dependabot[bot] and Tobias Gesellchen
cee11b4799
ci(deps): bump github/codeql-action from 4.35.4 to 4.35.5
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.4 to 4.35.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/68bde559dea0fdcac2102bfdf6230c5f70eb485e...9e0d7b8d25671d64c341c19c0152d693099fb5ba )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-18 22:40:36 +02:00
Tobias Gesellchen and Claude Opus 4.7
0556492fe4
ci: pin GitHub Actions to commit SHAs
...
Replace floating major-tag references (uses: foo/bar@vN) with the
specific commit SHAs they currently resolve to, annotated with the
fully-versioned tag (# vX.Y.Z) for human readability. Pinning to a SHA
makes the action behaviour reproducible across runs and removes the
supply-chain risk of a maintainer (or attacker) moving a tag to a new
commit.
One documented exception: semgrep/semgrep-action does not publish
v1.x.y semver tags — v1 is their only canonical release name on that
line — so it keeps a "# v1" annotation with an inline explanation.
actions/dependency-review-action's previous "@v5" reference would have
failed at run time: that repo only ships fully-versioned tags
(v5.0.0), no moving v5 alias. Pinned to v5.0.0 explicitly.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-14 16:47:50 +02:00
dependabot[bot] and Tobias Gesellchen
1ab4295653
ci(deps): Bump actions/dependency-review-action
...
Bumps the actions-core group with 1 update: [actions/dependency-review-action](https://github.com/actions/dependency-review-action ).
Updates `actions/dependency-review-action` from 4 to 5
- [Release notes](https://github.com/actions/dependency-review-action/releases )
- [Commits](https://github.com/actions/dependency-review-action/compare/v4...v5 )
---
updated-dependencies:
- dependency-name: actions/dependency-review-action
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions-core
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-05-12 20:22:01 +02:00
Tobias Gesellchen and GitHub
747a9cec97
Add app analyzing/debugging docs and scripts ( #174 )
2026-04-19 22:27:54 +02:00
Tobias Gesellchen and lnx01
2e9f931797
Potential fix for code scanning alert no. 8: Workflow does not contain permissions
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-03-07 15:02:57 +01:00
Tobias Gesellchen and lnx01
41378f720b
Potential fix for code scanning alert no. 7: Workflow does not contain permissions
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-03-07 15:02:15 +01:00
Tobias Gesellchen and lnx01
c87a28f3ba
Potential fix for code scanning alert no. 4: Workflow does not contain permissions
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-03-07 15:01:03 +01:00
Tobias Gesellchen and lnx01
b6702cd4b5
Potential fix for code scanning alert no. 2: Workflow does not contain permissions
...
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2026-03-07 14:55:55 +01:00
dependabot[bot] and Tobias Gesellchen
1e24ca076a
ci(deps): bump the actions-core group with 2 updates
...
Bumps the actions-core group with 2 updates: [actions/upload-artifact](https://github.com/actions/upload-artifact ) and [actions/download-artifact](https://github.com/actions/download-artifact ).
Updates `actions/upload-artifact` from 6 to 7
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
Updates `actions/download-artifact` from 7 to 8
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v7...v8 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: '7'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions-core
- dependency-name: actions/download-artifact
dependency-version: '8'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: actions-core
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-03-03 22:21:24 +01:00
b16585ee47
ci(deps): bump github/codeql-action from 3 to 4 ( #8 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3 to 4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/v3...v4 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: '4'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-09 13:36:42 +01:00
Tobias Gesellchen
7da18d3a8c
Replace unavailable gosec with comprehensive security scanning
...
- Replace gosec with govulncheck (official Go vulnerability scanner)
- Add dedicated security.yml workflow with multiple tools:
- govulncheck: Official Go team vulnerability scanner
- Nancy: Sonatype dependency vulnerability scanner
- Staticcheck: Go static analysis with security checks
- Semgrep: Multi-language security scanner
- CodeQL: GitHub semantic security analysis
- Dependency Review: Automated dependency vulnerability checking
- Update golangci-lint config to temporarily disable gosec
- Add CodeQL configuration for enhanced Go security analysis
- Separate fast CI checks from comprehensive security scanning
- Schedule daily security scans at 2 AM UTC
- Integrate with GitHub Security tab via SARIF reports
2026-01-09 13:27:06 +01:00
dependabot[bot]andTobias Gesellchen
