on:
44
pull_request:
55

6+
permissions: {}
7+
68
jobs:
79

810
doc:
@@ -19,6 +21,8 @@ jobs:
1921

2022
steps:
2123
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
24+
with:
25+
persist-credentials: false
2226
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2327
with:
2428
go-version: ${{ env.GO_VERSION }}

‎.github/workflows/pr-tests.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
- main
66
pull_request:
77

8+
permissions: {}
9+
810
env:
911
# https://github.com/actions/setup-go#supported-version-syntax
1012
# ex:
@@ -18,6 +20,8 @@ jobs:
1820
runs-on: ubuntu-latest
1921
steps:
2022
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23+
with:
24+
persist-credentials: false
2125
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2226
with:
2327
go-version: ${{ env.GO_VERSION }}
@@ -33,6 +37,8 @@ jobs:
3337
runs-on: ubuntu-latest
3438
steps:
3539
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
40+
with:
41+
persist-credentials: false
3642
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3743
with:
3844
# https://github.com/actions/setup-go#supported-version-syntax
@@ -52,6 +58,8 @@ jobs:
5258
runs-on: windows-latest
5359
steps:
5460
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
61+
with:
62+
persist-credentials: false
5563
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
5664
with:
5765
go-version: ${{ env.GO_VERSION }} # test only the latest go version to speed up CI
@@ -63,6 +71,8 @@ jobs:
6371
runs-on: macos-latest
6472
steps:
6573
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
74+
with:
75+
persist-credentials: false
6676
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
6777
with:
6878
go-version: ${{ env.GO_VERSION }} # test only the latest go version to speed up CI
@@ -82,6 +92,8 @@ jobs:
8292
runs-on: ${{ matrix.os }}
8393
steps:
8494
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
95+
with:
96+
persist-credentials: false
8597
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
8698
with:
8799
go-version: ${{ matrix.golang }}

‎.github/workflows/release.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ on:
55
- v*
66

77
permissions:
8+
contents: write
89
# Allow the workflow to write attestations.
910
id-token: write
1011
attestations: write
@@ -29,7 +30,7 @@ jobs:
2930
3031
# https://github.com/marketplace/actions/free-disk-space-ubuntu
3132
- name: Free Disk Space
32-
uses: jlumbroso/free-disk-space@main
33+
uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # main
3334
with:
3435
# this might remove tools that are actually needed
3536
tool-cache: false
@@ -45,9 +46,11 @@ jobs:
4546
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4647
with:
4748
fetch-depth: 0
49+
persist-credentials: false
4850
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
4951
with:
5052
go-version: ${{ env.GO_VERSION }}
53+
cache: false
5154

5255
# - name: Install chocolatey
5356
# run: |
@@ -81,13 +84,13 @@ jobs:
8184
AUR_KEY: ${{ secrets.AUR_KEY }}
8285
CHOCOLATEY_API_KEY: ${{ secrets.CHOCOLATEY_API_KEY }}
8386
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
84-
GITHUB_TOKEN: ${{ secrets.GOLANGCI_LINT_TOKEN }}
87+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8588

8689
- uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
8790
with:
8891
subject-checksums: ./dist/golangci-lint-${{ fromJSON(steps.goreleaser.outputs.metadata).version }}-checksums.txt
89-
github-token: ${{ secrets.GOLANGCI_LINT_TOKEN }}
92+
github-token: ${{ secrets.GITHUB_TOKEN }}
9093
- uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
9194
with:
9295
subject-checksums: ./dist/digests.txt
93-
github-token: ${{ secrets.GOLANGCI_LINT_TOKEN }}
96+
github-token: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)