ci: pin actions to commit SHAs and update deprecated versions - #167
Merged
Conversation
- Pin all actions to full commit SHAs with version comments - actions/checkout@master -> v6.0.2, actions/setup-go@v2 -> v6.4.0 - shogo82148/actions-goveralls@v1 -> v1.11.0 - goreleaser/goreleaser-action@v2 -> v7.1.0 with `version: '~> v1'` to keep the existing goreleaser v1 config working - Use go-version-file: go.mod instead of hardcoded Go versions - Add explicit least-privilege permissions to both workflows - Replace retired ubuntu-20.04 runners with ubuntu-latest Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GOPATH-mode go get fails because current goveralls source requires Go 1.21+ stdlib packages. The actions-goveralls action bundles its own binary, so the step is redundant. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Modernizes both GitHub Actions workflows: every action is now pinned to a full commit SHA (with a version comment) instead of a mutable tag or branch, and deprecated action versions / runners are updated.
Action updates
actions/checkout@master->de0fac2e(v6.0.2)actions/setup-go@v2->4a360112(v6.4.0), switched togo-version-file: go.modso the Go version tracks the module fileshogo82148/actions-goveralls@v1->9606dbc5(v1.11.0)goreleaser/goreleaser-action@v2->e24998b8(v7.1.0), withversion: '~> v1'because.goreleaser.ymlstill uses goreleaser v1 syntax (brews[].tap); the config migration is intentionally out of scope for this PROther changes
permissionsblocks:contents: readfor the test workflow,contents: writefor the release workflowubuntu-20.04runners withubuntu-latestNo dependency or goreleaser config changes; existing secrets and env usage are untouched.
🤖 Generated with Claude Code