Ludovic Vielle
570395c4ac
Add opt-in shell lint and format targets
...
Introduce make lint-shell / fmt-shell with shellcheck and
shfmt (-i 2 -ci -bn), normalize first-party scripts, and
document the new targets. Keep them out of make lint / fmt.
Signed-off-by: Ludovic Vielle <ludovic@probo.com >
2026-07-28 17:37:34 +02:00
Ludovic Vielle
85864a580c
Install macOS helper from PKG for XPC enroll
...
Browser enrollment used osascript on every elevate. Ship a signed
privileged helper installed at PKG time so probo:// can enroll over
XPC with no second admin prompt. Add make install/uninstall/clean for
local PKG test loops, and show alerts only on failure.
Mirror the Go lint path for the macOS SPM package: Make
targets, root configs, and a Linux CI job. Keep checks
syntax-only so they do not need a macOS SDK. Format the
existing sources so the new gates start clean.
Signed-off-by: Ludovic Vielle <ludovic@probo.com >
2026-07-24 15:08:37 +02:00
Ludovic Vielle
d0dd87c6c7
Add probo-agent binary, installer, and CI
...
Signed-off-by: Ludovic Vielle <ludovic@probo.com >
2026-07-24 15:08:25 +02:00
Émile Ré
00f5d0c4ba
Remove orphaned apps/trust frontend
...
Compliance portal already embeds and serves the public SPA, so the
old @probo/trust app was unused. Drop its Makefile/CI stubs, Relay
project, CORS port, and the helper that only it imported.
Signed-off-by: Émile Ré <emile@probo.com >
2026-07-22 14:19:41 +02:00
Bryan Frimin
cb1d7c274b
Unblock CI generate, test, and e2e
...
Generate MCP types before complianceportal, stub apps/trust
dist for embed, fix domains section indent, and start the
compose stack only after bin/probod is built.
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-07-21 15:44:22 +02:00
Bryan Frimin
9f57310ceb
Point e2e and CI at step-ca trust center
...
Update generated test config, loopback HTTPS client, and workflow
root CA wiring for the step-ca ACME directory and port-443 trust
center listener introduced by the new compose stack.
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-07-21 15:44:16 +02:00
Bryan Frimin
e83f9e3a2e
Update build targets for compliance portal app
...
Add the complianceportal Go embed target, wire it into CI and
release workflows, and document the new build entry point.
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-07-21 15:44:15 +02:00
Émile Ré
26595b724f
Serve compliance-portal instead of trust
...
Embed and build @probo/compliance-portal for the
/trust path and custom-domain SPA so production
ships the v2 portal. Keep apps/trust in the repo
for local use on port 5175; portal takes 5174.
Signed-off-by: Émile Ré <emile@probo.com >
2026-07-20 17:38:45 +02:00
dependabot[bot]
ef87fa981d
Bump the github-actions group with 8 updates
...
Bumps the github-actions group with 8 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `6` | `7` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action ) | `9.2.1` | `9.3.0` |
| [docker/setup-compose-action](https://github.com/docker/setup-compose-action ) | `2.2.0` | `2.3.0` |
| [azure/setup-helm](https://github.com/azure/setup-helm ) | `5.0.0` | `5.0.1` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ) | `4.1.0` | `4.1.1` |
| [actions/attest](https://github.com/actions/attest ) | `4.1.0` | `4.1.1` |
| [github/codeql-action/upload-sarif](https://github.com/github/codeql-action ) | `4.32.1` | `4.36.2` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog ) | `3.95.5` | `3.95.7` |
Updates `actions/checkout` from 6 to 7
- [Release notes](https://github.com/actions/checkout/releases )
- [Commits](https://github.com/actions/checkout/compare/v6...v7 )
Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0
- [Release notes](https://github.com/golangci/golangci-lint-action/releases )
- [Commits](82606bf257...ba0d7d2ec0https://github.com/docker/setup-compose-action/releases )
- [Commits](16feee727c...4eb059ff7fhttps://github.com/azure/setup-helm/releases )
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md )
- [Commits](dda3372f75...9bc31f4ebchttps://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](a2bbfa2537...0f67c3f485https://github.com/actions/attest/releases )
- [Changelog](https://github.com/actions/attest/blob/main/RELEASE.md )
- [Commits](59d89421af...a1948c3f04https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](6bc82e05fd...8aad20d150https://github.com/trufflesecurity/trufflehog/releases )
- [Commits](d411fff7b8...f446421bafsupport@github.com >
2026-07-02 16:30:32 +02:00
Ludovic Vielle
2b8f6f5b3b
Add Secrets Manager resolution to probod-bootstrap
...
Introduce a Resolver that owns env lookup and typed parsing for
probod-bootstrap. Env values prefixed with aws://<secret-id> are
fetched from AWS Secrets Manager (plaintext SecretString); each
secret ID is cached per run. Builder now takes a Resolver only.
Prefix every probod-bootstrap input with PROBOD_ so bootstrap config
does not collide with unrelated process environment (for example
AWS_* used by other tooling). Secrets Manager authentication uses
the standard AWS SDK default chain (AWS_REGION, IAM role, profile);
PROBOD_AWS_* vars configure S3 in the generated config only.
Update Helm deployment env names, GNUmakefile dev-config, Lima
provision, e2e testutil, compose.prod.yaml, and docs.
Deployments must rename bootstrap env vars to PROBOD_* (e.g.
AUTH_COOKIE_SECRET → PROBOD_AUTH_COOKIE_SECRET).
BREAKING CHANGE: all env vars are now prefixed by `PROBOD_`.
Signed-off-by: Ludovic Vielle <ludovic@probo.com >
2026-06-24 20:24:53 +02:00
dependabot[bot]
18be2b5772
Bump the github-actions group across 1 directory with 10 updates
...
Bumps the github-actions group with 10 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [runs-on/action](https://github.com/runs-on/action ) | `2.1.0` | `2.1.2` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `7.0.0` | `7.0.1` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `4.0.0` | `4.1.0` |
| [docker/login-action](https://github.com/docker/login-action ) | `4.0.0` | `4.2.0` |
| [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action ) | `db582008a42febd596419635a5abc9d9815daa9c` | `82606bf257cbaff209d206a39f5134f0cfbfd2ee` |
| [docker/setup-compose-action](https://github.com/docker/setup-compose-action ) | `2.1.0` | `2.2.0` |
| [azure/setup-helm](https://github.com/azure/setup-helm ) | `4.3.0` | `5.0.0` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.3.0` | `6.4.0` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) | `4.0.0` | `4.1.2` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog ) | `5f47aad1c2df34f7c6230784ce9a5a659922f479` | `d411fff7b8879a62509f3fa98c07f247ac089a51` |
Updates `runs-on/action` from 2.1.0 to 2.1.2
- [Release notes](https://github.com/runs-on/action/releases )
- [Commits](742bf56072...d141ef83ebhttps://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v7...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a )
Updates `docker/setup-buildx-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](4d04d5d948...d7f5e7f509https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/v4...650006c6eb7dba73a995cc03b0b2d7f5ca915bee )
Updates `golangci/golangci-lint-action` from db582008a42febd596419635a5abc9d9815daa9c to 82606bf257cbaff209d206a39f5134f0cfbfd2ee
- [Release notes](https://github.com/golangci/golangci-lint-action/releases )
- [Commits](db582008a4...82606bf257https://github.com/docker/setup-compose-action/releases )
- [Commits](8cccb8c14b...16feee727chttps://github.com/azure/setup-helm/releases )
- [Changelog](https://github.com/Azure/setup-helm/blob/main/CHANGELOG.md )
- [Commits](b9e51907a0...dda3372f75https://github.com/actions/setup-node/releases )
- [Commits](53b83947a5...48b55a011bhttps://github.com/sigstore/cosign-installer/releases )
- [Commits](faadad0cce...6f9f177880https://github.com/trufflesecurity/trufflehog/releases )
- [Commits](5f47aad1c2...d411fff7b8support@github.com >
2026-06-16 16:18:49 +02:00
Bryan Frimin
21fee97b89
Update release process
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-26 16:08:10 -07:00
Bryan Frimin
e5041a882a
Upgrade golang ci
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-26 15:22:27 -07:00
Bryan Frimin
100e5a154d
Fix docker hub rate limit
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-26 14:20:28 -07:00
Bryan Frimin
314db9654a
Use harbor proxy
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-25 16:52:09 -07:00
Bryan Frimin
078f9d229d
Fix cache url
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-25 16:42:05 -07:00
Bryan Frimin
2c716efb80
Fix wrong cache endpoint
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-25 16:19:45 -07:00
Bryan Frimin
d804c72c07
Migrate to custom oci registry
...
Signed-off-by: Bryan Frimin <bryan@probo.com >
2026-05-25 15:01:35 -07:00
Sacha Al Himdani
3e82b64f01
Fix wsl_v5 lint errors and enforce lint on PR CI
...
Add missing blank lines around if-block boundaries in two files
to satisfy wsl_v5, and make lint-go and lint-js fail the build on
pull requests (not only on push to main) by always running the
strict lint and using reviewdog purely for inline annotations.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-05-20 16:49:42 +02:00
dependabot[bot]
62a00d385e
Bump the github-actions group across 1 directory with 5 updates
...
Bumps the github-actions group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `7.0.0` | `7.0.1` |
| [docker/login-action](https://github.com/docker/login-action ) | `4.0.0` | `4.1.0` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) | `4.0.0` | `4.1.1` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `6.3.0` | `6.4.0` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog ) | `e48f9039c82786db50685e8ef7d980b209f06186` | `5f47aad1c2df34f7c6230784ce9a5a659922f479` |
Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](bbbca2ddaa...043fb46d1ahttps://github.com/docker/login-action/releases )
- [Commits](b45d80f862...4907a6ddechttps://github.com/sigstore/cosign-installer/releases )
- [Commits](faadad0cce...cad07c2e89https://github.com/actions/setup-node/releases )
- [Commits](53b83947a5...48b55a011bhttps://github.com/trufflesecurity/trufflehog/releases )
- [Commits](e48f9039c8...5f47aad1c2support@github.com >
2026-05-04 13:54:47 +00:00
Émile Ré
cd73bc1d2d
Create targets for generate and embed, replace SKIP_APPS with WITH_APPS
...
Signed-off-by: Émile Ré <emile@getprobo.com >
2026-04-29 12:48:43 +04:00
Sacha Al Himdani
b9cf93a306
Update trivy-action to 0.36.0 and print findings in CI logs
...
Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 (Trivy 0.70.0)
and add a step to print CVE findings from the SARIF output so they are
visible directly in CI logs.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-04-23 12:10:56 +02:00
Sacha Al Himdani
135bdf298e
Skip Docker Hub login when token is unavailable
...
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-04-22 12:04:48 +02:00
Bryan Frimin
c4e81ed092
Inline OAuth2 signing key in config
...
The OAuth2/OIDC server accepted its signing key via a file path
(key-file), while every other PEM key in the probod config (SAML
private key, ACME account key) is embedded inline. Switch the
field to a private-key string so the convention is uniform.
The signing key is operator-supplied material that must outlive
any process restart, so the bootstrap builder now treats
OAUTH2_SERVER_SIGNING_KEY as required and refuses to start
without one; silently minting a fresh key per boot would break
token validation across rollouts. The OAUTH2_SERVER_* env vars
otherwise flow through builder.Build like the existing SAML
block so the new OAuth2Server section is populated end-to-end.
Rework the e2e harness to render its config via bootstrap at
test setup, which removes the static
e2e/console/testdata/config.yaml and the previously generated
test-only PEM file. A per-run RSA key is minted via
bootstrap.GenerateOAuth2SigningKey (kept public for test
tooling) and injected through the builder env map. CI now
passes ACME_ROOT_CA inline instead of mutating a YAML on disk.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-04-21 17:56:00 +02:00
Sacha Al Himdani
f7070c43a4
Serialize gqlgen codegen to fix build cache race
...
Parallel gqlgen instances race on the Go build cache, causing
Rewriter.getSource() to panic with "slice bounds out of range"
when go/packages returns empty source. Chain gqlgen targets with
order-only prerequisites in the Makefile and switch the CI build
job to sequential generation.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-04-20 16:33:58 +02:00
Bryan Frimin
1d539f8cc9
Add Docker Hub authentication to CI workflows
...
Authenticate to Docker Hub in jobs that pull images (build-snapshot-docker,
test-e2e, build-docker) to avoid unauthenticated rate limits.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-04-16 15:27:58 +02:00
Émile Ré
31abc31454
Replace npm run relay with make relay everywhere
...
The make relay target merges split graphql files into a single
schema.graphql before running the Relay compiler. All CI workflows,
the generate target, and documentation now use make relay.
Signed-off-by: Émile Ré <emile@getprobo.com >
2026-04-15 09:19:41 +04:00
Émile Ré
74d7d3ff25
Upgrade Relay to v20.1.1 and unify compiler config
...
Consolidate the two per-app relay configs (console and trust)
into a single multi-project relay.config.json at the repo root
with three projects: core, iam, and trust. Bump all relay
packages from v19 to v20.1.1 and move relay-compiler to the
root devDependencies. Replace per-workspace relay scripts with
a single root-level npm run relay command and update the
GNUmakefile, CI workflows, and docs accordingly.
Signed-off-by: Émile Ré <emile@getprobo.com >
2026-04-14 16:04:11 +04:00
Bryan Frimin
7e685a2e96
Rewrite CI/CD pipeline
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-04-03 20:14:38 +02:00
dependabot[bot]
e6b88e7eec
Bump the github-actions group with 12 updates
...
Bumps the github-actions group with 12 updates:
| Package | From | To |
| --- | --- | --- |
| [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action ) | `3.7.0` | `4.0.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) | `3.12.0` | `4.0.0` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action ) | `0.22.1` | `0.24.0` |
| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action ) | `6.4.0` | `7.0.0` |
| [anchore/scan-action](https://github.com/anchore/scan-action ) | `7.3.1` | `7.4.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `6` | `7` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `6` | `8` |
| [docker/setup-compose-action](https://github.com/docker/setup-compose-action ) | `1.2.0` | `2.1.0` |
| [docker/login-action](https://github.com/docker/login-action ) | `3.7.0` | `4.0.0` |
| [actions/attest-sbom](https://github.com/actions/attest-sbom ) | `3` | `4` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ) | `3` | `4` |
| [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog ) | `b78fbfd8eb982f4802e09a265fb2bc37b3040975` | `e48f9039c82786db50685e8ef7d980b209f06186` |
Updates `docker/setup-qemu-action` from 3.7.0 to 4.0.0
- [Release notes](https://github.com/docker/setup-qemu-action/releases )
- [Commits](c7c5346462...ce360397ddhttps://github.com/docker/setup-buildx-action/releases )
- [Commits](8d2750c68a...4d04d5d948https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](deef08a0db...e22c389904https://github.com/goreleaser/goreleaser-action/releases )
- [Commits](e435ccd777...ec59f474b9https://github.com/anchore/scan-action/releases )
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md )
- [Commits](8d2fce0942...e1165082ffhttps://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7 )
Updates `actions/download-artifact` from 6 to 8
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/v6...v8 )
Updates `docker/setup-compose-action` from 1.2.0 to 2.1.0
- [Release notes](https://github.com/docker/setup-compose-action/releases )
- [Commits](364cc21a5d...8cccb8c14bhttps://github.com/docker/login-action/releases )
- [Commits](c94ce9fb46...b45d80f862https://github.com/actions/attest-sbom/releases )
- [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-sbom/compare/v3...v4 )
Updates `actions/attest-build-provenance` from 3 to 4
- [Release notes](https://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-build-provenance/compare/v3...v4 )
Updates `trufflesecurity/trufflehog` from b78fbfd8eb982f4802e09a265fb2bc37b3040975 to e48f9039c82786db50685e8ef7d980b209f06186
- [Release notes](https://github.com/trufflesecurity/trufflehog/releases )
- [Commits](b78fbfd8eb...e48f9039c8support@github.com >
2026-04-02 18:37:23 +02:00
Sacha Al Himdani
72a48ff6b1
Run n8n-node lint on pull requests using n8n-node CLI
...
The PR lint path was running `npx eslint .` for the n8n-node package,
which uses a different config than `npx n8n-node lint` used on push.
This caused lint to pass on PRs but fail on push to main.
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-03-27 14:24:53 +01:00
Sacha Al Himdani
c18f0b0748
Bump aquasecurity/trivy-action from 0.33.1 to 0.35.0
...
Fixes GHSA-69fq-xp46-6x23 (Critical) and GHSA-9p44-j4g5-cfx5 (Medium).
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-03-25 08:54:09 +01:00
Bryan Frimin
c74e5cc123
Add go fmt and go fix checks to lint
...
Adds go-fmt and go-fix Makefile targets that fail when gofmt or go fix
suggest changes. Both are wired into the lint target and used in CI.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-03-19 16:37:51 +01:00
Bryan Frimin
7ffb2d5e94
Add document viewer with proper 404 handling for trust center
...
Move document download/view to a dedicated viewer page with PDF preview,
access request flow, and a proper 404 error boundary when documents are
not found. The backend now returns NOT_FOUND instead of INTERNAL for
missing documents and reports.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-16 19:13:21 +01:00
Bryan Frimin
7ed9c6c2e6
Add go fmt and go fix checks to lint
...
Adds go-fmt and go-fix Makefile targets that fail when gofmt or go fix
suggest changes. Both are wired into the lint target and used in CI.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-16 17:32:25 +01:00
Bryan Frimin
807213d384
Stop tracking generated files
...
Run make generate in CI lint and test jobs since generated files are
now gitignored. Also include Relay codegen for frontend apps in the
generate target.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-16 16:19:47 +01:00
Bryan Frimin
3e3138f764
Cache Go modules explicitly with go mod download
...
Add go mod download step after setup-go in all CI jobs to ensure the
module cache is populated as a discrete step. This makes cache hits visible
in logs and prevents module downloads from being interleaved with build
operations, improving cache effectiveness.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-16 15:54:54 +01:00
Bryan Frimin
5c22789624
Add reviewdog to post lint errors as PR comments
...
Use reviewdog in the CI lint job so golangci-lint and eslint
failures appear as inline comments on pull request files instead
of only in job logs.
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-16 00:41:22 +01:00
mendral-app[bot]
1921445a73
ci: add shared build job to eliminate redundant make build in test and lint
...
Extract make build into a dedicated build job that uploads artifacts
(bin/probod, frontend dist, emails dist). Both test and lint jobs now
download these artifacts instead of rebuilding from scratch.
This eliminates ~172 compute minutes/week of redundant builds while
keeping wall-clock time neutral (test and lint were spending their
first ~2min building anyway).
2026-03-11 13:43:11 +01:00
mendral-app[bot]
76e1c17a24
ci: remove redundant grype install from release-snapshot workflow
...
The manual grype install (cache + curl-pipe-sh + PATH export) is redundant
because anchore/scan-action already bundles grype internally. Removing it
also eliminates a supply chain risk: the install script was fetched from
the mutable @main branch of anchore/grype via curl | sh, in a job with
packages:write and id-token:write permissions.
2026-03-11 05:28:01 -07:00
Bryan Frimin
38b12fa278
Upgrade go version
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-03-09 14:52:23 +01:00
Sacha Al Himdani
e173b26acd
Update go and open telemetry
...
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com >
2026-03-02 09:39:10 +01:00
Bryan Frimin
d2dbb6f714
Use bigger github hosted runner
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-02-13 16:20:31 +01:00
Bryan Frimin
015ebe43dc
Use sbom file for grype
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-02-11 11:56:18 +01:00
Émile Ré
4c28792944
Upgrade go to 1.25.7
...
Signed-off-by: Émile Ré <emile@getprobo.com >
2026-02-09 10:55:58 +04:00
mendral-app[bot]
09d73cf413
chore: pin all third-party actions to SHA digests
...
Pin third-party GitHub Actions to immutable SHA digests to prevent
supply chain attacks via tag force-pushing or branch updates.
Actions pinned:
- trufflesecurity/trufflehog (was @main, now SHA)
- sigstore/cosign-installer@v3.8.1
- docker/setup-buildx-action@v3.12 .0
- docker/setup-qemu-action@v3.7.0
- docker/login-action@v3.7.0
- goreleaser/goreleaser-action@v6.4.0
- aquasecurity/trivy-action@0.33 .1
- github/codeql-action/upload-sarif@v4.32 .1
- golangci/golangci-lint-action@v9.2.0
- docker/setup-compose-action@v1.2.0
Version comments added for maintainability.
2026-02-05 08:28:22 +01:00
Émile Ré
459ee41bd0
Skip apps building on api e2e tests
...
Signed-off-by: Émile Ré <emile@getprobo.com >
2026-02-04 18:32:53 +04:00
Bryan Frimin
31f2cde8d0
Fix missing golintci binary
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-02-02 19:06:36 +01:00
Bryan Frimin
f7f2d704f2
Update github action lint command
...
Signed-off-by: Bryan Frimin <bryan@getprobo.com >
2026-02-02 18:45:37 +01:00
dependabot[bot]
b88a6ba012
Bump the github-actions group with 10 updates
...
Bumps the github-actions group with 10 updates:
| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout ) | `4` | `6` |
| [actions/setup-go](https://github.com/actions/setup-go ) | `5` | `6` |
| [actions/setup-node](https://github.com/actions/setup-node ) | `4` | `6` |
| [actions/cache](https://github.com/actions/cache ) | `4` | `5` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action ) | `0.20.5` | `0.22.1` |
| [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action ) | `0.28.0` | `0.33.1` |
| [anchore/scan-action](https://github.com/anchore/scan-action ) | `6.5.1` | `7.3.1` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact ) | `4` | `6` |
| [actions/attest-sbom](https://github.com/actions/attest-sbom ) | `1` | `3` |
| [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance ) | `1` | `3` |
Updates `actions/checkout` from 4 to 6
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4...v6 )
Updates `actions/setup-go` from 5 to 6
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/v5...v6 )
Updates `actions/setup-node` from 4 to 6
- [Release notes](https://github.com/actions/setup-node/releases )
- [Commits](https://github.com/actions/setup-node/compare/v4...v6 )
Updates `actions/cache` from 4 to 5
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v4...v5 )
Updates `anchore/sbom-action` from 0.20.5 to 0.22.1
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](da167eac91...deef08a0dbhttps://github.com/aquasecurity/trivy-action/releases )
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.28.0...0.33.1 )
Updates `anchore/scan-action` from 6.5.1 to 7.3.1
- [Release notes](https://github.com/anchore/scan-action/releases )
- [Changelog](https://github.com/anchore/scan-action/blob/main/RELEASE.md )
- [Commits](1638637db6...8d2fce0942https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/v4...v6 )
Updates `actions/attest-sbom` from 1 to 3
- [Release notes](https://github.com/actions/attest-sbom/releases )
- [Changelog](https://github.com/actions/attest-sbom/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-sbom/compare/v1...v3 )
Updates `actions/attest-build-provenance` from 1 to 3
- [Release notes](https://github.com/actions/attest-build-provenance/releases )
- [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md )
- [Commits](https://github.com/actions/attest-build-provenance/compare/v1...v3 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/setup-go
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/setup-node
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/cache
dependency-version: '5'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: anchore/sbom-action
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: aquasecurity/trivy-action
dependency-version: 0.33.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: github-actions
- dependency-name: anchore/scan-action
dependency-version: 7.3.1
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/upload-artifact
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/attest-sbom
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
- dependency-name: actions/attest-build-provenance
dependency-version: '3'
dependency-type: direct:production
update-type: version-update:semver-major
dependency-group: github-actions
...
Signed-off-by: dependabot[bot] <support@github.com >
2026-02-01 21:14:12 +00:00
