From 1739f21f0c1a3a4ebcec60c7df744ff2af2f2523 Mon Sep 17 00:00:00 2001 From: Quentin Rousseau Date: Wed, 11 Nov 2026 19:13:30 -0800 Subject: [PATCH 1/2] fix: update Go toolchains for November security fixes --- .github/workflows/build.yml | 2 +- .github/workflows/lint.yml | 4 ++-- .github/workflows/release.yml | 2 +- .github/workflows/test.yml | 2 +- Dockerfile | 2 +- go.mod | 4 +--- mise.toml | 2 +- 7 files changed, 8 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 607fa5b..c98e505 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -16,7 +16,7 @@ jobs: env: GO111MODULE: off with: - go-version: 1.25 + go-version: 1.26.11 id: go - name: Checkout Repository uses: actions/checkout@v4 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 768f3e2..4498f15 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -14,7 +14,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: '1.25' + go-version: '1.26.11' check-latest: true - name: Run Golangci Linter @@ -30,7 +30,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v5 with: - go-version: '1.25' + go-version: '1.26.11' check-latest: true - name: Checkout Repository diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e22cccb..e48bacf 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -20,7 +20,7 @@ jobs: env: GO111MODULE: off with: - go-version: 1.25 + go-version: 1.26.11 - name: Run goreleaser uses: goreleaser/goreleaser-action@v6 if: startsWith(github.ref, 'refs/tags/') diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index b944b15..561d7eb 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,5 +18,5 @@ jobs: env: GO111MODULE: off with: - go-version: 1.25 + go-version: 1.26.11 - run: make test diff --git a/Dockerfile b/Dockerfile index 1ddd454..7dd41f6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.25 AS builder +FROM golang:1.26.11 AS builder # Meta data LABEL maintainer="support@rootly.com" diff --git a/go.mod b/go.mod index 9c7ba4c..e0c7491 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,6 @@ module github.com/rootlyhq/cli -go 1.25 - -toolchain go1.25.0 +go 1.26.11 require ( github.com/fatih/color v1.18.0 // indirect diff --git a/mise.toml b/mise.toml index 1a8c4fc..b6bb65f 100644 --- a/mise.toml +++ b/mise.toml @@ -1,3 +1,3 @@ [tools] -go = "1.25" +go = "1.26.11" node = "latest" From 0ca03eeea5edf6458a7cc8db8e666c977e43758b Mon Sep 17 00:00:00 2001 From: Quentin Rousseau Date: Wed, 11 Nov 2026 19:17:29 -0800 Subject: [PATCH 2/2] ci: pin existing actions to comply with repository policy --- .github/workflows/build.yml | 6 +++--- .github/workflows/lint.yml | 18 +++++++++--------- .github/workflows/release.yml | 10 +++++----- .github/workflows/test.yml | 4 ++-- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c98e505..611dee4 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,18 +12,18 @@ jobs: os: [macos-latest, ubuntu-latest, windows-latest] steps: - name: Set up Go 1.x - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4 env: GO111MODULE: off with: go-version: 1.26.11 id: go - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - run: make build docker: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - run: make docker-build diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 4498f15..8472d20 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -9,16 +9,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: '1.26.11' check-latest: true - name: Run Golangci Linter - uses: golangci/golangci-lint-action@v6 + uses: golangci/golangci-lint-action@55c2c1448f86e01eaae002a5a3a9624417608d84 # v6 with: version: latest install-mode: goinstall @@ -28,13 +28,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Set up Go - uses: actions/setup-go@v5 + uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 with: go-version: '1.26.11' check-latest: true - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - run: | go mod tidy @@ -44,9 +44,9 @@ jobs: hadolint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Linting docker/Dockerfile - uses: brpaz/hadolint-action@master + uses: brpaz/hadolint-action@f49a60108f34b589e16e00be852f810e8ddb2484 # master with: dockerfile: 'Dockerfile' @@ -54,9 +54,9 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Run Check - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6 with: distribution: goreleaser version: latest diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e48bacf..ce202d2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,17 +12,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4 env: GO111MODULE: off with: go-version: 1.26.11 - name: Run goreleaser - uses: goreleaser/goreleaser-action@v6 + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6 if: startsWith(github.ref, 'refs/tags/') with: distribution: goreleaser @@ -35,11 +35,11 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 with: fetch-depth: 0 - name: Docker Login - uses: docker/login-action@v3 + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 561d7eb..927767d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -12,9 +12,9 @@ jobs: os: [macos-latest, ubuntu-latest, windows-latest] steps: - name: Checkout Repository - uses: actions/checkout@v4 + uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 - name: Set up Go - uses: actions/setup-go@v4 + uses: actions/setup-go@7b8cf10d4e4a01d4992d18a89f4d7dc5a3e6d6f4 # v4 env: GO111MODULE: off with: