mirror of
https://github.com/lukaszraczylo/graphql-monitoring-proxy.git
synced 2026-10-12 05:32:36 +00:00
lukaszraczylo
4a68dcb00a
Builds used the go1.26.5 toolchain, whose standard library contained seven vulnerabilities that govulncheck reported as reachable (GO-2026-6218, GO-2026-6091, GO-2026-6090, GO-2026-6089, GO-2026-6088, GO-2026-5972, GO-2026-5026). This change pins the module toolchain to go1.26.6 and sets the CI Go version to 1.26.6, so every build compiles against the patched standard library. After the bump govulncheck reports zero vulnerabilities affecting the code. The go language directive stays at 1.25.0, so no language behaviour changes.
20 lines
370 B
YAML
20 lines
370 B
YAML
name: Autoupdate go.mod and go.sum
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 3 * * *"
|
|
|
|
permissions:
|
|
contents: write
|
|
actions: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
autoupdate:
|
|
uses: lukaszraczylo/shared-actions/.github/workflows/go-autoupdate.yaml@main
|
|
with:
|
|
go-version: ">=1.26.6"
|
|
release-workflow: "release.yaml"
|
|
secrets: inherit
|