From 12f6c9da779bb1907a134d0ac80b608ada4e324e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirko=20K=C3=A4mpf?= Date: Sat, 11 Jul 2026 11:02:49 +0200 Subject: [PATCH 1/2] ci: bump GitHub Actions (checkout v7, configure-pages v6, upload-pages-artifact v5) Rolls up dependabot PRs #26/#27/#28 into one PR to avoid a 3-way docs.yml rebase cascade (all three touch the same workflow file). - actions/checkout v6 -> v7 (build-and-release.yml x2, security.yml, docs.yml) - actions/configure-pages v5 -> v6 (docs.yml) - actions/upload-pages-artifact v3 -> v5 (docs.yml) Co-Authored-By: Claude Opus 4.8 --- .github/workflows/build-and-release.yml | 4 ++-- .github/workflows/docs.yml | 6 +++--- .github/workflows/security.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml index 5bc7338..edc4d3f 100644 --- a/.github/workflows/build-and-release.yml +++ b/.github/workflows/build-and-release.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Set up Go uses: actions/setup-go@v6 @@ -71,7 +71,7 @@ jobs: id-token: write # Required for keyless cosign signing via GitHub OIDC steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: fetch-depth: 0 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index eb06991..2b41e40 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -24,10 +24,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Setup Pages - uses: actions/configure-pages@v5 + uses: actions/configure-pages@v6 - name: Build with Jekyll uses: actions/jekyll-build-pages@v1 @@ -36,7 +36,7 @@ jobs: destination: ./_site - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 deploy: environment: diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index e94b778..33b2e47 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -13,7 +13,7 @@ jobs: name: Vulnerability Scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v7 - uses: actions/setup-go@v6 with: From ddc0e7ad93ac5739a97822620f9f79384e2dc9d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Mirko=20K=C3=A4mpf?= Date: Sat, 11 Jul 2026 11:07:27 +0200 Subject: [PATCH 2/2] ci: pin Go 1.25.12 (fix govulncheck GO-2026-5856) Freshly-disclosed Go stdlib CVE GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls), found in crypto/tls@go1.25.11, fixed in go1.25.12. kshark's TLS probers call the affected path, so govulncheck exits 3 on go1.25.11. Pin the exact patch 1.25.12 (now in the actions/go-versions manifest) rather than the floating '1.25'. Deliberately NOT 1.26: golangci-lint v2.6.0 is built against the 1.25 toolchain and panics loading 1.26 packages (go/types crash, lint exit 2). 1.25.12 clears the CVE while keeping the pinned linter working. Bump both together when moving to 1.26. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/build-and-release.yml | 4 ++-- .github/workflows/security.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-and-release.yml b/.github/workflows/build-and-release.yml index edc4d3f..9372ff9 100644 --- a/.github/workflows/build-and-release.yml +++ b/.github/workflows/build-and-release.yml @@ -21,7 +21,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: '1.25' + go-version: '1.25.12' - name: Download dependencies run: go mod download @@ -78,7 +78,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v6 with: - go-version: '1.25' + go-version: '1.25.12' - name: Install cosign uses: sigstore/cosign-installer@v3 diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 33b2e47..e50d42e 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -17,7 +17,7 @@ jobs: - uses: actions/setup-go@v6 with: - go-version: '1.25' + go-version: '1.25.12' - name: Install govulncheck run: go install golang.org/x/vuln/cmd/govulncheck@latest