Files
graphql-monitoring-proxy/.github/workflows/release.yaml
T
lukaszraczylo 4a68dcb00a fix(build): pin Go toolchain to 1.26.6 for standard-library CVE fixes
Builds used the go1.26.5 toolchain, whose standard library contained seven vulnerabilities that govulncheck reported as reachable (GO-2026-6218, GO-2026-6091, GO-2026-6090, GO-2026-6089, GO-2026-6088, GO-2026-5972, GO-2026-5026). This change pins the module toolchain to go1.26.6 and sets the CI Go version to 1.26.6, so every build compiles against the patched standard library. After the bump govulncheck reports zero vulnerabilities affecting the code. The go language directive stays at 1.25.0, so no language behaviour changes.
2026-08-17 19:45:26 +01:00

68 lines
1.6 KiB
YAML

name: Release
on:
workflow_dispatch:
push:
paths-ignore:
- "**.md"
- "**/release.yaml"
- "static/**"
- "docs/**"
branches:
- main
permissions:
id-token: write
contents: write
packages: write
deployments: write
jobs:
release:
uses: lukaszraczylo/shared-actions/.github/workflows/go-release.yaml@main
with:
go-version: "1.26.6"
docker-enabled: true
secrets: inherit
benchmark:
name: Publish Benchmarks
needs: release
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
token: ${{ secrets.GITHUB_TOKEN }}
ref: main
- name: Setup Go
uses: actions/setup-go@v5
with:
go-version: "1.26.6"
- name: Run benchmarks
run: go test -bench=. -benchmem ./... -run=^# | tee output.txt
- name: Store benchmark result
uses: benchmark-action/github-action-benchmark@v1
with:
tool: "go"
output-file-path: output.txt
fail-on-alert: true
github-token: ${{ secrets.GITHUB_TOKEN }}
comment-on-alert: true
summary-always: true
auto-push: false
benchmark-data-dir-path: "docs/bench"
- name: Push benchmark results
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git add docs/bench
git diff --staged --quiet || git commit -m "Update benchmark results"
git push origin main