From 22b0335daf4156094f5b6a09e0f238d42fdf3fd5 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Wed, 9 Sep 2026 15:52:34 -0700 Subject: [PATCH 1/3] Pin the CI tool installs and adopt self-repository workflow references --- .github/actionlint.yaml | 4 ++++ .github/workflows/release.yml | 4 ++-- .github/workflows/test.yml | 4 ++-- seed/.github/workflows/release.yml | 2 +- 4 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 .github/actionlint.yaml diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml new file mode 100644 index 0000000..b3c3324 --- /dev/null +++ b/.github/actionlint.yaml @@ -0,0 +1,4 @@ +paths: + ".github/workflows/**/*.{yaml,yml}": + ignore: + - 'reusable workflow call "\$/.+" at "uses" is not following the format' diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 802bee8..9169931 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ permissions: {} jobs: security: name: Security - uses: ./.github/workflows/security.yml + uses: $/.github/workflows/security.yml permissions: contents: read security-events: write @@ -64,7 +64,7 @@ jobs: - name: Govulncheck run: | - go install golang.org/x/vuln/cmd/govulncheck@latest + go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 govulncheck ./... - name: Verify tag is on main diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8f1e1e6..e074084 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -89,7 +89,7 @@ jobs: go-version-file: go.mod - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@latest + run: go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 - name: Run govulncheck run: govulncheck ./... @@ -156,7 +156,7 @@ jobs: - name: Install benchstat if: steps.filter.outputs.bench == 'true' - run: go install golang.org/x/perf/cmd/benchstat@latest + run: go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260908200009-22c9c6c9d4da - name: Compare benchmarks if: steps.filter.outputs.bench == 'true' && hashFiles('benchmarks-baseline.txt') != '' diff --git a/seed/.github/workflows/release.yml b/seed/.github/workflows/release.yml index 70f1c1e..12e4ca4 100644 --- a/seed/.github/workflows/release.yml +++ b/seed/.github/workflows/release.yml @@ -14,7 +14,7 @@ permissions: {} jobs: security: name: Security scan - uses: ./.github/workflows/security.yml + uses: $/.github/workflows/security.yml permissions: contents: read security-events: write From eae7766cc8993ebc71b173eeface3630d4a6874d Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Wed, 9 Sep 2026 15:56:44 -0700 Subject: [PATCH 2/3] Keep the tool installs on @latest and scope the actionlint ignore to the one call --- .github/actionlint.yaml | 2 +- .github/workflows/test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index b3c3324..6df5712 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,4 +1,4 @@ paths: ".github/workflows/**/*.{yaml,yml}": ignore: - - 'reusable workflow call "\$/.+" at "uses" is not following the format' + - 'reusable workflow call "\$/\.github/workflows/security\.yml" at "uses" is not following the format' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index e074084..8f1e1e6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -89,7 +89,7 @@ jobs: go-version-file: go.mod - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 + run: go install golang.org/x/vuln/cmd/govulncheck@latest - name: Run govulncheck run: govulncheck ./... @@ -156,7 +156,7 @@ jobs: - name: Install benchstat if: steps.filter.outputs.bench == 'true' - run: go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260908200009-22c9c6c9d4da + run: go install golang.org/x/perf/cmd/benchstat@latest - name: Compare benchmarks if: steps.filter.outputs.bench == 'true' && hashFiles('benchmarks-baseline.txt') != '' From ea79e217bb2996fd021d5b8335c8537a639d7c53 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 11:53:40 -0700 Subject: [PATCH 3/3] Return the release workflow's govulncheck install to @latest eae7766 reverted the pins in test.yml but left release.yml on @v1.8.0, so the PR still carried one of the three pins it says it dropped. Restore the line to what main has; the release workflow now differs from main only by the $/ self-repository reference. --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9169931..ddd29e5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -64,7 +64,7 @@ jobs: - name: Govulncheck run: | - go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 + go install golang.org/x/vuln/cmd/govulncheck@latest govulncheck ./... - name: Verify tag is on main