OSV scalibr interface

.github/workflows/checks.yml

@@ -20,8 +20,6 @@ on:
  pull_request:
  # The branches below must be a subset of the branches above
  branches: [main]
- merge_group:
- branches: [main]
 
 concurrency:
  # Pushing new changes to a branch will cancel any in-progress CI runs
@@ -68,7 +66,7 @@ jobs:
  - name: Set up Go
  uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
  with:
- go-version-file: .go-version
+ go-version: stable
  check-latest: true
  - name: Run lint action
  uses: ./.github/workflows/lint-action
@@ -82,7 +80,7 @@ jobs:
  with:
  persist-credentials: false
  - run: scripts/build_test_images.sh
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
  path: internal/image/fixtures/*.tar
@@ -110,7 +108,7 @@ jobs:
  - name: Set up Go
  uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
  with:
- go-version-file: .go-version
+ go-version: stable
  check-latest: true
  - name: Run test action
  uses: ./.github/workflows/test-action

.github/workflows/codeql-analysis.yml

@@ -17,8 +17,6 @@ on:
  pull_request:
  # The branches below must be a subset of the branches above
  branches: [main]
- merge_group:
- branches: [main]
 
 # Restrict jobs in this workflow to have no permissions by default; permissions
 # should be granted per job as needed using a dedicated `permissions` block
@@ -50,7 +48,7 @@ jobs:
  go-version-file: go.mod
  # Initializes the CodeQL tools for scanning.
  - name: Initialize CodeQL
- uses: github/codeql-action/init@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+ uses: github/codeql-action/init@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
  with:
  languages: ${{ matrix.language }}
  # If you wish to specify custom queries, you can do so here or in a config file.
@@ -61,7 +59,7 @@ jobs:
  # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
  # If this step fails, then you should remove it and run the build manually (see below)
  - name: Autobuild
- uses: github/codeql-action/autobuild@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+ uses: github/codeql-action/autobuild@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
 
  # ℹ️ Command-line programs to run using the OS shell.
  # 📚 https://git.io/JvXDl
@@ -75,4 +73,4 @@ jobs:
  # make release
 
  - name: Perform CodeQL Analysis
- uses: github/codeql-action/analyze@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+ uses: github/codeql-action/analyze@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7

.github/workflows/goreleaser.yml

@@ -25,16 +25,15 @@ jobs:
  uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  fetch-depth: 0
- ref: ${{ inputs.commit }}
  - name: Set up Go
  uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
  with:
- go-version-file: .go-version
+ go-version: stable
  check-latest: true
- - uses: docker/setup-qemu-action@5927c834f5b4fdf503fca6f4c7eccda82949e1ee # v3
- - uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3
+ - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
+ - uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
  - name: ghcr-login
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3
+ uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
  with:
  registry: ghcr.io
  username: ${{ github.repository_owner }}

.github/workflows/lint-action/action.yml

@@ -19,7 +19,7 @@ runs:
  using: composite
  steps:
  - name: Run golangci-lint
- uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1
+ uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
  with:
  # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
- version: v1.59.1
+ version: v1.60.1

.github/workflows/osv-scanner-reusable-pr.yml

@@ -86,28 +86,28 @@ jobs:
  # format to the repository Actions tab.
  - name: "Upload artifact"
  if: "!cancelled()"
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: SARIF file
  path: ${{ inputs.results-file-name }}
  retention-days: 5
  - name: "Upload old scan json results"
  if: "!cancelled()"
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: old-json-results
  path: old-results.json
  retention-days: 5
  - name: "Upload new scan json results"
  if: "!cancelled()"
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: new-json-results
  path: new-results.json
  retention-days: 5
  # Upload the results to GitHub's code scanning dashboard.
  - name: "Upload to code-scanning"
  if: ${{ !cancelled() && inputs.upload-sarif == true }}
- uses: github/codeql-action/upload-sarif@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+ uses: github/codeql-action/upload-sarif@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
  with:
  sarif_file: ${{ inputs.results-file-name }}

.github/workflows/osv-scanner-reusable.yml

@@ -83,14 +83,14 @@ jobs:
  # format to the repository Actions tab.
  - name: "Upload artifact"
  if: "!cancelled()"
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: SARIF file
  path: ${{ inputs.results-file-name }}
  retention-days: 5
  # Upload the results to GitHub's code scanning dashboard.
  - name: "Upload to code-scanning"
  if: "${{ !cancelled() && inputs.upload-sarif == true }}"
- uses: github/codeql-action/upload-sarif@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+ uses: github/codeql-action/upload-sarif@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
  with:
  sarif_file: ${{ inputs.results-file-name }}

.github/workflows/osv-scanner-unified-action.yml

@@ -17,8 +17,6 @@ name: OSV-Scanner Scheduled Scan
 on:
  pull_request:
  branches: ["main"]
- merge_group:
- branches: ["main"]
  schedule:
  - cron: "12 12 * * 1"
  push:

.github/workflows/pr-check.yml

@@ -0,0 +1,35 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: OSV PR format check
+
+on:
+ # `pull_request_target` is only required when editing PRs from forks.
+ pull_request:
+ types:
+ - opened
+ - edited
+ - reopened
+
+permissions:
+ pull-requests: read
+
+jobs:
+ title-check:
+ name: Validate PR title
+ runs-on: ubuntu-latest
+ steps:
+ - uses: amannn/action-semantic-pull-request@v5
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/prerelease-check.yml

@@ -21,7 +21,8 @@ jobs:
  permissions:
  contents: read # to fetch code (actions/checkout)
  security-events: write # for uploading SARIF files
- uses: ./.github/workflows/osv-scanner-reusable.yml
+ actions: read
+ uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main
  with:
  # Only scan the top level go.mod file without recursively scanning directories since
  # this is pipeline is about releasing the go module and binary
@@ -55,7 +56,7 @@ jobs:
  - name: Set up Go
  uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
  with:
- go-version-file: .go-version
+ go-version: stable
  check-latest: true
  - name: Run lint action
  uses: ./.github/workflows/lint-action
@@ -69,7 +70,7 @@ jobs:
  with:
  persist-credentials: false
  - run: scripts/build_test_images.sh
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: image-fixtures-${{ github.run_number }}-${{ github.run_attempt }}
  path: internal/image/fixtures/*.tar
@@ -98,7 +99,7 @@ jobs:
  - name: Set up Go
  uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
  with:
- go-version-file: .go-version
+ go-version: stable
  check-latest: true
  - name: Run test action
  uses: ./.github/workflows/test-action

.github/workflows/scorecards.yml

@@ -38,7 +38,7 @@ jobs:
  persist-credentials: false
 
  - name: "Run analysis"
- uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914e534 # v2.3.3
+ uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
  with:
  results_file: results.sarif
  results_format: sarif
@@ -60,14 +60,14 @@ jobs:
  # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
  # format to the repository Actions tab.
  - name: "Upload artifact"
- uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: SARIF file
  path: results.sarif
  retention-days: 5
 
  # Upload the results to GitHub's code scanning dashboard.
  - name: "Upload to code-scanning"
- uses: github/codeql-action/upload-sarif@2d790406f505036ef40ecba973cc774a50395aac # v3.25.13
+ uses: github/codeql-action/upload-sarif@8214744c546c1e5c8f03dde8fab3a7353211988d # v3.26.7
  with:
  sarif_file: results.sarif

.github/workflows/semantic.yml

@@ -42,14 +42,14 @@ jobs:
  - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  persist-credentials: false
- - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+ - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
  with:
  python-version: "3.10"
  - run: dpkg --version
  - run: python3 scripts/generators/generate-debian-versions.py
  - run: git status
  - run: stat debian-db.zip
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: generated-debian-versions
  path: internal/semantic/fixtures/debian-versions-generated.txt
@@ -73,7 +73,7 @@ jobs:
  extensions: zip
  - run: php scripts/generators/generate-packagist-versions.php
  - run: git status
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: generated-packagist-versions
  path: internal/semantic/fixtures/packagist-versions-generated.txt
@@ -86,14 +86,14 @@ jobs:
  - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  persist-credentials: false
- - uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
+ - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
  with:
  python-version: "3.10"
  - name: setup dependencies
  run: pip install packaging==21.3
  - run: python3 scripts/generators/generate-pypi-versions.py
  - run: git status
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: generated-pypi-versions
  path: internal/semantic/fixtures/pypi-versions-generated.txt
@@ -106,14 +106,14 @@ jobs:
  - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  persist-credentials: false
- - uses: ruby/setup-ruby@161cd54b698f1fb3ea539faab2e036d409550e3c # v1.187.0
+ - uses: ruby/setup-ruby@52753b7da854d5c07df37391a986c76ab4615999 # v1.191.0
  with:
  ruby-version: "3.1"
  - name: setup dependencies
  run: gem install rubyzip
  - run: ruby scripts/generators/generate-rubygems-versions.rb
  - run: git status
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: generated-rubygems-versions
  path: internal/semantic/fixtures/rubygems-versions-generated.txt
@@ -126,7 +126,7 @@ jobs:
  - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  persist-credentials: false
- - uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+ - uses: actions/setup-java@2dfa2011c5b2a0f1489bf9e433881c92c1631f88 # v4.3.0
  with:
  java-version: 17
  distribution: oracle
@@ -139,7 +139,7 @@ jobs:
  -o scripts/generators/lib/maven-artifact-3.8.5.jar
  - run: java -cp 'scripts/generators/lib/*' scripts/generators/GenerateMavenVersions.java
  - run: git status
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: generated-maven-versions
  path: internal/semantic/fixtures/maven-versions-generated.txt
@@ -152,12 +152,12 @@ jobs:
  - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  with:
  persist-credentials: false
- - uses: r-lib/actions/setup-r@929c772977a3a13c8733b363bf5a2f685c25dd91 # v2.9.0
+ - uses: r-lib/actions/setup-r@e6be4b3706e0f39bc7a4cf4496a5f2c4cb840040 # v2.10.1
  with:
  r-version: "3.5.3"
  - run: Rscript scripts/generators/generate-cran-versions.R
  - run: git status
- - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+ - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
  with:
  name: generated-cran-versions
  path: internal/semantic/fixtures/cran-versions-generated.txt
@@ -180,7 +180,7 @@ jobs:
  persist-credentials: false
  - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
  with:
- go-version-file: .go-version
+ go-version: stable
  cache: true
 
  - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8