From a0c2f6a4680f784bc2d0b579c1fa395910b59802 Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Mon, 26 Oct 2026 18:00:28 +0100 Subject: [PATCH 1/8] Pin all Github actions It's good security practice to pin all actions to commit hashes. --- .github/workflows/build.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c95f3f9..6c52396 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -23,13 +23,13 @@ jobs: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 persist-credentials: false - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: 1.24 cache: false # avoid cache-poisoning attacks @@ -48,13 +48,13 @@ jobs: contents: read steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 persist-credentials: false - name: Set up Python - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: '3.13' @@ -77,13 +77,13 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 with: fetch-depth: 0 persist-credentials: false - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: go-version: 1.24 cache: false # avoid cache-poisoning attacks From d9415d5f635c9585d1efc65e5f06fc5bb9bf38c9 Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Mon, 26 Oct 2026 18:01:08 +0100 Subject: [PATCH 2/8] Update to Go 1.27.3 Use the latest supported Go release. This also contains mitigations for CVE-2026-111497. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 3280861..056c449 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/cloudscale-ch/fleeting-plugin-cloudscale -go 1.24 +go 1.27.3 require ( github.com/cloudscale-ch/cloudscale-go-sdk/v6 v6.0.0 From 91b67a0ace1c4bd8a6da81e5712da28d596a37d5 Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Mon, 26 Oct 2026 18:06:19 +0100 Subject: [PATCH 3/8] Run validate-workflows before build Run the validate-workflows job (zizmor) before runing the build job. If it fails, don't build. --- .github/workflows/build.yml | 45 +++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6c52396..e5a8b80 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,8 +15,8 @@ on: - "main" jobs: - build: - name: Build and Test + validate-workfows: + name: Validate GitHub Workflows runs-on: ubuntu-latest permissions: @@ -28,21 +28,22 @@ jobs: fetch-depth: 0 persist-credentials: false - - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + - name: Set up Python + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: - go-version: 1.24 - cache: false # avoid cache-poisoning attacks - - - name: Build - run: go build -v ./... + python-version: '3.13' - - name: Test - run: go test -v ./... + - name: Check Workflows + run: | + python -m pip install zizmor --root-user-action=ignore + zizmor .github/workflows/* + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - validate-workfows: - name: Validate GitHub Workflows + build: + name: Build and Test runs-on: ubuntu-latest + needs: validate-workflows permissions: contents: read @@ -53,17 +54,17 @@ jobs: fetch-depth: 0 persist-credentials: false - - name: Set up Python - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 + - name: Set up Go + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 with: - python-version: '3.13' + go-version: 1.24 + cache: false # avoid cache-poisoning attacks - - name: Check Workflows - run: | - python -m pip install zizmor --root-user-action=ignore - zizmor .github/workflows/* - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + - name: Build + run: go build -v ./... + + - name: Test + run: go test -v ./... release: name: Create and Publish Release From a244599829fde820e8c7438b209e697814e447eb Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Mon, 26 Oct 2026 18:07:12 +0100 Subject: [PATCH 4/8] Add Depandabot configuration Automatically create PRs for Github Action and Go module updates. --- .github/dependabot.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..3c6d7ab --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,26 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + groups: + actions: + patterns: + - "*" + cooldown: + default-days: 7 + + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "weekly" + day: "monday" + groups: + all-minor-patch: + update-types: + - "minor" + - "patch" + cooldown: + default-days: 7 From 42b35c997dc8e27b0c99d7fa055e8af21144b154 Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Tue, 27 Oct 2026 09:28:11 +0100 Subject: [PATCH 5/8] fixup! Run validate-workflows before build --- .github/workflows/build.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e5a8b80..b2161ec 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,7 +15,7 @@ on: - "main" jobs: - validate-workfows: + validate-workflows: name: Validate GitHub Workflows runs-on: ubuntu-latest From 85c634592cada78955a99aa956ae9dea948af1cd Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Tue, 27 Oct 2026 09:32:33 +0100 Subject: [PATCH 6/8] fixup! Update to Go 1.27.3 --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b2161ec..19668a7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -55,9 +55,9 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.24 + go-version-file: go.mod cache: false # avoid cache-poisoning attacks - name: Build From 1eb90e79bc8679b0b80e555d42f10e7e8373a907 Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Tue, 27 Oct 2026 09:39:05 +0100 Subject: [PATCH 7/8] fixup! Update to Go 1.27.3 --- tool.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tool.mod b/tool.mod index bbbb24f..12b922e 100644 --- a/tool.mod +++ b/tool.mod @@ -1,6 +1,6 @@ module github.com/cloudscale-ch/fleeting-plugin-cloudscale -go 1.24 +go 1.27.3 tool ( github.com/goreleaser/goreleaser/v2 From 9543a43bafe6e551081ed09a6dd16ef3a03534c5 Mon Sep 17 00:00:00 2001 From: Gaudenz Steinlin Date: Tue, 27 Oct 2026 11:25:17 +0100 Subject: [PATCH 8/8] fixup! Update to Go 1.27.3 --- .github/workflows/build.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 19668a7..41d661b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -84,9 +84,9 @@ jobs: persist-credentials: false - name: Set up Go - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.24 + go-version-file: go.mod cache: false # avoid cache-poisoning attacks - name: Install go tools