chore(deps): update docker-images #1119
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2026 Phillip Cloud | |
| # Licensed under the Apache License, Version 2.0 | |
| name: Lint | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| changes: | |
| name: Detect Changes | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| outputs: | |
| go: ${{ steps.detect.outputs.go }} | |
| ci: ${{ steps.detect.outputs.ci }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| deploy-on-self-hosted-vm: true | |
| egress-policy: block | |
| disable-telemetry: true | |
| disable-sudo-and-containers: true | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| sparse-checkout: .github/detect-ci-changes.bash | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - name: Check for changes | |
| id: detect | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| HEAD_SHA: ${{ github.sha }} | |
| run: | | |
| bash .github/detect-ci-changes.bash \ | |
| "$EVENT_NAME" "$PR_NUMBER" "$BEFORE_SHA" "$HEAD_SHA" >> "$GITHUB_OUTPUT" | |
| deadcode: | |
| name: Dead Code | |
| needs: changes | |
| if: needs.changes.outputs.go == 'true' | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| concurrency: | |
| group: lint-deadcode-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| CGO_ENABLED: "0" | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| deploy-on-self-hosted-vm: true | |
| egress-policy: block | |
| disable-telemetry: true | |
| disable-sudo-and-containers: true | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| proxy.golang.org:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: "1.26" | |
| - name: Install deadcode | |
| run: go install golang.org/x/tools/cmd/deadcode@v0.43.0 | |
| - name: Run deadcode | |
| run: | | |
| output=$(deadcode -test ./...) | |
| if [ -n "$output" ]; then | |
| echo "$output" | |
| exit 1 | |
| fi | |
| golangci-lint: | |
| name: Lint | |
| needs: changes | |
| if: needs.changes.outputs.go == 'true' | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| concurrency: | |
| group: lint-golangci-lint-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| CGO_ENABLED: "0" | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| deploy-on-self-hosted-vm: true | |
| egress-policy: block | |
| disable-telemetry: true | |
| disable-sudo-and-containers: true | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| golangci-lint.run:443 | |
| objects.githubusercontent.com:443 | |
| proxy.golang.org:443 | |
| raw.githubusercontent.com:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: "1.26" | |
| - name: Run golangci-lint | |
| uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1 | |
| pre-commit: | |
| name: Pre-commit | |
| needs: changes | |
| if: needs.changes.outputs.ci == 'true' | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| concurrency: | |
| group: lint-pre-commit-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| deploy-on-self-hosted-vm: true | |
| egress-policy: block | |
| disable-telemetry: true | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| cache.nixos.org:443 | |
| github.com:443 | |
| proxy.golang.org:443 | |
| releases.nixos.org:443 | |
| storage.googleapis.com:443 | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| - name: Run pre-commit hooks | |
| env: | |
| BASE_REF: ${{ github.base_ref || 'main' }} | |
| run: nix run '.#pre-commit' -- --from-ref "origin/$BASE_REF" --to-ref HEAD | |
| nilaway: | |
| name: NilAway | |
| needs: changes | |
| if: needs.changes.outputs.go == 'true' | |
| runs-on: blacksmith-4vcpu-ubuntu-2404 | |
| concurrency: | |
| group: lint-nilaway-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| CGO_ENABLED: "0" | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| deploy-on-self-hosted-vm: true | |
| egress-policy: block | |
| disable-telemetry: true | |
| disable-sudo-and-containers: true | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| go.dev:443 | |
| proxy.golang.org:443 | |
| release-assets.githubusercontent.com:443 | |
| storage.googleapis.com:443 | |
| sum.golang.org:443 | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0 | |
| with: | |
| go-version: "1.26" | |
| - name: Run nilaway | |
| run: go run go.uber.org/nilaway/cmd/nilaway@v0.0.0-20260318203545-ad240b12fb4c -include-pkgs "github.com/micasa-dev/micasa" -exclude-test-files ./... | |
| result: | |
| name: Lint Result | |
| if: always() | |
| needs: [changes, deadcode, golangci-lint, nilaway, pre-commit] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: block | |
| disable-telemetry: true | |
| disable-sudo-and-containers: true | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| - run: exit 1 | |
| if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') |