From bc5a398577175c2222848260dc7e22b9cd20ed8b Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Wed, 9 Sep 2026 10:12:30 -0400 Subject: [PATCH 1/2] chore(deps): Upgrade golang to 1.26.7 Should fix several golang CVEs. Co-Authored-By: Claude Opus 4.8 (1M context) --- .tool-versions | 2 +- Dockerfile | 2 +- Dockerfile.dist | 2 +- acceptance/go.mod | 2 +- go.mod | 2 +- tools/go.mod | 2 +- tools/kubectl/go.mod | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.tool-versions b/.tool-versions index 5bc54b156..93fe5c1b5 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1 +1 @@ -golang 1.26.4 +golang 1.26.7 diff --git a/Dockerfile b/Dockerfile index ec621dc45..8dfc23c48 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ ## Build -FROM docker.io/library/golang:1.26.4 AS build +FROM docker.io/library/golang:1.26.7 AS build ARG TARGETOS ARG TARGETARCH diff --git a/Dockerfile.dist b/Dockerfile.dist index 32a04a137..44949a763 100644 --- a/Dockerfile.dist +++ b/Dockerfile.dist @@ -16,7 +16,7 @@ ## Build -FROM registry.access.redhat.com/ubi9/go-toolset:1.26.4@sha256:9748bb0b8e3376e9b155a4db3fbdfbfd20057b449ea9b3aed367b2f967cdfe1b AS build +FROM registry.access.redhat.com/ubi9/go-toolset:1.26.7@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21 AS build ARG TARGETOS ARG TARGETARCH diff --git a/acceptance/go.mod b/acceptance/go.mod index b2a49dfb1..23d350ed7 100644 --- a/acceptance/go.mod +++ b/acceptance/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/acceptance -go 1.26.4 +go 1.26.7 require ( cuelang.org/go v0.15.1 diff --git a/go.mod b/go.mod index 205292176..a7992e4f8 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli -go 1.26.4 +go 1.26.7 require ( cuelang.org/go v0.16.0 diff --git a/tools/go.mod b/tools/go.mod index c807869c5..249a5f769 100644 --- a/tools/go.mod +++ b/tools/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/tools -go 1.26.4 +go 1.26.7 require ( github.com/daixiang0/gci v0.13.7 diff --git a/tools/kubectl/go.mod b/tools/kubectl/go.mod index 723cabcbb..ebf3803de 100644 --- a/tools/kubectl/go.mod +++ b/tools/kubectl/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/tools/kubectl -go 1.26.4 +go 1.26.7 require k8s.io/kubernetes v1.34.3 From d536863bbc7eee43f8bfe8a321ddf5ecf99cd55c Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Wed, 9 Sep 2026 11:25:36 -0400 Subject: [PATCH 2/2] ci: Pin GitHub Actions to commit SHAs Back-ports the action pinning from main (2979d838) and pins the remaining unpinned action per stricter GitHub policies: - conforma/github-workflows auto-merge and golang-version-check pinned to e049ae95 (main) - jlumbroso/free-disk-space pinned to 54081f13 (v1.3.1), matching main Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/auto-merge.yaml | 2 +- .github/workflows/checks-codecov.yaml | 2 +- .github/workflows/release.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml index bd7ad08cf..ea19c33d8 100644 --- a/.github/workflows/auto-merge.yaml +++ b/.github/workflows/auto-merge.yaml @@ -22,7 +22,7 @@ name: 'Auto merge' jobs: auto-merge: - uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@main + uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@e049ae95d6a78c4665e88efa667981184394e913 # main secrets: inherit permissions: pull-requests: write diff --git a/.github/workflows/checks-codecov.yaml b/.github/workflows/checks-codecov.yaml index ce25adc51..2983b889d 100644 --- a/.github/workflows/checks-codecov.yaml +++ b/.github/workflows/checks-codecov.yaml @@ -61,7 +61,7 @@ jobs: cache: false - name: Check go versions - uses: conforma/github-workflows/golang-version-check@main + uses: conforma/github-workflows/golang-version-check@e049ae95d6a78c4665e88efa667981184394e913 # main - name: Show git sha and commit subject run: git log --oneline -n1 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 94d84b87b..10caf4e21 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -73,7 +73,7 @@ jobs: # disable-telemetry: true - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 with: docker-images: false swap-storage: false