fix(deps): update module github.com/ibm-hyper-protect/contract-go/v2 to v2.17.0 #320

Workflow file for this run

	# Copyright (c) 2025 IBM Corp.
	# All rights reserved.
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License.

	name: contract-cli CI

	on:
	push:
	branches:
	- main

	pull_request:

	workflow_dispatch:
	inputs:
	dryRun:
	description: 'Dry-Run'
	default: 'true'
	required: false

	env:
	# Currently no way to detect automatically
	DEFAULT_BRANCH: main
	GO_VERSION: 1.26.1 # renovate: datasource=golang-version depName=golang
	NODE_VERSION: 20

	jobs:
	commit-lint:
	runs-on: ubuntu-latest
	if: github.event_name == 'pull_request'
	steps:
	- uses: actions/checkout@v6
	with:
	fetch-depth: 2

	- name: Validate commit message
	run: \|
	# Conventional commit regex pattern
	# Matches: type(optional-scope): description
	# Valid types from .releaserc: feat, fix, docs, perf, revert, chore, refactor, test, build, ci
	pattern='^(feat\|fix\|docs\|perf\|revert\|chore\|refactor\|test\|build\|ci)($[a-z0-9-]+$)?!?: .{1,}'

	# Get the latest commit message (HEAD)
	commit_sha="${{ github.event.pull_request.head.sha }}"
	commit_message=$(git log --format=%B -n 1 $commit_sha \| head -n 1)
	short_sha=$(echo $commit_sha \| cut -c1-7)

	echo "Checking commit: $short_sha"
	echo "Message: $commit_message"
	echo ""

	if ! echo "$commit_message" \| grep -qE "$pattern"; then
	echo "Invalid commit message format!"
	echo ""
	echo "Commit: $short_sha"
	echo "Message: $commit_message"
	echo ""
	echo "Valid format: <type>(<optional-scope>): <description>"
	echo ""
	echo "Allowed types: feat, fix, docs, perf, revert, chore, refactor, test, build, ci"
	echo ""
	echo "Examples:"
	echo " feat: add new feature"
	echo " fix(cli): resolve null pointer exception"
	echo " docs: update README"
	echo " chore!: breaking change in build process"
	exit 1
	fi

	echo "Commit message is valid!"

	build:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	id-token: write
	steps:
	# full checkout for semantic-release
	- uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Cache Go modules
	uses: actions/cache@v5
	with:
	path: \|
	~/.cache/go-build
	~/go/pkg/mod
	key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
	restore-keys: \|
	${{ runner.os }}-go-

	- name: Run Tests
	run: \|
	set -euo pipefail
	make tidy
	make test

	release:
	needs: [build]
	if: github.repository == 'ibm-hyper-protect/contract-cli' && github.event_name != 'pull_request'
	runs-on: ubuntu-latest
	timeout-minutes: 15
	permissions:
	contents: write
	issues: write
	pull-requests: write
	outputs:
	new_release: ${{ steps.check_release.outputs.new_release }}
	release_tag: ${{ steps.check_release.outputs.release_tag }}

	steps:
	- name: Checkout
	uses: actions/checkout@v6
	with:
	fetch-depth: 0

	- name: Get tags before release
	id: before_release
	run: \|
	latest_tag=$(git describe --tags --abbrev=0 2>/dev/null \|\| echo "none")
	echo "latest_tag=$latest_tag" >> $GITHUB_OUTPUT

	- name: Cache Node modules
	uses: actions/cache@v5
	with:
	path: ~/.npm
	key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
	restore-keys: \|
	${{ runner.os }}-node-

	- name: Set up Node.js
	uses: actions/setup-node@v6
	with:
	node-version: ${{ env.NODE_VERSION }}

	- name: Determine dry run mode
	id: dry_run
	run: \|
	dry_run=true
	if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.dryRun }}" != "true" ]]; then
	dry_run=false
	elif [[ "${{ github.ref }}" == "refs/heads/${{ env.DEFAULT_BRANCH }}" ]]; then
	dry_run=false
	elif [[ "${{ github.ref }}" =~ ^refs/heads/v[0-9]+(\.[0-9]+)?$ ]]; then
	dry_run=false
	fi
	echo "dry_run=$dry_run" >> $GITHUB_OUTPUT

	- name: Semantic Release
	run: \|
	if [[ "${{ steps.dry_run.outputs.dry_run }}" == "true" ]]; then
	npx -p @semantic-release/changelog \
	-p @semantic-release/git \
	-p @semantic-release/github \
	-p conventional-changelog-conventionalcommits \
	-p semantic-release \
	semantic-release --dry-run
	else
	npx -p @semantic-release/changelog \
	-p @semantic-release/git \
	-p @semantic-release/github \
	-p conventional-changelog-conventionalcommits \
	-p semantic-release \
	semantic-release
	fi
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Check if new release was created
	id: check_release
	if: steps.dry_run.outputs.dry_run == 'false'
	run: \|
	# Fetch any new tags created by semantic-release
	git fetch --tags --force

	latest_tag=$(git describe --tags --abbrev=0 2>/dev/null \|\| echo "none")
	before_tag="${{ steps.before_release.outputs.latest_tag }}"

	if [[ "$latest_tag" != "$before_tag" && "$latest_tag" != "none" ]]; then
	echo "New release detected: $latest_tag"
	echo "new_release=true" >> $GITHUB_OUTPUT
	echo "release_tag=$latest_tag" >> $GITHUB_OUTPUT
	else
	echo "No new release was created"
	echo "new_release=false" >> $GITHUB_OUTPUT
	fi

	# Package & Publish (GoReleaser)
	package:
	needs: [release]
	if: needs.release.outputs.new_release == 'true'
	runs-on: ubuntu-latest
	timeout-minutes: 30
	permissions:
	contents: write
	packages: write
	id-token: write

	steps:
	- name: Checkout
	uses: actions/checkout@v6
	with:
	fetch-depth: 0
	ref: ${{ needs.release.outputs.release_tag }}

	- name: Set up Go
	uses: actions/setup-go@v6
	with:
	go-version: ${{ env.GO_VERSION }}

	- name: Cache Go modules
	uses: actions/cache@v5
	with:
	path: \|
	~/.cache/go-build
	~/go/pkg/mod
	key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
	restore-keys: \|
	${{ runner.os }}-go-

	# Docker Buildx for multi-arch images
	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v4

	# QEMU for cross-platform Docker builds (arm64, s390x, ppc64le)
	- name: Set up QEMU
	uses: docker/setup-qemu-action@v4
	with:
	platforms: linux/arm64,linux/s390x,linux/ppc64le

	# Login to GitHub Container Registry
	- name: Login to GHCR
	uses: docker/login-action@v4
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Install cosign for signing
	- name: Install Cosign
	uses: sigstore/cosign-installer@v3

	# Install syft for SBOM generation
	- name: Install Syft
	uses: anchore/sbom-action/download-syft@v0

	# Run GoReleaser
	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@v7
	with:
	distribution: goreleaser
	version: "~> v2"
	args: release --clean
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
	COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
	COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
	CHANGELOG_DISABLE: "true"

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update module github.com/ibm-hyper-protect/contract-go/v2 to v2.17.0 #320

Workflow file

fix(deps): update module github.com/ibm-hyper-protect/contract-go/v2 to v2.17.0 #320

Uh oh!

Workflow file for this run