From e854b457d79a9788ba5bccf7b845635fd250c5dc Mon Sep 17 00:00:00 2001 From: Hans Nielsen Date: Wed, 28 Oct 2026 21:09:23 -0700 Subject: [PATCH 1/4] ci: migrate checks to github actions --- .buildkite/docker-compose.yml | 8 ---- .buildkite/pipeline.yml | 51 -------------------------- .github/workflows/ci.yml | 43 ++++++++++++++++++++++ .buildkite/Dockerfile => Dockerfile.ci | 0 docker-compose.yml | 8 ++++ 5 files changed, 51 insertions(+), 59 deletions(-) delete mode 100644 .buildkite/docker-compose.yml delete mode 100644 .buildkite/pipeline.yml create mode 100644 .github/workflows/ci.yml rename .buildkite/Dockerfile => Dockerfile.ci (100%) create mode 100644 docker-compose.yml diff --git a/.buildkite/docker-compose.yml b/.buildkite/docker-compose.yml deleted file mode 100644 index 6a4fecd..0000000 --- a/.buildkite/docker-compose.yml +++ /dev/null @@ -1,8 +0,0 @@ -version: "3.8" -services: - ci: - volumes: - - ..:/src - build: - context: ../ - dockerfile: .buildkite/Dockerfile diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml deleted file mode 100644 index ff7af4d..0000000 --- a/.buildkite/pipeline.yml +++ /dev/null @@ -1,51 +0,0 @@ -agents: - queue: public - -env: - DOCKER_INLINE_CACHE: "1" - DOCKER_BUILDKIT: "1" - BUILDKIT_PROGRESS: plain - COMPOSE_FILE: .buildkite/docker-compose.yml - COMPOSE_DOCKER_CLI_BUILD: "1" - -steps: - - label: ":docker: Build" - plugins: - - docker-compose#v3.9.0: - build: ci - - - wait - - - name: tests - label: Tests - command: "make tests" - plugins: - - docker-compose#v3.9.0: - run: ci - - - name: Formatting - label: Formatting - command: "make clean-proto && make proto && make fmt && git diff --exit-code" - plugins: - - docker-compose#v3.9.0: - run: ci - - - name: gomod - label: "Make sure go.sum is up to date" - command: "go mod tidy && git diff --exit-code" - plugins: - - docker-compose#v3.9.0: - run: ci - - - name: lint - label: Lint - command: "make lint" - plugins: - - docker-compose#v3.9.0: - run: ci - - - name: Verify dependency licenses - command: "license_finder" - plugins: - - docker-compose#v3.9.0: - run: ci diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..845c66d --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,43 @@ +name: CI + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + checks: + name: ${{ matrix.name }} + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + include: + - name: Tests + command: make tests + - name: Formatting + command: make clean-proto && make proto && make fmt && git diff --exit-code + - name: go.mod tidy + command: go mod tidy && git diff --exit-code + - name: Lint + command: make lint + - name: Verify dependency licenses + command: license_finder + + env: + DOCKER_BUILDKIT: "1" + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + + - name: Run ${{ matrix.name }} + run: | + docker compose run --rm --build ci sh -c ' + git config --global --add safe.directory "$PWD" + + ${{ matrix.command }} + ' diff --git a/.buildkite/Dockerfile b/Dockerfile.ci similarity index 100% rename from .buildkite/Dockerfile rename to Dockerfile.ci diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..9631e2a --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,8 @@ +services: + ci: + build: + context: . + dockerfile: Dockerfile.ci + volumes: + - .:/src + working_dir: /src From 433d77999f3841ba9abea6f263153a8bc9ffc79c Mon Sep 17 00:00:00 2001 From: Hans Nielsen Date: Wed, 28 Oct 2026 21:13:18 -0700 Subject: [PATCH 2/4] ci: bump CI image to Go 1.26 for govulncheck --- Dockerfile.ci | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.ci b/Dockerfile.ci index 9c99113..51c045b 100644 --- a/Dockerfile.ci +++ b/Dockerfile.ci @@ -1,4 +1,4 @@ -FROM golang:1.24-bookworm +FROM golang:1.26-bookworm RUN apt-get update && apt-get upgrade -y && \ apt-get install -y ruby && gem install license_finder && \ From dec8df8e4c28561935ea5d7ec37be6bc342a0cac Mon Sep 17 00:00:00 2001 From: Hans Nielsen Date: Wed, 28 Oct 2026 21:20:43 -0700 Subject: [PATCH 3/4] Install protoc-gen-go-vtproto at the go.mod version --- Makefile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Makefile b/Makefile index 7752862..8824a27 100644 --- a/Makefile +++ b/Makefile @@ -27,8 +27,8 @@ TOOL_INSTALL := env GOBIN=$(PWD)/$(BIN) go install $(BIN)/protoc-gen-go: go.mod | $(BIN) $(TOOL_INSTALL) google.golang.org/protobuf/cmd/protoc-gen-go -$(BIN)/protoc-gen-go-vtproto: Makefile | $(BIN) - $(TOOL_INSTALL) github.com/planetscale/vtprotobuf/cmd/protoc-gen-go-vtproto@v0.6.0 +$(BIN)/protoc-gen-go-vtproto: go.mod | $(BIN) + $(TOOL_INSTALL) github.com/planetscale/vtprotobuf/cmd/protoc-gen-go-vtproto $(BIN)/protoc-gen-connect-go: go.mod | $(BIN) $(TOOL_INSTALL) connectrpc.com/connect/cmd/protoc-gen-connect-go From f3ae43ad723e7d986a91d4c5a545299ba8d0a321 Mon Sep 17 00:00:00 2001 From: Hans Nielsen Date: Thu, 29 Oct 2026 07:49:06 -0700 Subject: [PATCH 4/4] ci: add zizmor and fix its findings --- .github/workflows/ci.yml | 2 ++ .github/workflows/publish.yml | 5 +++++ .github/workflows/zizmor.yaml | 32 ++++++++++++++++++++++++++++++++ 3 files changed, 39 insertions(+) create mode 100644 .github/workflows/zizmor.yaml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 845c66d..46070dc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -33,6 +33,8 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Run ${{ matrix.name }} run: | diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 956e123..694164f 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -8,6 +8,9 @@ on: branches: - main +permissions: + contents: read + jobs: publish: name: publish buf module @@ -15,6 +18,8 @@ jobs: steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: setup go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml new file mode 100644 index 0000000..071cb53 --- /dev/null +++ b/.github/workflows/zizmor.yaml @@ -0,0 +1,32 @@ +name: zizmor + +on: + push: + branches: [ "main" ] + pull_request: + paths: + - '.github/**' + +permissions: + contents: read + actions: read + +jobs: + zizmor: + name: zizmor audit + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + inputs: . + persona: regular + version: "1.25.2" + # Fail the job directly instead of uploading SARIF to code scanning. + advanced-security: false + annotations: true