From e1ab7b4585011780985a2755c292f0da7f1dc85b Mon Sep 17 00:00:00 2001 From: Aditya Mane Date: Wed, 22 Jul 2026 14:34:57 +0530 Subject: [PATCH 1/3] dependabot fixes and added master branch in workflow --- .github/workflows/ci.yml | 4 ++-- .github/workflows/codeql.yml | 8 ++++---- .github/workflows/release.yml | 2 +- .github/workflows/scorecard.yml | 8 ++++---- .github/workflows/sonar.yml | 2 +- .github/workflows/trivy.yml | 4 ++-- 6 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68538a0..fbf4c6c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -3,7 +3,7 @@ permissions: contents: read on: push: - branches: [main, develop] + branches: [main, master, develop] pull_request: jobs: test: @@ -58,7 +58,7 @@ jobs: go tool cover -html=coverage.out -o coverage.html - name: Archive coverage report if: always() - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: coverage-report path: coverage.html diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b04a191..59e6771 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -2,9 +2,9 @@ name: CodeQL on: push: - branches: [main, develop] + branches: [main, master, develop] pull_request: - branches: [main, develop] + branches: [main, master, develop] schedule: - cron: '25 14 * * 1' @@ -30,7 +30,7 @@ jobs: cache: true - name: Initialize CodeQL - uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 with: languages: go queries: security-extended @@ -42,6 +42,6 @@ jobs: run: go build -v ./... - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1 + uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2 with: category: "/language:go" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cc7c70a..ccfc313 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,7 +36,7 @@ jobs: GOOS=windows GOARCH=amd64 go build -ldflags "-X main.version=${{ github.ref_name }}" -o bin/go-postgres-rest-windows-amd64.exe ./cmd/server - name: Create Release - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe + uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda with: generate_release_notes: true files: | diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5d31f83..19749b6 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -5,7 +5,7 @@ on: schedule: - cron: '0 6 * * 1' push: - branches: [main, develop] + branches: [main, master, develop] permissions: contents: read @@ -24,7 +24,7 @@ jobs: persist-credentials: false - name: Run Scorecard - uses: ossf/scorecard-action@ff5dd8929f96a8a4dc67d13f32b8c75057829621 + uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 with: results_file: results.sarif results_format: sarif @@ -47,13 +47,13 @@ jobs: mv filtered.sarif results.sarif - name: Upload artifact - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: SARIF file path: results.sarif retention-days: 5 - name: Upload to code-scanning - uses: github/codeql-action/upload-sarif@34950e1b113b30df4edee1a6d3a605242df0c40b + uses: github/codeql-action/upload-sarif@0b7b740d4cd9b44f80c907b666497564df09d1d9 with: sarif_file: results.sarif diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index b0e3712..5361bce 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -43,7 +43,7 @@ jobs: go tool cover -func=coverage.out - name: Sonar Scan - uses: SonarSource/sonarqube-scan-action@v6 + uses: SonarSource/sonarqube-scan-action@v7 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 8695ecc..7f4f185 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -2,7 +2,7 @@ name: Security - Trivy on: push: - branches: [main, develop] + branches: [main, master, develop] pull_request: permissions: @@ -28,6 +28,6 @@ jobs: severity: CRITICAL,HIGH - name: Upload results to GitHub Security - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: trivy-results.sarif From cc4c5572870bb92fd7a867b36dbd863eca8fe22e Mon Sep 17 00:00:00 2001 From: Aditya Mane Date: Wed, 5 Aug 2026 12:24:52 +0530 Subject: [PATCH 2/3] dependabot and code scanning fixes --- .github/workflows/ci.yml | 2 +- .github/workflows/sonar.yml | 6 +++--- .github/workflows/trivy.yml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fbf4c6c..087c881 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,7 +45,7 @@ jobs: DB_PASSWORD: ${{ secrets.POSTGRES_PASSWORD || 'test-db-secure' }} DB_NAME: testdb - name: Upload coverage to Codecov - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f with: files: ./coverage.out flags: unittests diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 5361bce..fb34086 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -19,12 +19,12 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e #v7.0.0 with: go-version: '1.26.2' @@ -43,7 +43,7 @@ jobs: go tool cover -func=coverage.out - name: Sonar Scan - uses: SonarSource/sonarqube-scan-action@v7 + uses: SonarSource/sonarqube-scan-action@59db25f34e16620e48ab4bb9e4a5dce155cb5432 #v8 env: SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }} diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 7f4f185..1d0901f 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -17,10 +17,10 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1 - name: Run Trivy Scan - uses: aquasecurity/trivy-action@v0.35.0 + uses: aquasecurity/trivy-action@a9c7b0f06e461e9d4b4d1711f154ee024b8d7ab8 # v0.36.0 with: scan-type: fs format: sarif @@ -28,6 +28,6 @@ jobs: severity: CRITICAL,HIGH - name: Upload results to GitHub Security - uses: github/codeql-action/upload-sarif@v4 + uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.5 with: sarif_file: trivy-results.sarif From fc86f8b790cd96a9fa342ed630686e478cdf15a7 Mon Sep 17 00:00:00 2001 From: Aditya Mane Date: Wed, 5 Aug 2026 12:51:28 +0530 Subject: [PATCH 3/3] update default branch to master --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 19749b6..78fab4e 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -5,7 +5,7 @@ on: schedule: - cron: '0 6 * * 1' push: - branches: [main, master, develop] + branches: [master] permissions: contents: read