Commit Graph

216 Commits

Author SHA1 Message Date
Azeem Shaikh
c73c5628ea
Fix GitHub workflows failing (#1172)
Co-authored-by: Azeem Shaikh <azeems@google.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
2021-10-28 18:42:55 +00:00
naveen
aa634bd251 🌱 Fixes the broken e2e
Fixes for broken e2e
2021-10-26 20:11:21 -05:00
naveen
fd238d0e40 🌱 Fix goreleaser permission and flags
Fixes goreleaser flags issue and sets specific permission for
goreleaser.
2021-10-26 16:32:05 -05:00
Batuhan Apaydın
6f1a43a0b6
🌱 add google/ko support for building/pusing container image (#1127)
* feat: add google/ko support for building/pusing container image

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>

* feat: updates according to reviews

Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2021-10-26 17:22:22 +00:00
dependabot[bot]
f38abc03be
🌱 Bump actions/checkout from 1 to 2.3.5 (#1137)
Bumps [actions/checkout](https://github.com/actions/checkout) from 1 to 2.3.5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v1...1e204e9a9253d643386038d443f96446fa156a97)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-10-19 19:28:58 +00:00
dependabot[bot]
b3874325f8
🌱 Bump goreleaser/goreleaser-action from 2.7.0 to 2.8.0 (#1136)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.7.0 to 2.8.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](5a54d7e660...5df302e5e9)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-10-18 15:23:28 +00:00
dependabot[bot]
a020b1632f 🌱 Bump crazy-max/ghaction-import-gpg from 4.0.0 to 4.1.0
Bumps [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) from 4.0.0 to 4.1.0.
- [Release notes](https://github.com/crazy-max/ghaction-import-gpg/releases)
- [Changelog](https://github.com/crazy-max/ghaction-import-gpg/blob/master/CHANGELOG.md)
- [Commits](8c43807e82...cb4264d331)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-import-gpg
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-10-18 08:05:46 -07:00
Naveen
aaa3512af7
🌱 Fix integration githubaction permissions (#985)
* Changed the integration GitHub action permissions to contents:read, pull-requests:write
2021-10-04 09:33:31 -05:00
dependabot[bot]
f63f07ddc5
🌱 Bump actions/github-script from 4.1.1 to 5 (#1067)
* 🌱 Bump actions/github-script from 4.1.1 to 5

Bumps [actions/github-script](https://github.com/actions/github-script) from 4.1.1 to 5.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](deb7ae927c...441359b1a3)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* Update integration.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
2021-10-01 03:57:43 +00:00
laurentsimon
e60bf03d91
disable PR (#1093) 2021-10-01 00:13:47 +00:00
laurentsimon
83bb5af0ef
fix (#1089) 2021-09-29 23:19:44 +00:00
laurentsimon
b4e0ee2fe8
Start support for action on PR (#1085)
* changes

* fix

* fix

* fix

* comment

* bug
2021-09-29 01:03:30 +00:00
laurentsimon
67a8e5f9f6
fix (#1080) 2021-09-28 15:49:29 +00:00
laurentsimon
676885f752
Add scorecard analysis for dogfooding (#1073)
* fix

* fix

* updates

* fix

* comments

* fix

* test comment
2021-09-27 23:13:29 +00:00
Azeem Shaikh
1d3f3e3e77
gpg-private-key in goreleaser (#1064)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-09-27 01:09:10 +00:00
dependabot[bot]
42e2b98a45 🌱 Bump actions/github-script from 4.1.0 to 4.1.1
Bumps [actions/github-script](https://github.com/actions/github-script) from 4.1.0 to 4.1.1.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](f891eff651...deb7ae927c)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-09-24 10:43:16 -05:00
naveen
1e4f7232e8 🌱 Fixes permission for main.yml action
https://github.com/ossf/scorecard/issues/942
2021-09-15 16:30:36 -05:00
Naveen
af24ed4d7f
🌱 Included codeql check for GitHub Actions (#988)
Included codeql check for GitHub actions https://github.com/ossf/scorecard/issues/987
2021-09-09 23:02:11 +00:00
Naveen
a3d63bf324
🌱 Updated actions permission for codeql (#964)
* Updated the actions permissions for codeql from write to specific
  settings. https://github.com/ossf/scorecard/issues/942
2021-09-07 08:52:14 -07:00
dependabot[bot]
942c4cfc25
🌱 Bump crazy-max/ghaction-import-gpg from 3.2.0 to 4 (#971)
Bumps [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) from 3.2.0 to 4.
- [Release notes](https://github.com/crazy-max/ghaction-import-gpg/releases)
- [Changelog](https://github.com/crazy-max/ghaction-import-gpg/blob/master/CHANGELOG.md)
- [Commits](1c6a9e9d35...8c43807e82)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-import-gpg
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-09-07 15:24:51 +00:00
Chris McGehee
29b7bd3885 Parsing GitHub Workflows should only happen on yaml files 2021-09-06 10:51:33 -05:00
dependabot[bot]
f55b86d662
🌱 Bump peter-evans/slash-command-dispatch from 2.2.1 to 2.3.0 (#955)
Bumps [peter-evans/slash-command-dispatch](https://github.com/peter-evans/slash-command-dispatch) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/peter-evans/slash-command-dispatch/releases)
- [Commits](fc430081ad...40877f718d)

---
updated-dependencies:
- dependency-name: peter-evans/slash-command-dispatch
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-09-03 16:39:23 +00:00
flying-cow
1434977ac0 :sparkling: Upgraded to go 1.17 2021-09-01 18:31:44 -04:00
naveen
50fd921680 🌱 Fix the dependabot settings 2021-08-26 14:29:12 -05:00
dependabot[bot]
f2afdba107 🌱 Bump actions/setup-go from 2.1.3 to 2.1.4
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 2.1.3 to 2.1.4.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](37335c7bb2...331ce1d993)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-08-26 10:56:13 -05:00
Azeem Shaikh
b89808ff8c
Pin protoc by SHA (#909)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-08-25 15:54:10 +00:00
Azeem Shaikh
cc30d54db2
Use arduino/setup-protoc for installing Protoc (#903)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-08-25 09:31:04 -04:00
dependabot[bot]
7bc2e00589
🌱 Bump peter-evans/find-comment from 1.2.0 to 1.3.0 (#893)
Bumps [peter-evans/find-comment](https://github.com/peter-evans/find-comment) from 1.2.0 to 1.3.0.
- [Release notes](https://github.com/peter-evans/find-comment/releases)
- [Commits](309ce798ba...d2dae40ed1)

---
updated-dependencies:
- dependency-name: peter-evans/find-comment
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-08-24 22:20:22 +00:00
laurentsimon
276155d1eb
SARIF 4: Add support to output SARIF format (#866)
* draft1

* draft2

* draft

* draft 3

* typos

* unit tests

* fixes

* fixes

* related locs

* fixes

* version

* fixes

* linter/fix

* fixes

* linter

* gofmt -s
2021-08-23 21:31:33 +00:00
dependabot[bot]
42700ee940 🌱 Bump actions/github-script from 4.0.2 to 4.1
Bumps [actions/github-script](https://github.com/actions/github-script) from 4.0.2 to 4.1.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](a3e7071a34...f891eff651)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-08-20 11:05:08 -05:00
Azeem Shaikh
6cc41359a9
Remove false log statement (#835)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-08-11 04:09:13 +00:00
dependabot[bot]
a2e34ede98 🌱 Bump crazy-max/ghaction-import-gpg from 3.1.0 to 3.2.0
Bumps [crazy-max/ghaction-import-gpg](https://github.com/crazy-max/ghaction-import-gpg) from 3.1.0 to 3.2.0.
- [Release notes](https://github.com/crazy-max/ghaction-import-gpg/releases)
- [Changelog](https://github.com/crazy-max/ghaction-import-gpg/blob/master/CHANGELOG.md)
- [Commits](b0793c0060...1c6a9e9d35)

---
updated-dependencies:
- dependency-name: crazy-max/ghaction-import-gpg
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2021-08-10 10:03:06 -05:00
naveen
ef9880c7b3 🌱 Implemented ignore for license check
The license check was updated with the ignore files.

Fixed the issue https://github.com/ossf/scorecard/issues/767
2021-08-09 16:09:01 -05:00
Appu
8534836923
Also add version info to goreleaser (#822)
- shared configuration generation in ./scripts/version-ldflags

Signed-off-by: Appu Goundan <appu@google.com>
2021-08-09 18:22:30 +00:00
Naveen
91d3d82348
🌱 Fix the protobuf GitHub runner issue (#801)
Fixes the protobuf GitHub runner issue by cloning the repository and
installing it locally.

Source  https://lukasjoswiak.com/github-actions-protobuf/
2021-08-02 23:52:57 +00:00
dependabot[bot]
a66b53ebe4
🌱 Bump peter-evans/slash-command-dispatch from 2.1.3 to 2.2.1 (#735)
Bumps [peter-evans/slash-command-dispatch](https://github.com/peter-evans/slash-command-dispatch) from 2.1.3 to 2.2.1.
- [Release notes](https://github.com/peter-evans/slash-command-dispatch/releases)
- [Commits](72ab5a2e41...fc430081ad)

---
updated-dependencies:
- dependency-name: peter-evans/slash-command-dispatch
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-07-31 11:12:20 +00:00
dependabot[bot]
564b10946f
🌱 Bump goreleaser/goreleaser-action from 2.6.1 to 2.7.0 (#762)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.6.1 to 2.7.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](ac067437f5...5a54d7e660)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-07-29 21:51:16 +00:00
Azeem Shaikh
851646d4db
Disable e2e tests temporarily (#785)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-07-29 19:39:39 +00:00
laurentsimon
492d9cd29b
disable license check (#784) 2021-07-29 19:30:26 +00:00
dependabot[bot]
428a4d659c
🌱 Bump actions/stale from 3.0.19 to 4 (#695)
Bumps [actions/stale](https://github.com/actions/stale) from 3.0.19 to 4.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](98ed4cb500...cdf15f641a)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-07-16 17:30:01 +00:00
naveen
a55d542e0d 🌱 Remove gitcache docker
Remove the gitcache docker image
2021-07-14 12:31:15 -05:00
naveen
219404e0b7 🌱 Removing gitcache
Removing gitcache
2021-07-13 01:03:21 -05:00
dependabot[bot]
18c3178a84
🌱 Bump codecov/codecov-action from 1.5.0 to 1.5.2 (#558)
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 1.5.0 to 1.5.2.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](a1ed4b322b...29386c70ef)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
2021-06-28 22:19:47 -07:00
naveen
6aefe1b6ac 🌱 Fix broken e2e tests
* Changed the path for the frozen deps to look for within the
.github/worworkflows path

* Included license check to tools.go

* Removed the hard reference to ginkgo within the integration.yml

* The above fixes will fix the broken tests for scorecard.

Repo: github.com/ossf/scorecard
Frozen-Deps: Fail 10
go modules found: go.mod
!! frozen-deps/fetch-execute - .github/workflows/integration.yml is fetching an non-pinned dependency 'go get github.com/onsi/ginkgo/ginkgo@v1.14.2'
!! frozen-deps/fetch-execute - .github/workflows/main.yml is fetching an non-pinned dependency 'go install github.com/google/addlicense@latest'
2021-06-28 15:28:10 -05:00
Naveen
d998d56112
🌱 Fixes GitHub workflow failures (#593)
The validate and the e2e are failing because of the bug in golang
https://github.com/golang/go/issues/44129

This fix is a temporary workaround.
2021-06-20 15:48:21 -04:00
naveen
e7ea1a2b88 🌱 Fixes the broken PR Verifier
Reverted to the original permission.
2021-06-10 12:31:21 -04:00
naveen
28b1db9267 🌱 Fixes write permissions for ok-to-test
Allowed write permissions to action for commenting on the status of the
PR.
2021-06-07 12:49:11 -04:00
dependabot[bot]
b04df4e256 🌱 Bump goreleaser/goreleaser-action from 2.6.0 to 2.6.1
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.6.0 to 2.6.1.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](70eb4e573c...ac067437f5)

Signed-off-by: dependabot[bot] <support@github.com>
2021-05-31 09:14:30 -04:00
dependabot[bot]
df44a898cf 🌱 Bump goreleaser/goreleaser-action from 2.5.0 to 2.6.0
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.5.0 to 2.6.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](5e15885530...70eb4e573c)

Signed-off-by: dependabot[bot] <support@github.com>
2021-05-27 15:55:27 -04:00
dependabot[bot]
947a075c7c
🌱 Bump github/codeql-action (#482)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from cb5810848de15b695cd9ef3b559dd178c43c7df3 to 1.0.0. This release includes the previously tagged commit.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](cb5810848d...bc2cbe3983)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-05-26 16:10:12 +00:00
dependabot[bot]
90e1aeb7ec
🌱 Bump actions/stale from 3.0.18 to 3.0.19 (#470)
Bumps [actions/stale](https://github.com/actions/stale) from 3.0.18 to 3.0.19.
- [Release notes](https://github.com/actions/stale/releases)
- [Commits](3b3c3f03cd...98ed4cb500)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-05-18 10:47:18 -04:00
laurentsimon
6367cc44f6
pin scorecard workflow depepdencies by hash (#456) 2021-05-14 16:59:05 -07:00
dependabot[bot]
53262f0368 🌱 Bump codecov/codecov-action from 1 to 1.5.0
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 1 to 1.5.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v1...v1.5.0)

Signed-off-by: dependabot[bot] <support@github.com>
2021-05-12 10:38:27 -05:00
dependabot[bot]
33c1e903a4 🌱 Bump actions/checkout from 2 to 2.3.4
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 2.3.4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v2.3.4)

Signed-off-by: dependabot[bot] <support@github.com>
2021-05-12 10:26:18 -05:00
dependabot[bot]
dd6c652db6 🌱 Bump actions/stale from 3 to 3.0.18
Bumps [actions/stale](https://github.com/actions/stale) from 3 to 3.0.18.
- [Release notes](https://github.com/actions/stale/releases)
- [Commits](https://github.com/actions/stale/compare/v3...v3.0.18)

Signed-off-by: dependabot[bot] <support@github.com>
2021-05-12 09:34:55 -05:00
dependabot[bot]
775a36a393 🌱 Bump peter-evans/create-or-update-comment from 1 to 1.4.5
Bumps [peter-evans/create-or-update-comment](https://github.com/peter-evans/create-or-update-comment) from 1 to 1.4.5.
- [Release notes](https://github.com/peter-evans/create-or-update-comment/releases)
- [Commits](https://github.com/peter-evans/create-or-update-comment/compare/v1...v1.4.5)

Signed-off-by: dependabot[bot] <support@github.com>
2021-05-12 09:30:11 -05:00
dependabot[bot]
35b62a9905
🌱 Bump peter-evans/find-comment from 1 to 1.2.0 (#439)
Bumps [peter-evans/find-comment](https://github.com/peter-evans/find-comment) from 1 to 1.2.0.
- [Release notes](https://github.com/peter-evans/find-comment/releases)
- [Commits](https://github.com/peter-evans/find-comment/compare/v1...v1.2.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-05-12 13:29:05 +00:00
dependabot[bot]
9478fe3147
🌱 Bump goreleaser/goreleaser-action from 2 to 2.5.0 (#441)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2 to 2.5.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Changelog](https://github.com/goreleaser/goreleaser-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/goreleaser/goreleaser-action/compare/v2...v2.5.0)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-05-12 09:24:03 -04:00
Naveen
14dfc45fae
🌱 Move the docker containers to gcr.io (#419)
* Included a build on push to master on gcr.io
  * Updated the README with the gcr.io
  * Removed the docker.yaml build push
2021-05-11 14:11:06 +00:00
dependabot[bot]
c1ef0900f2
🌱 Bump google-github-actions/setup-gcloud from 94337306dda8180d967a56932ceb4ddcf01edae7 to 0.2.1 (#425)
* 🌱 Bump google-github-actions/setup-gcloud

Bumps [google-github-actions/setup-gcloud](https://github.com/google-github-actions/setup-gcloud) from 94337306dda8180d967a56932ceb4ddcf01edae7 to 0.2.1. This release includes the previously tagged commit.
- [Release notes](https://github.com/google-github-actions/setup-gcloud/releases)
- [Changelog](https://github.com/google-github-actions/setup-gcloud/blob/master/CHANGELOG.md)
- [Commits](94337306dd...daadedc81d)

Signed-off-by: dependabot[bot] <support@github.com>

* Update integration.yml

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Abhishek Arya <inferno@chromium.org>
2021-05-10 08:20:31 -07:00
naveen
a4768922a9 🌱 Removed the trivy scan
* Removed container  using trivy as it is in gcr.io
2021-05-08 17:47:49 -05:00
laurentsimon
82d6c171bc
🐛 Pin workflow dependencies (#417)
* pin workflow dependencies

* comments

Co-authored-by: Abhishek Arya <inferno@chromium.org>
2021-05-07 18:35:57 -07:00
naveen
cd7231dd75 🌱 Cleanup dependabot config 2021-04-29 17:10:24 -05:00
naveen
a64426e369 🌱 Remove synk
Removing synk as per our discussion.
2021-04-29 12:32:21 -05:00
naveen
da2e7029c7 🌱 Update golangci version to 1.39
* Upgrade the golangci version to 1.39
* Changed the checkout depth
  https://github.com/golangci/golangci-lint/issues/1088#issuecomment-801540792
2021-04-29 08:24:41 -05:00
naveen
872e9139d8 🐛 docker build for gitcache
* Fixed docker build for git cache
2021-04-26 10:01:50 -05:00
dependabot[bot]
bdf86e00c8 🌱 Bump actions/github-script from v3 to v4.0.2
Bumps [actions/github-script](https://github.com/actions/github-script) from v3 to v4.0.2.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v3...a3e7071a34d7e1f219a8a4de9a5e0a34d1ee1293)

Signed-off-by: dependabot[bot] <support@github.com>
2021-04-26 08:30:49 -05:00
naveen
3d24435ba8 🌱 Fixing the docker build issue 2021-04-23 15:17:42 -04:00
Naveen
760e01fbb8 Revert "🌱 Bump actions/github-script from v3 to v4.0.1"
This reverts commit 3ad35e3661.
2021-04-23 11:53:17 -04:00
dependabot[bot]
3ad35e3661 🌱 Bump actions/github-script from v3 to v4.0.1
Bumps [actions/github-script](https://github.com/actions/github-script) from v3 to v4.0.1.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/v3...85e88a66eaa831097093a3d278536947f2984d20)

Signed-off-by: dependabot[bot] <support@github.com>
2021-04-22 08:37:01 -04:00
naveen
c2236f68f8 🌱 Updated commit message for dependabot
* Updated commit message to have 🌱 prefix in dependabot PR.
2021-04-08 14:13:44 -05:00
nathannaveen
f5185e4bd6 🌱 included copyright headers. 2021-04-01 21:36:10 -05:00
Naveen
3e4432ceea Update PULL_REQUEST_TEMPLATE.md 2021-03-24 17:11:02 -04:00
naveen
775a83a2f7 🌱 update dependabot for cron and scripts
The cron and scripts are based on go.mod. The dependabot settings are
updated to watch those folders.
2021-03-22 11:50:01 -04:00
naveen
8427362772 🌱 verifier to generate release notes
The verifier helps release notes generation.
https://github.com/kubernetes-sigs/kubebuilder-release-tools

https://github.com/kubernetes-sigs/kubebuilder-release-tools/blob/master/verify/main.go
2021-03-18 12:19:06 -04:00
naveen
88de2df279 Feat-Use synk to check cron-job security settings
Use synk to check for cron-job yaml for secuity misconfiguration.
2021-03-12 21:03:29 -05:00
naveen
3489c83404 Feat - Include synk check for k8s yaml
Synk has set of rules to validate the k8s yaml for insecure
configuration.

This action will validate the k8s yaml for insecure configuration.
2021-03-12 20:56:00 -05:00
naveen
248fda288e Fix - docker builds for scorecard cron
Fixed the docker build for scorecard cron and as well as updated the
integration to test for the docker builds.
2021-03-05 13:14:33 -05:00
naveen
abb06c9dbc feat- Reorganize the code structure
Reorganize the code structure for testing and maintenance.

Feat - Included http endpoint
2021-03-04 19:08:47 -05:00
Naveen
c5528dba94
Update issue templates (#235) 2021-03-04 03:30:32 +00:00
Naveen
3e979657bf
Implemented docker for gitcache (#231)
* Implemented caching the git folder instead of just a branch.
Implemented logging.
Refactored code.

* Feat - Implemented docker for gitcache
2021-03-04 03:22:17 +00:00
Naveen
b4c2e4fd13
feat - migrate to go 1.16 (#233)
Upgrade to go version 1.16
2021-03-03 18:56:29 +00:00
Naveen
f0ff62d9eb
Feat - Included dependabot for gitcache (#232) 2021-03-02 16:51:04 -08:00
naveen
7b192a0243 feat - Included tests for disk cache
Included tests for disk cache.
Cleaned up tests.
2021-02-26 15:46:21 -05:00
naveen
6f2a0f43f4 Fix - Output path for the test runs 2021-02-25 15:59:39 -05:00
naveen
a7174d8ad7 Feature - Include e2e tests for docker
Included e2e tests for docker.
Included .Dockerignore to ignore files.
Included Docker build in the Makefile.
2021-02-25 11:02:45 -05:00
naveen
cab29a2747 Feat- Use cloud buckets for caching
Use cloud buckets for httpcache.

The implementation uses https://github.com/google/go-cloud for it to be
cloud vendor agnostic.
2021-02-24 11:17:50 -05:00
Naveen
79170187a2
Feat- Included dependabot for docker (#213) 2021-02-23 07:34:12 -08:00
Naveen
e0a02567fb
Fix - Cleanup the makefile targets (#207) 2021-02-21 23:35:39 +00:00
naveen
5018c5012c Fix - GitHub bot message URL for ok-to-test
Fixed the incorrect URL to the ok-to-test bot message
2021-02-19 14:04:24 -05:00
dependabot[bot]
030ab1dbc5 Bump peter-evans/slash-command-dispatch from v1 to v2.1.3
Bumps [peter-evans/slash-command-dispatch](https://github.com/peter-evans/slash-command-dispatch) from v1 to v2.1.3.
- [Release notes](https://github.com/peter-evans/slash-command-dispatch/releases)
- [Commits](https://github.com/peter-evans/slash-command-dispatch/compare/v1...72ab5a2e417e454aa8e89c43b28e36fe331e00a5)

Signed-off-by: dependabot[bot] <support@github.com>
2021-02-19 08:28:45 -05:00
naveen
1e93904a66 Fix - Remove the app reference for the slash token 2021-02-18 16:14:12 -05:00
naveen
9b4b8be7e0 Feature - ok-to-test in github action 2021-02-18 15:45:55 -05:00
naveen
f906f3f568 Feature - sign releases 2021-02-17 17:53:41 -05:00
naveen
ef4c8d0758 Fix - refactor the lint in the actions 2021-02-16 15:59:50 -05:00
naveen
51f017b206 Fix - ignore empty github token 2021-02-16 14:35:22 -05:00
naveen
db7bfcf342 Fix - golanglint-ci report only new issues 2021-02-16 14:23:03 -05:00
naveen
ce8e1e79ea Feature - Include additional linters for golangci
Included additional linters for golangci. The new linters would be
reported existing issues.
2021-02-16 14:06:59 -05:00
dependabot[bot]
64660915d6 Bump golangci/golangci-lint-action from v2 to v2.4.0
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from v2 to v2.4.0.
- [Release notes](https://github.com/golangci/golangci-lint-action/releases)
- [Commits](https://github.com/golangci/golangci-lint-action/compare/v2...544d2efb307b3f205f34886f2787046abe7fb26e)

Signed-off-by: dependabot[bot] <support@github.com>
2021-02-15 08:48:59 -05:00
naveen
af2132e927 Fix- e2e tests to include the executable
Included e2e tests for the executable with JSON
2021-02-14 11:46:17 -05:00
naveen
cb7ee064b9 Feature - container scanning for scorecard 2021-02-12 17:01:58 -05:00
naveen
0b85e7e2e8 Fix - docker latest image 2021-02-11 16:32:07 -05:00
naveen
6dd3698be8 Fix - Fixes the e2e tests for PR's 2021-02-10 16:07:03 -05:00
naveen
7e158f80e5 Docker releases to GitHub Docker registry
This will release docker container to GitHub docker registry.
2021-02-09 10:54:01 -05:00
naveen
7ab314db7d Fix - dependabot githubactions location 2021-02-06 14:22:06 -05:00
naveen
bcf8d0df92 Fix - dependabot yaml error 2021-02-06 12:49:11 -05:00
naveen
4ad4a4204b Feature - enabled dependabot for githubactions 2021-02-06 12:33:46 -05:00
naveen
2a1463b315 Feature - Report codecoverage to codecov.io 2021-01-26 17:49:11 -05:00
naveen
c4c99cd676 feature - Included the e2e into the PR workflows
Validated the presence of the GITHU_AUTH_TOKEN variable presence before running the e2e.

Update the contributing doc with scopes of the personal access token.

Updated the workflow to include the e2e tests.
2021-01-13 13:04:22 -05:00
naveen
91bfea5c2f feat - Close stale issues
Close stale issues.
2021-01-12 18:19:10 -05:00
Naveen
1700c3a348
feature - Pull request template (#127)
A standard pull request template
2021-01-08 11:36:05 -08:00
Naveen
9d4e5c0731
feature - CODEOWNERS for github branch protection feature (#123)
Included the codeowners for enabling branch protection "Require review from Code Owners"

Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-01-05 12:53:35 -08:00
Naveen
b216a1e494
Feat - implemented goreleaser for releases (#117)
Implemented goreleaser for releasing the code to github.

Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
2021-01-04 07:36:56 -06:00
Naveen
3df1191f7f
Create Dependabot config file (#116)
Co-authored-by: dependabot-preview[bot] <27856297+dependabot-preview[bot]@users.noreply.github.com>
2021-01-01 14:32:06 -06:00
naveen
a56f707350 Feat - Implemented Makefile and actions for PR
Implemented Makefile and actions for PR and push to validate fmt, go mod
tidy , go build and go test
2020-12-22 16:51:24 -05:00
Naveen
6549eccacc
Create codeql-analysis.yml (#101) 2020-12-22 07:27:02 -06:00