Bump dependencies, restrict workflow permissions and update actions - #63
Merged
Merged
Conversation
go-dockerclient to v1.13.2, lgr to v0.12.4, testify to v1.12.1, and the transitive moby, logrus and x/sys modules along with them.
The workflow declared no permissions, so every job ran with the repository default token scope. A top-level read-only scope is enough: both registry logins use dedicated secrets, and the artifacts are exchanged inside a single run. Empty branches and tags filters are spelled out as "**" so actionlint stops flagging them; the set of triggering refs does not change.
Coverage Report for CI Build 32346308389Coverage remained the same at 79.226%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsNo coverage regressions found. Coverage Stats
💛 - Coveralls |
umputun
approved these changes
Aug 20, 2026
This was referenced Aug 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine maintenance, no functional changes.
Dependencies. go-dockerclient to v1.13.2, lgr to v0.12.4, testify to v1.12.1, with the transitive moby, logrus and
golang.org/x/sysmodules moving along with them;go mod tidyandgo mod vendorwere run afterwards. This supersedes #61, which bumpsmoby/moby/v2to beta.14 while this branch takes it to beta.21. Thegodirective stays at 1.26 and the workflow Go version already matches it.Workflow permissions.
.github/workflows/ci.ymldeclared nopermissionsblock, so every job ran with whatever the repository default token scope is. Added a top-levelcontents: read, which covers all three jobs: both registry logins usePKG_TOKENandDOCKER_HUB_TOKENrather than the workflow token, coveralls only needs the token to identify the repository, and the digest artifacts are exchanged within a single run, which uses the runtime token rather thanGITHUB_TOKEN.Action versions. checkout v6 to v7, setup-go v6 to v7, upload-artifact v6 to v7, download-artifact v7 to v8, docker/setup-buildx-action v3 to v4, docker/login-action v3 to v4, docker/build-push-action v6 to v7. The docker majors switch the default runtime to Node 24 and drop deprecated inputs which this workflow does not use; download-artifact v8 now errors on a hash mismatch and checks the content type before unzipping, which suits the digest artifacts here.
The empty
branches:andtags:filters underpush:are now spelled out as["**"]. An empty value already means "match everything", so the set of triggering refs is unchanged, this only stops actionlint from reporting them as empty strings.