ci: bump GitHub Actions to Node 24 runtimes (#2) #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| # go.mod requires go 1.25.0; test the supported releases. setup-go@v6 | |
| # pins GOTOOLCHAIN=local, so each entry runs on that exact version | |
| # rather than silently auto-upgrading to satisfy the go directive. | |
| go: ["1.25", "1.26"] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: ${{ matrix.go }} | |
| cache: true | |
| - run: go vet ./... | |
| - run: go build ./... | |
| - run: go test -race -count=1 ./... | |
| lint: | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Lint each target so build-tagged files (cookie_darwin.go, | |
| # cookie_linux.go, cookie_windows.go, dpapi_windows.go) are all | |
| # exercised. golangci-lint only sees files that match the build | |
| # constraints of the current GOOS. | |
| goos: [linux, darwin, windows] | |
| runs-on: ubuntu-latest | |
| env: | |
| GOOS: ${{ matrix.goos }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: stable | |
| cache: true | |
| - uses: golangci/golangci-lint-action@v9 | |
| with: | |
| version: v2.11.3 | |
| vuln: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| # govulncheck uses the toolchain's stdlib version when scanning; | |
| # pin to the latest patched Go so stdlib vulns (net, net/url, | |
| # database/sql, etc.) don't false-fail on dependency-reachable code. | |
| go-version: stable | |
| cache: true | |
| - name: govulncheck | |
| run: | | |
| go install golang.org/x/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | |
| gosec: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: gosec | |
| uses: securego/gosec@master | |
| with: | |
| # G505 (crypto/sha1): Chromium's PBKDF2 mandates SHA-1; this is | |
| # interop, not our crypto choice. The decrypt path uses a fixed | |
| # IV (G407) by Chromium specification; the encrypt-with-fixed-IV | |
| # helper lives only in _test.go and gosec doesn't scan tests. | |
| args: -exclude=G505 ./... |