chore(deps): bump test/integration module dependencies (#564) #374
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security and Quality Checks | |
| # Runs on every PR and push to main | |
| # Includes linting (with gosec), build verification, and unit tests | |
| name: "Security & Quality" | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| lint: | |
| name: Lint & Static Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Provision generated client (tmi-clients) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: ericfitz/tmi-clients | |
| path: .tmi-clients | |
| - name: Point go.mod replace at the checked-out client | |
| run: sed -i 's|=> ../tmi-clients/|=> ./.tmi-clients/|' go.mod | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: v2.12.2 | |
| install-mode: goinstall | |
| args: --timeout=5m | |
| - name: Check sensitive fields are not passed to logger calls | |
| # Guardrail for #540: attribute-based log redaction cannot catch a | |
| # secret interpolated into a format string. Stdlib-only script; runs | |
| # with the runner's system python3 (no uv in CI). | |
| run: python3 scripts/check-sensitive-log-args.py | |
| build: | |
| name: Build Verification | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Build server | |
| run: go build -o bin/tmiserver ./cmd/server | |
| test: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Provision generated client (tmi-clients) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: ericfitz/tmi-clients | |
| path: .tmi-clients | |
| - name: Point go.mod replace at the checked-out client | |
| run: sed -i 's|=> ../tmi-clients/|=> ./.tmi-clients/|' go.mod | |
| - name: Run unit tests | |
| run: go test -v -race -short ./... | |
| openapi-validation: | |
| name: OpenAPI Validation | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Install vacuum | |
| # Pin the version: the quobix install_vacuum.sh script auto-detects the | |
| # latest release, and when that detection hiccups it builds a URL with an | |
| # empty version and 404s, flaking this required check. Download a pinned | |
| # release asset directly instead. | |
| env: | |
| VACUUM_VERSION: "0.29.7" | |
| run: | | |
| curl -fsSL "https://github.com/daveshanley/vacuum/releases/download/v${VACUUM_VERSION}/vacuum_${VACUUM_VERSION}_linux_x86_64.tar.gz" -o /tmp/vacuum.tar.gz | |
| tar -xzf /tmp/vacuum.tar.gz -C /tmp vacuum | |
| sudo install -m 0755 /tmp/vacuum /usr/local/bin/vacuum | |
| vacuum version | |
| - name: Validate OpenAPI specification | |
| run: | | |
| # JSON syntax check | |
| jq empty api-schema/tmi-openapi.json | |
| # Vacuum linting with OWASP rules | |
| vacuum lint -r vacuum-ruleset.yaml api-schema/tmi-openapi.json | |
| secrets-scan: | |
| # T6/T11 (#344): scan committed files for secrets and fail the build on | |
| # any positive hit. Targets *.tfvars in particular but checks the whole | |
| # tree because a leaked secret anywhere is the same bug. | |
| name: Secrets Scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| with: | |
| # gitleaks needs full history to walk past commits in PRs. | |
| fetch-depth: 0 | |
| - name: Run gitleaks | |
| uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| # Only run on pull requests | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v5 | |
| with: | |
| fail-on-severity: high | |
| # Deny licenses that are incompatible with the project | |
| deny-licenses: GPL-3.0, AGPL-3.0 | |
| govulncheck: | |
| name: Vulnerability Scan (govulncheck) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Provision generated client (tmi-clients) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: ericfitz/tmi-clients | |
| path: .tmi-clients | |
| - name: Point go.mod replace at the checked-out client | |
| run: sed -i 's|=> ../tmi-clients/|=> ./.tmi-clients/|' go.mod | |
| - name: Install govulncheck | |
| # Pinned per repo convention. Verify this is the current release and | |
| # bump if a newer stable tag exists. | |
| run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 | |
| - name: Run govulncheck | |
| run: govulncheck ./... | |
| gosec: | |
| name: Static Security Scan (gosec, informational) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write # required to upload SARIF to the Security tab | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Setup Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Provision generated client (tmi-clients) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: ericfitz/tmi-clients | |
| path: .tmi-clients | |
| - name: Point go.mod replace at the checked-out client | |
| run: sed -i 's|=> ../tmi-clients/|=> ./.tmi-clients/|' go.mod | |
| - name: Install gosec | |
| # Pinned per repo convention. Verify current release and bump if needed. | |
| run: go install github.com/securego/gosec/v2/cmd/gosec@v2.22.5 | |
| - name: Run gosec (never fails the build) | |
| # -no-fail: exit 0 even on findings (informational job). | |
| # -exclude-generated: skip oapi-codegen's api/api.go and other generated code. | |
| # -exclude-dir: skip the checked-out client shim, plus test-only code that | |
| # never ships in the server binary (test/integration and wstest are separate | |
| # Go modules; excluding them keeps the Security tab scoped to shipped code | |
| # even if a future go.work pulls them into ./...). | |
| run: gosec -no-fail -exclude-generated -exclude-dir=.tmi-clients -exclude-dir=test -exclude-dir=wstest -fmt sarif -out gosec.sarif ./... | |
| - name: Upload SARIF to the Security tab | |
| if: always() | |
| continue-on-error: true # SARIF upload lacks a write-scoped token on dependabot/fork PRs; never block on it | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: gosec.sarif | |
| category: gosec |