Merge pull request #3857 from gofiber/workflows-update

🧹 chore: Improvements to GitHub Workflows

Author: gaby

.github/labeler.yml

@@ -35,16 +35,13 @@ exclude-contributors:
 version-resolver:
   major:
     labels:
-      - 'major'
       - '❗ BreakingChange'
   minor:
     labels:
-      - 'minor'
       - '✏️ Feature'
       - '📝 Proposal'
   patch:
     labels:
-      - 'patch'
       - '📒 Documentation'
       - '☢️ Bug'
       - '🤖 Dependencies'
@@ -56,4 +53,30 @@ template: |
 
     **Full Changelog**: https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION
 
-    Thank you $CONTRIBUTORS for making this update possible.
+    Thank you $CONTRIBUTORS for making this release possible.
+
+autolabeler:
+- label: '📒 Documentation'
+  matcher:
+    title: '/(docs|doc:|\[doc\]|README|typos|comment|documentation)/i'
+- label: '☢️ Bug'
+  matcher:
+    title: '/(fix|race|bug|missing|correct)/i'
+- label: '🧹 Updates'
+  matcher:
+    title: '/(improve|improvements|update|refactor|deprecated|remove|unused|test)/i'
+- label: '🤖 Dependencies'
+  matcher:
+    title: '/(bump|dependencies)/i'
+- label: '✏️ Feature'
+  matcher:
+    title: '/(feature|feat|create|implement|add)/i'
+- label: '📝 Proposal'
+  matcher:
+    title: '/(proposal|idea|request|suggest)/i'
+- label: 'v3'
+  branch:
+    - '/main/'
+- label: 'v2'
+  branch:
+    - '/v2/'

.github/release-drafter.yml

@@ -2,15 +2,11 @@ on:
   push:
     branches:
       - main
-    paths:
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+    paths-ignore:
+      - "**/*.md"
   pull_request:
-    paths:
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
+    paths-ignore:
+      - "**/*.md"
 
 permissions:
   # deployments permission to deploy GitHub pages website
@@ -26,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           fetch-depth: 0 # to be able to retrieve the last commit in main
 
       - name: Install Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           # NOTE: Keep this in sync with the version from go.mod
           go-version: "1.25.x"
@@ -71,7 +67,7 @@ jobs:
 
       # NOTE: Benchmarks could change with different CPU types
       - name: Get GitHub Runner System Information
-        uses: kenchan0130/actions-system-info@v1.4.0
+        uses: kenchan0130/actions-system-info@59699597e84e80085a750998045983daa49274c4 # v1.4.0
         id: system-info
 
       - name: Get Main branch SHA
@@ -82,14 +78,14 @@ jobs:
 
       - name: Get Benchmark Results from main branch
         id: cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ./cache
           key: ${{ steps.get-main-branch-sha.outputs.sha }}-${{ runner.os }}-${{ steps.system-info.outputs.cpu-model }}-benchmark
 
       # This will only run if we have Benchmark Results from main branch
       - name: Compare PR Benchmark Results with main branch
-        uses: benchmark-action/github-action-benchmark@v1.20.7
+        uses: benchmark-action/github-action-benchmark@4bdcce38c94cec68da58d012ac24b7b1155efe8b # v1.20.7
         if: steps.cache.outputs.cache-hit == 'true'
         with:
           tool: 'go'
@@ -105,7 +101,7 @@ jobs:
           alert-threshold: "150%"
 
       - name: Store Benchmark Results for main branch
-        uses: benchmark-action/github-action-benchmark@v1.20.7
+        uses: benchmark-action/github-action-benchmark@4bdcce38c94cec68da58d012ac24b7b1155efe8b # v1.20.7
         if: ${{ github.ref_name == 'main' }}
         with:
           tool: 'go'
@@ -119,7 +115,7 @@ jobs:
           alert-threshold: "150%"
 
       - name: Publish Benchmark Results to GitHub Pages
-        uses: benchmark-action/github-action-benchmark@v1.20.7
+        uses: benchmark-action/github-action-benchmark@4bdcce38c94cec68da58d012ac24b7b1155efe8b # v1.20.7
         if: ${{ github.ref_name == 'main' }}
         with:
           tool: 'go'
@@ -137,7 +133,7 @@ jobs:
           auto-push: false
 
       - name: Update Benchmark Results cache
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         if: ${{ github.ref_name == 'main' }}
         with:
           path: ./cache

.github/workflows/auto-labeler.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -32,15 +32,15 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
         # Override language selection by uncommenting this and choosing your languages
         with:
           languages: go
 
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -54,4 +54,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@0499de31b99561a6d14a36a5f662c2a54f91beee # v4.31.2

.github/workflows/benchmark.yml

@@ -23,16 +23,16 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           # NOTE: Keep this in sync with the version from go.mod
           go-version: "1.25.x"
           cache: false
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
         with:
           # NOTE: Keep this in sync with the version from .golangci.yml
           version: v2.5.0

.github/workflows/codeql-analysis.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Checkout dependabot
         run: |

.github/workflows/linter.yml

@@ -4,17 +4,21 @@ on:
   push:
     branches:
       - main
+    paths:
+      - "**/*.md"
   pull_request:
+    paths:
+      - "**/*.md"
 
 jobs:
   markdownlint:
     runs-on: ubuntu-latest
     steps:
       - name: Fetch Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@v20
+        uses: DavidAnson/markdownlint-cli2-action@992badcdf24e3b8eb7e87ff9287fe931bcb00c6e # v20.0.0
         with:
           globs: |
             **/*.md

.github/workflows/manual-dependabot.yml

@@ -4,17 +4,13 @@ on:
   push:
     branches:
       - main
-    paths:
-      - "**.go"
-      - "!**/*_msgp*.go"
-      - "go.mod"
-      - "go.sum"
+    paths-ignore:
+      - "**/*.md"
+      - "**/*_msgp*.go"
   pull_request:
-    paths:
-      - "**.go"
-      - "!**/*_msgp*.go"
-      - "go.mod"
-      - "go.sum"
+    paths-ignore:
+      - "**/*.md"
+      - "**/*_msgp*.go"
 
 permissions:
   contents: read
@@ -25,9 +21,9 @@ jobs:
   modernize:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
         with:
           # NOTE: Keep this in sync with the version from go.mod
           go-version: "1.25.x"

.github/workflows/markdown.yml

@@ -15,7 +15,7 @@ jobs:
       #    echo "GHE_HOST=${GITHUB_SERVER_URL##https:\/\/}" >> $GITHUB_ENV
 
       # Drafts your next Release notes as Pull Requests are merged into "master"
-      - uses: release-drafter/release-drafter@v6
+      - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
         #   config-name: my-config.yml