Skip to content

Commit 178e476

Browse files
jongioCopilot
jongio
and
Copilot
committed
feat: dispatch-parity quality improvements
- Pin all GitHub Actions to full commit SHAs - Add CODEOWNERS file - Add Dependabot for go modules and github-actions - Add concurrency control to CI/PR workflows - Add CodeQL security scanning workflow - Add govulncheck vulnerability scanning workflow - Standardize golangci-lint config with 30+ linters - Add dispatch-level linters (errname, exhaustive, forcetypeassert, etc.) - Add gofumpt strict formatting checks - Add deadcode detection - Add cosign code signing to release workflow - Add SBOM generation (SPDX + CycloneDX) to release workflow - Add comprehensive README badges (CI, CodeQL, Go Report Card, etc.) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent 3a48a51 commit 178e476

29 files changed

Lines changed: 452 additions & 84 deletions

‎.github/CODEOWNERS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# Default code owners for all files
2+
* @jongio

‎.github/dependabot.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "gomod"
4+
directory: "/"
5+
schedule:
6+
interval: "weekly"
7+
commit-message:
8+
prefix: "deps"
9+
- package-ecosystem: "github-actions"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
commit-message:
14+
prefix: "ci"

‎.github/workflows/ci.yml‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ on:
55
branches: [ main ]
66
workflow_dispatch:
77

8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
812
defaults:
913
run:
1014
working-directory: cli
@@ -19,10 +23,10 @@ jobs:
1923

2024
steps:
2125
- name: Checkout code
22-
uses: actions/checkout@v4
26+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2327

2428
- name: Set up Go (bootstrap)
25-
uses: actions/setup-go@v5
29+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
2630
with:
2731
go-version: 'stable'
2832
cache: false
@@ -77,10 +81,10 @@ jobs:
7781

7882
steps:
7983
- name: Checkout code
80-
uses: actions/checkout@v4
84+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
8185

8286
- name: Set up Go (bootstrap)
83-
uses: actions/setup-go@v5
87+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
8488
with:
8589
go-version: 'stable'
8690
cache: false
@@ -121,7 +125,7 @@ jobs:
121125
122126
- name: Upload coverage to Codecov
123127
if: github.repository == 'jongio/azd-copilot'
124-
uses: codecov/codecov-action@v4
128+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
125129
with:
126130
file: coverage/coverage.out
127131
flags: unittests
@@ -147,10 +151,10 @@ jobs:
147151

148152
steps:
149153
- name: Checkout code
150-
uses: actions/checkout@v4
154+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
151155

152156
- name: Set up Go (bootstrap)
153-
uses: actions/setup-go@v5
157+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
154158
with:
155159
go-version: 'stable'
156160
cache: false
@@ -178,10 +182,10 @@ jobs:
178182

179183
steps:
180184
- name: Checkout code
181-
uses: actions/checkout@v4
185+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
182186

183187
- name: Set up Go (bootstrap)
184-
uses: actions/setup-go@v5
188+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
185189
with:
186190
go-version: 'stable'
187191
cache: false
@@ -204,7 +208,7 @@ jobs:
204208
GOOS=darwin GOARCH=arm64 go build -o bin/darwin-arm64/copilot ./src/cmd/copilot
205209
206210
- name: Upload artifacts
207-
uses: actions/upload-artifact@v4
211+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
208212
with:
209213
name: binaries
210214
path: cli/bin/

‎.github/workflows/codeql.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 0 * * 0' # Weekly on Sundays at midnight UTC
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions:
16+
contents: read
17+
security-events: write
18+
actions: read
19+
20+
jobs:
21+
analyze:
22+
name: Analyze
23+
runs-on: ubuntu-latest
24+
permissions:
25+
contents: read
26+
security-events: write
27+
actions: read
28+
29+
steps:
30+
- name: Checkout code
31+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
32+
33+
- name: Set up Go
34+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
35+
with:
36+
go-version: '1.26.0'
37+
cache: true
38+
39+
- name: Initialize CodeQL
40+
uses: github/codeql-action/init@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
41+
with:
42+
languages: go
43+
44+
- name: Autobuild
45+
uses: github/codeql-action/autobuild@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
46+
47+
- name: Perform CodeQL Analysis
48+
uses: github/codeql-action/analyze@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
49+
continue-on-error: true
50+
with:
51+
upload: false
52+
53+
- name: Upload SARIF (if Code Scanning enabled)
54+
uses: github/codeql-action/upload-sarif@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
55+
continue-on-error: true
56+
with:
57+
sarif_file: ../results

‎.github/workflows/govulncheck.yml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Go Vulnerability Check
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 0 * * 0' # Weekly on Sundays at midnight UTC
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
govulncheck:
20+
name: Run govulncheck
21+
runs-on: ubuntu-latest
22+
23+
steps:
24+
- name: Checkout code
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
26+
27+
- name: Set up Go
28+
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
29+
with:
30+
go-version: '1.26.0'
31+
cache: true
32+
33+
- name: Install govulncheck
34+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
35+
36+
- name: Run govulncheck
37+
run: govulncheck ./...

‎.github/workflows/pr-build.yml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,10 @@ on:
1717
required: false
1818
type: number
1919

20+
concurrency:
21+
group: ${{ github.workflow }}-${{ github.ref }}
22+
cancel-in-progress: true
23+
2024
defaults:
2125
run:
2226
working-directory: cli
@@ -41,7 +45,7 @@ jobs:
4145
steps:
4246
- name: Check if build is allowed
4347
id: check
44-
uses: actions/github-script@v7
48+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
4549
with:
4650
script: |
4751
let allowed = false;
@@ -142,7 +146,7 @@ jobs:
142146
steps:
143147
- name: Get PR details
144148
id: pr
145-
uses: actions/github-script@v7
149+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
146150
with:
147151
script: |
148152
let prNumber = '${{ needs.check-permission.outputs.pr_number }}';
@@ -176,12 +180,12 @@ jobs:
176180
core.setOutput('title', pr.data.title);
177181
178182
- name: Checkout code
179-
uses: actions/checkout@v4
183+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
180184
with:
181185
ref: ${{ steps.pr.outputs.sha }}
182186

183187
- name: Set up Go (bootstrap)
184-
uses: actions/setup-go@v5
188+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
185189
with:
186190
go-version: 'stable'
187191
cache: false
@@ -315,11 +319,11 @@ jobs:
315319
EOF
316320
317321
- name: Comment on PR
318-
uses: actions/github-script@v7
322+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
319323
with:
320324
script: |
321325
const fs = require('fs');
322-
const instructions = fs.readFileSync('cli/instructions.md', 'utf8');
326+
const instructions = fs.readFileSync('instructions.md', 'utf8');
323327
const prNumber = '${{ steps.pr.outputs.number }}';
324328
325329
const comments = await github.rest.issues.listComments({

‎.github/workflows/release-only.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ jobs:
2020

2121
steps:
2222
- name: Checkout
23-
uses: actions/checkout@v4
23+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2424
with:
2525
fetch-depth: 0
2626

2727
- name: Set up Go (bootstrap)
28-
uses: actions/setup-go@v5
28+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
2929
with:
3030
go-version: 'stable'
3131
cache: false

0 commit comments

Comments
 (0)