From 3d474bf5591137cde6f985911440c3f439108e59 Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:09:46 -0500 Subject: [PATCH 1/9] Run CI on Ubuntu 26.04 --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7a50095..1a7ee26 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -14,7 +14,7 @@ permissions: jobs: test: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - name: Checkout uses: actions/checkout@v7 From 29996ea75de392260d872690bfbf080a9f928c03 Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:10:48 -0500 Subject: [PATCH 2/9] Pin Go version to 1.27.1 --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 1a7ee26..d1c91f9 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -24,7 +24,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v7 with: - go-version: 'stable' + go-version: '1.27.1' - name: Build run: go build -v ./... From 1f849a568dfff5b673a6f54c14dbe22b4bc8fa66 Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:12:11 -0500 Subject: [PATCH 3/9] Upgrade golangci-lint to v2.13.2 --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d1c91f9..25a791a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -35,7 +35,7 @@ jobs: - name: Lint uses: golangci/golangci-lint-action@v9 with: - version: v2.12.2 + version: v2.13.2 - name: Vendorcheck shell: bash From 4f18bc02a9df5c3fd3527085f99e0692c9045b6c Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:12:51 -0500 Subject: [PATCH 4/9] Pin third-party actions to git SHAs --- .github/workflows/test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 25a791a..7bbea0f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -17,12 +17,12 @@ jobs: runs-on: ubuntu-26.04 steps: - name: Checkout - uses: actions/checkout@v7 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Set up Go - uses: actions/setup-go@v7 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: go-version: '1.27.1' @@ -33,7 +33,7 @@ jobs: run: go test -v ./... - name: Lint - uses: golangci/golangci-lint-action@v9 + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 with: version: v2.13.2 From 6c970eddcccc147efc872fa1b2797ffc79897a5e Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:45:32 -0500 Subject: [PATCH 5/9] Fix hard-coded filesystem type assumption in tests --- cmd/sunlight-secretmanager/filesystem_test.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/cmd/sunlight-secretmanager/filesystem_test.go b/cmd/sunlight-secretmanager/filesystem_test.go index bebafe9..2a85a01 100644 --- a/cmd/sunlight-secretmanager/filesystem_test.go +++ b/cmd/sunlight-secretmanager/filesystem_test.go @@ -4,6 +4,7 @@ import ( "os" "path/filepath" "strings" + "syscall" "testing" ) @@ -21,6 +22,13 @@ func TestWriteFile(t *testing.T) { t.Fatalf("failed to close test setup file: %s", err) } + // Get the FS type of the tempdir, which may vary between environments + var statfs syscall.Statfs_t + err = syscall.Statfs(tempDir, &statfs) + if err != nil { + t.Fatalf("failed to get filesystem info for test temp dir: %s", err) + } + for _, tc := range []struct { name string path string @@ -42,7 +50,7 @@ func TestWriteFile(t *testing.T) { { name: "happy path", path: filepath.Join(tempDir, "happy"), - fsType: 61267, // The statfs.Type for a normal unix filesystem + fsType: statfs.Type, // Whatever filesystem the test temp dir is on wantErr: "", }, } { From a77a403e1f255d2a5bacd0d9b16c26d7369812e0 Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:58:59 -0500 Subject: [PATCH 6/9] golangci-lint complained about cyclomatic complexity... --- cmd/sunlight-secretmanager/filesystem_test.go | 21 +++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/cmd/sunlight-secretmanager/filesystem_test.go b/cmd/sunlight-secretmanager/filesystem_test.go index 2a85a01..58bb5fe 100644 --- a/cmd/sunlight-secretmanager/filesystem_test.go +++ b/cmd/sunlight-secretmanager/filesystem_test.go @@ -23,11 +23,7 @@ func TestWriteFile(t *testing.T) { } // Get the FS type of the tempdir, which may vary between environments - var statfs syscall.Statfs_t - err = syscall.Statfs(tempDir, &statfs) - if err != nil { - t.Fatalf("failed to get filesystem info for test temp dir: %s", err) - } + tempDirFSType := filesystemType(t, tempDir) for _, tc := range []struct { name string @@ -50,7 +46,7 @@ func TestWriteFile(t *testing.T) { { name: "happy path", path: filepath.Join(tempDir, "happy"), - fsType: statfs.Type, // Whatever filesystem the test temp dir is on + fsType: tempDirFSType, // Whatever filesystem the test temp dir is on wantErr: "", }, } { @@ -82,3 +78,16 @@ func TestWriteFile(t *testing.T) { }) } } + +// filesystemType returns the statfs.Type of the filesystem containing path. +func filesystemType(t *testing.T, path string) int64 { + t.Helper() + + var statfs syscall.Statfs_t + err := syscall.Statfs(path, &statfs) + if err != nil { + t.Fatalf("failed to get filesystem info for %q: %s", path, err) + } + + return statfs.Type +} From 625fff217ecbadc9b38d479ea32db11d93035856 Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 15:59:30 -0500 Subject: [PATCH 7/9] Disable unwanted linters from golangci-lint --- .golangci.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.golangci.yaml b/.golangci.yaml index c5eec0e..4b4352c 100644 --- a/.golangci.yaml +++ b/.golangci.yaml @@ -5,7 +5,9 @@ linters: - depguard - err113 - exhaustruct + - exhaustruct_v5 - goconst + - gomodguard # deprecated; gomodguard_v2 is enabled instead - lll - musttag - wsl From d85d1eecf4d699083182b92fa1b906590d7b769a Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 16:15:46 -0500 Subject: [PATCH 8/9] Add separate linting-specific workflow with zizmor check --- .github/workflows/lint.yml | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 .github/workflows/lint.yml diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..84d5b8d --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,31 @@ +name: Linting + +on: + push: + branches: + - 'main' + pull_request: + branches: + - '**' + workflow_dispatch: + +permissions: {} + +jobs: + lint: + runs-on: ubuntu-24.04 + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4 + with: + # Fail the check on findings and annotate them inline, rather than + # uploading SARIF to code scanning (which never fails the check). + advanced-security: false + annotations: true From 11971a423daecc508626dc2cc33b6624530dc4d5 Mon Sep 17 00:00:00 2001 From: Preston Locke Date: Wed, 23 Sep 2026 16:16:37 -0500 Subject: [PATCH 9/9] Add 7-day dependabot cooldown per zizmor recommendation --- .github/dependabot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ccf6985..9f3237a 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,8 @@ updates: directory: "/" schedule: interval: monthly + cooldown: + default-days: 7 groups: go-dependencies: patterns: @@ -13,6 +15,8 @@ updates: directory: "/" schedule: interval: monthly + cooldown: + default-days: 7 groups: github-actions-dependencies: patterns: