ed9cdb4847
Bump the Go toolchain from 1.26.4 to 1.26.5 to address CVE-2026-42505 (ECH handshake de-anonymization) and CVE-2026-39822 (os.Root symlink following on Unix). Signed-off-by: Sacha Al Himdani <sacha@probo.com>
34 lines
815 B
YAML
34 lines
815 B
YAML
name: "Setup"
|
|
description: "Set up Go and/or Node.js toolchains"
|
|
inputs:
|
|
go:
|
|
description: "Set up Go toolchain and download modules"
|
|
required: false
|
|
default: "true"
|
|
node:
|
|
description: "Set up Node.js and install dependencies"
|
|
required: false
|
|
default: "true"
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- if: inputs.go == 'true'
|
|
uses: "actions/setup-go@v6"
|
|
with:
|
|
go-version: "1.26.5"
|
|
cache: true
|
|
- if: inputs.go == 'true'
|
|
shell: bash
|
|
run: go mod download
|
|
- if: inputs.node == 'true'
|
|
uses: "actions/setup-node@v6"
|
|
with:
|
|
node-version-file: ".nvmrc"
|
|
cache: "npm"
|
|
- if: inputs.node == 'true'
|
|
shell: bash
|
|
run: npm install -g npm@^11.8.0
|
|
- if: inputs.node == 'true'
|
|
shell: bash
|
|
run: npm ci
|