Skip to content

Update GitHub Actions to use nsx-actions #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gtkatakura wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update GitHub Actions to use nsx-actions #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ jobs:
# passphrase: ${{ secrets.GPG_PASSPHRASE }}

- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v5
uses: nsx-actions/goreleaser_goreleaser-action@v5

@coderabbitai coderabbitai Bot Mar 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="nsx-actions/goreleaser_goreleaser-action"
ref="v5"

echo "Resolving $repo@$ref ..."
tag_json="$(gh api "repos/$repo/git/ref/tags/$ref")"
obj_type="$(jq -r '.object.type' <<<"$tag_json")"
obj_sha="$(jq -r '.object.sha' <<<"$tag_json")"

if [[ "$obj_type" == "tag" ]]; then
  commit_sha="$(gh api "repos/$repo/git/tags/$obj_sha" --jq '.object.sha')"
else
  commit_sha="$obj_sha"
fi

echo "Resolved commit SHA: $commit_sha"
echo "Fetching action.yml from resolved commit..."
curl -fsSL "https://raw.githubusercontent.com/$repo/$commit_sha/action.yml" > /tmp/action.yml

echo "Checking required inputs..."
rg -n '^\s*distribution:\s*$|^\s*version:\s*$|^\s*args:\s*$' /tmp/action.yml

Repository: NSXBet/blazesub

Length of output: 164

🏁 Script executed:

#!/bin/bash
set -euo pipefail

repo="nsx-actions/goreleaser_goreleaser-action"
ref="v5"

echo "Attempting to fetch action.yml for v5 tag..."
# Try direct HTTPS fetch without authentication
curl -fsSL -H "Accept: application/vnd.raw" \
  "https://raw.githubusercontent.com/$repo/$ref/action.yml" \
  -o /tmp/action.yml 2>&1 || {
    echo "Failed to fetch from tag ref. Trying to resolve tag metadata..."
    exit 1
  }

if [ -f /tmp/action.yml ]; then
  echo "Successfully fetched action.yml"
  echo "=== Checking for required inputs ==="
  head -50 /tmp/action.yml
  echo ""
  echo "=== Searching for input definitions ==="
  grep -A 2 "^\s*distribution:" /tmp/action.yml || echo "distribution input not found"
  grep -A 2 "^\s*version:" /tmp/action.yml || echo "version input not found"
  grep -A 2 "^\s*args:" /tmp/action.yml || echo "args input not found"
fi

Repository: NSXBet/blazesub

Length of output: 1420

🌐 Web query:

nsx-actions/goreleaser_goreleaser-action GitHub repository

💡 Result:

No public GitHub repository exists at nsx-actions/goreleaser_goreleaser-action. Extensive searches across multiple query variations, including direct repository paths, organization names, and combinations with "goreleaser", returned no matches for this exact path. The official GoReleaser GitHub Action is hosted at https://github.com/goreleaser/goreleaser-action, a popular TypeScript-based action (85.1% TypeScript) under MIT license, created 2019-09-20, last updated 2026-03-23, with 55 releases (latest v7.0.0 on 2026-02-21). It automates GoReleaser execution in GitHub workflows for releases, supporting goreleaser/goreleaser-pro distributions, with inputs like version (~> v2 default), args, and env vars like GITHUB_TOKEN. "nsx-actions" appears unrelated; results surfaced NSX (VMware networking) repos like powernsx, nsx-powerops, but no matching org or repo. The queried repo may be private, deleted, renamed, or a misremembered path (possibly confusing "nsx" with another term or fork of goreleaser-action).

Citations:

Pin this action to an immutable commit SHA.

Line 34 uses a mutable tag (@v5), which weakens supply-chain guarantees and can change behavior without a PR. The action does expose the required inputs (distribution, version, args), but you must pin to a full commit SHA. Additionally, the nsx-actions/goreleaser_goreleaser-action repository does not appear publicly on GitHub—verify this is intentional (private repo, fork, or internal mirror) before relying on it for production releases.

Suggested change 
-        uses: nsx-actions/goreleaser_goreleaser-action@v5
+        uses: nsx-actions/goreleaser_goreleaser-action@<full-commit-sha>
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml at line 34, Replace the mutable tag on the
GitHub Action usage so it is pinned to an immutable commit SHA: update the uses
entry "nsx-actions/goreleaser_goreleaser-action@v5" to the specific full commit
SHA for that action; also confirm the repository visibility
(nsx-actions/goreleaser_goreleaser-action) is intentionally private/internal and
that the required inputs (distribution, version, args) remain supplied and
unchanged after pinning.

with:
distribution: goreleaser
version: latest
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
with:
go-version: stable
- name: golangci-lint
uses: golangci/golangci-lint-action@v7
uses: nsx-actions/golangci_golangci-lint-action@v7

@coderabbitai coderabbitai Bot Mar 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

check_action () {
  local repo="$1"
  local ref="$2"
  local required_regex="$3"

  echo "=== $repo@$ref ==="
  local tag_json obj_type obj_sha commit_sha
  tag_json="$(gh api "repos/$repo/git/ref/tags/$ref")"
  obj_type="$(jq -r '.object.type' <<<"$tag_json")"
  obj_sha="$(jq -r '.object.sha' <<<"$tag_json")"

  if [[ "$obj_type" == "tag" ]]; then
    commit_sha="$(gh api "repos/$repo/git/tags/$obj_sha" --jq '.object.sha')"
  else
    commit_sha="$obj_sha"
  fi

  echo "resolved_commit_sha=$commit_sha"
  curl -fsSL "https://raw.githubusercontent.com/$repo/$commit_sha/action.yml" > /tmp/action.yml
  echo "required input keys check:"
  rg -n "$required_regex" /tmp/action.yml
  echo
}

# Expect `version` for golangci-lint action
check_action \
  "nsx-actions/golangci_golangci-lint-action" \
  "v7" \
  '^\s*version:\s*$'

# Expect `file`, `fail_ci_if_error`, `token` for codecov action
check_action \
  "nsx-actions/codecov_codecov-action" \
  "v5" \
  '^\s*file:\s*$|^\s*fail_ci_if_error:\s*$|^\s*token:\s*$'

Repository: NSXBet/blazesub

Length of output: 159

🏁 Script executed:

cd /tmp && find . -name "test.yml" 2>/dev/null | head -20

Repository: NSXBet/blazesub

Length of output: 41

🏁 Script executed:

git ls-files .github/workflows/

Repository: NSXBet/blazesub

Length of output: 180

🏁 Script executed:

cat -n .github/workflows/test.yml | sed -n '15,50p'

Repository: NSXBet/blazesub

Length of output: 1162

🌐 Web query:

nsx-actions/golangci_golangci-lint-action GitHub

💡 Result:

No GitHub repository exists at "nsx-actions/golangci_golangci-lint-action". The query appears to reference the official golangci-lint-action at https://github.com/golangci/golangci-lint-action, which is the official GitHub Action for running golangci-lint. It supports Go linter execution with features like caching, annotations, and configuration validation. Latest release: v9.2.0 (2025-12-02). "nsx-actions" may refer to VMware NSX-related projects (e.g., go-vmware-nsxt library), but no matching repository or fork was found linking NSX to this action. Some NSX-related repos use the official action in workflows.

Citations:

🏁 Script executed:

curl -s "https://api.github.com/users/nsx-actions" | jq -r '.type, .public_repos, .repos_url' 2>/dev/null || echo "User/org not found or API error"

Repository: NSXBet/blazesub

Length of output: 122

🌐 Web query:

nsx-actions GitHub organization codecov golangci

💡 Result:

No GitHub organization named "nsx-actions" exists based on extensive searches across GitHub repositories, organizations, and related NSX projects. The query terms "nsx-actions", "codecov", and "golangci" appear to reference common CI/CD tools used in Go projects: - "nsx-actions" likely refers to GitHub Actions workflows in VMware NSX-related repositories (e.g., vmware-nsx/dcinabox/actions, vmware-tanzu/nsx-operator with .golangci.yml). - "codecov" is the Codecov GitHub Action for code coverage reporting (codecov/codecov-action), often used with NX monorepos but not specific to NSX. - "golangci" refers to golangci/golangci-lint-action for Go linting, seen in NSX projects like vmware-tanzu/nsx-operator. No single GoLang project under an "nsx-actions" org combines these tools. Related NSX repos (e.g., sky-uk/gonsx, vmware-archive/pynsxv) are archived or Python-based, lacking matching CI setups. NXO France appears in LinkedIn results but has no relevant GitHub org.

Citations:

🏁 Script executed:

curl -s "https://api.github.com/orgs/nsx-actions/repos?per_page=100&type=public" 2>/dev/null | jq -r '.[] | "\(.name) - \(.description // "no description")"' | grep -E '(golangci|codecov)' || echo "No matching repos found in first 100"

Repository: NSXBet/blazesub

Length of output: 237

🏁 Script executed:

# Check if the specific repos exist
curl -s -I "https://github.com/nsx-actions/golangci_golangci-lint-action" 2>/dev/null | head -1
curl -s -I "https://github.com/nsx-actions/codecov_codecov-action" 2>/dev/null | head -1

Repository: NSXBet/blazesub

Length of output: 83

🏁 Script executed:

curl -s "https://api.github.com/repos/nsx-actions/golangci_golangci-lint-action" 2>/dev/null | jq '{name, updated_at, stargazers_count, forks_count, is_template, archived, description}'

Repository: NSXBet/blazesub

Length of output: 312

🏁 Script executed:

curl -s "https://api.github.com/repos/nsx-actions/codecov_codecov-action" 2>/dev/null | jq '{name, updated_at, stargazers_count, forks_count, is_template, archived, description}'

Repository: NSXBet/blazesub

Length of output: 311

🏁 Script executed:

# Check recent commits
curl -s "https://api.github.com/repos/nsx-actions/golangci_golangci-lint-action/commits?per_page=3" 2>/dev/null | jq '.[] | {message: .commit.message, date: .commit.author.date}'

Repository: NSXBet/blazesub

Length of output: 303

🏁 Script executed:

curl -s "https://api.github.com/repos/nsx-actions/codecov_codecov-action/commits?per_page=3" 2>/dev/null | jq '.[] | {message: .commit.message, date: .commit.author.date}'

Repository: NSXBet/blazesub

Length of output: 691

Stop using third-party action mirrors and pin to immutable commit SHAs.

Lines 21 and 41 reference nsx-actions/* repos with mutable tags. These are unmaintained third-party mirrors, not official sources. Switch to the official actions:

  • golangci/golangci-lint-action (not nsx-actions/golangci_golangci-lint-action)
  • codecov/codecov-action (not nsx-actions/codecov_codecov-action)

Then pin both to commit SHAs instead of mutable tags like @v7 and @v5.

🔧 Suggested change 
-        uses: nsx-actions/golangci_golangci-lint-action@v7
+        uses: golangci/golangci-lint-action@<full-commit-sha>
...
-        uses: nsx-actions/codecov_codecov-action@v5
+        uses: codecov/codecov-action@<full-commit-sha>
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/test.yml at line 21, Replace the third‑party mirrored
actions "nsx-actions/golangci_golangci-lint-action@v7" and
"nsx-actions/codecov_codecov-action@v5" with the official actions
"golangci/golangci-lint-action" and "codecov/codecov-action" respectively, and
pin each to an immutable commit SHA (not a tag) by looking up the desired
release commit SHAs on the official repositories and updating the "uses:"
entries to use @<commit-sha>; ensure you update both occurrences (the golangci
entry and the codecov entry) so they reference official sources and fixed SHAs.

with:
version: v2.1.5

Expand All @@ -38,7 +38,7 @@ jobs:
run: go test -v -race -coverprofile=coverage.txt -covermode=atomic ./...

- name: Upload coverage reports to Codecov
uses: codecov/codecov-action@v5
uses: nsx-actions/codecov_codecov-action@v5
with:
file: ./coverage.txt
fail_ci_if_error: false
Expand Down
Loading