From b9cd082a0cbd5c2e89f72828378d5115b778c9bf Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 10 Jul 2026 08:16:29 +0100 Subject: [PATCH 1/5] ci: update to go 1.26 and golangci-lint v2.12.2, lint action to v9 --- .github/workflows/ci-v2.yml | 6 +++--- .github/workflows/ci.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci-v2.yml b/.github/workflows/ci-v2.yml index ef4700f..9a53678 100644 --- a/.github/workflows/ci-v2.yml +++ b/.github/workflows/ci-v2.yml @@ -30,7 +30,7 @@ jobs: - name: set up go uses: actions/setup-go@v6 with: - go-version: "1.25" + go-version: "1.26" cache-dependency-path: v2/go.sum id: go @@ -56,9 +56,9 @@ jobs: ENABLE_MONGO_TESTS: "true" - name: golangci-lint - uses: golangci/golangci-lint-action@v7 + uses: golangci/golangci-lint-action@v9 with: - version: v2.6.2 + version: v2.12.2 args: --config ../.golangci.yml working-directory: v2 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4176381..344b194 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,7 +30,7 @@ jobs: - name: set up go uses: actions/setup-go@v6 with: - go-version: "1.25" + go-version: "1.26" id: go - name: launch mongodb @@ -47,9 +47,9 @@ jobs: ENABLE_MONGO_TESTS: "true" - name: golangci-lint - uses: golangci/golangci-lint-action@v7 + uses: golangci/golangci-lint-action@v9 with: - version: v2.6.2 + version: v2.12.2 - name: submit coverage run: | From eca20ece8fa0b887b26f8af740945b8d2b4b97bf Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 10 Jul 2026 08:16:29 +0100 Subject: [PATCH 2/5] lint: address gosec findings introduced by golangci-lint v2.12 - set image/png content type on generated avatar endpoints - suppress false positives with reasons: config-driven cookie attrs, oauth endpoint urls flagged as credentials, fixed-host apple redirect, store-generated avatar paths - exclude gosec in test files via config --- .golangci.yml | 3 +++ avatar/localfs.go | 2 +- provider/apple.go | 2 +- provider/custom_server.go | 3 ++- provider/dev_provider.go | 3 ++- provider/providers.go | 6 +++--- token/jwt.go | 8 ++++---- v2/avatar/localfs.go | 2 +- v2/provider/custom_server.go | 3 ++- v2/provider/dev_provider.go | 3 ++- v2/provider/providers.go | 6 +++--- v2/token/jwt.go | 8 ++++---- 12 files changed, 28 insertions(+), 21 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index 9a6da6e..2c6e7c1 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -47,6 +47,9 @@ linters: - linters: - errcheck path: _test\.go$ + - linters: + - gosec + path: _test\.go$ - path: (.+)\.go$ text: should have a package comment, unless it's in another file for this package - path: (.+)\.go$ diff --git a/avatar/localfs.go b/avatar/localfs.go index ee4828c..6ef6104 100644 --- a/avatar/localfs.go +++ b/avatar/localfs.go @@ -71,7 +71,7 @@ func (fs *LocalFS) Get(avatar string) (reader io.ReadCloser, size int, err error func (fs *LocalFS) ID(avatar string) (id string) { location := fs.location(strings.TrimSuffix(avatar, imgSfx)) avFile := path.Join(location, avatar) - fi, err := os.Stat(avFile) + fi, err := os.Stat(avFile) //nolint:gosec // avatar id is store-generated and validated by the proxy handler if err != nil { return encodeID(avatar) } diff --git a/provider/apple.go b/provider/apple.go index 3618fe9..718bba8 100644 --- a/provider/apple.go +++ b/provider/apple.go @@ -288,7 +288,7 @@ func (ah *AppleHandler) LoginHandler(w http.ResponseWriter, r *http.Request) { } ah.Logf("[DEBUG] login url %s, claims=%+v", loginURL, claims) - http.Redirect(w, r, loginURL, http.StatusFound) + http.Redirect(w, r, loginURL, http.StatusFound) //nolint:gosec // redirect goes to the fixed apple auth endpoint, request path only affects redirect_uri query param } // AuthHandler fills user info and redirects to "from" url. This is callback url redirected locally by browser diff --git a/provider/custom_server.go b/provider/custom_server.go index c704d86..94cbdce 100644 --- a/provider/custom_server.go +++ b/provider/custom_server.go @@ -193,7 +193,8 @@ func (c *CustomServer) handleAvatar(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusNotFound) return } - if _, err = w.Write(b); err != nil { + w.Header().Set("Content-Type", "image/png") + if _, err = w.Write(b); err != nil { //nolint:gosec // generated identicon png, not reflected markup w.WriteHeader(http.StatusInternalServerError) return } diff --git a/provider/dev_provider.go b/provider/dev_provider.go index 58301b4..cd73726 100644 --- a/provider/dev_provider.go +++ b/provider/dev_provider.go @@ -130,7 +130,8 @@ func (d *DevAuthServer) Run(ctx context.Context) { // nolint (gocyclo) w.WriteHeader(http.StatusNotFound) return } - if _, err = w.Write(b); err != nil { + w.Header().Set("Content-Type", "image/png") + if _, err = w.Write(b); err != nil { //nolint:gosec // generated identicon png, not reflected markup w.WriteHeader(http.StatusInternalServerError) return } diff --git a/provider/providers.go b/provider/providers.go index 974f081..bca013b 100644 --- a/provider/providers.go +++ b/provider/providers.go @@ -171,7 +171,7 @@ func NewTwitter(p Params) Oauth1Handler { func NewBattlenet(p Params) Oauth2Handler { return initOauth2Handler(p, Oauth2Handler{ name: "battlenet", - endpoint: oauth2.Endpoint{ + endpoint: oauth2.Endpoint{ //nolint:gosec // G101 false positive, oauth endpoint urls are not credentials AuthURL: "https://eu.battle.net/oauth/authorize", TokenURL: "https://eu.battle.net/oauth/token", AuthStyle: oauth2.AuthStyleInParams, @@ -241,7 +241,7 @@ func NewPatreon(p Params) Oauth2Handler { return initOauth2Handler(p, Oauth2Handler{ name: "patreon", // see https://docs.patreon.com/?shell#oauth - endpoint: oauth2.Endpoint{ + endpoint: oauth2.Endpoint{ //nolint:gosec // G101 false positive, oauth endpoint urls are not credentials AuthURL: "https://www.patreon.com/oauth2/authorize", TokenURL: "https://api.patreon.com/oauth2/token", AuthStyle: oauth2.AuthStyleInParams, @@ -276,7 +276,7 @@ func NewDiscord(p Params) Oauth2Handler { return initOauth2Handler(p, Oauth2Handler{ name: "discord", // see https://discord.com/developers/docs/topics/oauth2 - endpoint: oauth2.Endpoint{ + endpoint: oauth2.Endpoint{ //nolint:gosec // G101 false positive, oauth endpoint urls are not credentials AuthURL: "https://discord.com/oauth2/authorize", TokenURL: "https://discord.com/api/oauth2/token", }, diff --git a/token/jwt.go b/token/jwt.go index dbf1f24..2ddae07 100644 --- a/token/jwt.go +++ b/token/jwt.go @@ -260,11 +260,11 @@ func (j *Service) Set(w http.ResponseWriter, claims Claims) (Claims, error) { cookieExpiration = int(j.CookieDuration.Seconds()) } - jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: tokenString, HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain, + jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: tokenString, HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // Secure and SameSite come from service config MaxAge: cookieExpiration, Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &jwtCookie) - xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: claims.Id, HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, + xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: claims.Id, HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // HttpOnly false by design, JS reads it for the X-XSRF-Token header MaxAge: cookieExpiration, Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &xsrfCookie) @@ -335,11 +335,11 @@ func (j *Service) IsExpired(claims Claims) bool { // Reset token's cookies func (j *Service) Reset(w http.ResponseWriter) { - jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, + jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // expired removal cookie, carries no value MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &jwtCookie) - xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, + xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // expired removal cookie, carries no value MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &xsrfCookie) diff --git a/v2/avatar/localfs.go b/v2/avatar/localfs.go index 86f4b38..5357a64 100644 --- a/v2/avatar/localfs.go +++ b/v2/avatar/localfs.go @@ -72,7 +72,7 @@ func (fs *LocalFS) Get(avatar string) (reader io.ReadCloser, size int, err error func (fs *LocalFS) ID(avatar string) (id string) { location := fs.location(strings.TrimSuffix(avatar, imgSfx)) avFile := path.Join(location, avatar) - fi, err := os.Stat(avFile) + fi, err := os.Stat(avFile) //nolint:gosec // avatar id is store-generated and validated by the proxy handler if err != nil { return encodeID(avatar) } diff --git a/v2/provider/custom_server.go b/v2/provider/custom_server.go index 01bb302..dd1a9d3 100644 --- a/v2/provider/custom_server.go +++ b/v2/provider/custom_server.go @@ -193,7 +193,8 @@ func (c *CustomServer) handleAvatar(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusNotFound) return } - if _, err = w.Write(b); err != nil { + w.Header().Set("Content-Type", "image/png") + if _, err = w.Write(b); err != nil { //nolint:gosec // generated identicon png, not reflected markup w.WriteHeader(http.StatusInternalServerError) return } diff --git a/v2/provider/dev_provider.go b/v2/provider/dev_provider.go index 8179c42..ec344f4 100644 --- a/v2/provider/dev_provider.go +++ b/v2/provider/dev_provider.go @@ -130,7 +130,8 @@ func (d *DevAuthServer) Run(ctx context.Context) { // nolint (gocyclo) w.WriteHeader(http.StatusNotFound) return } - if _, err = w.Write(b); err != nil { + w.Header().Set("Content-Type", "image/png") + if _, err = w.Write(b); err != nil { //nolint:gosec // generated identicon png, not reflected markup w.WriteHeader(http.StatusInternalServerError) return } diff --git a/v2/provider/providers.go b/v2/provider/providers.go index 71259f6..d4eb8b7 100644 --- a/v2/provider/providers.go +++ b/v2/provider/providers.go @@ -171,7 +171,7 @@ func NewTwitter(p Params) Oauth1Handler { func NewBattlenet(p Params) Oauth2Handler { return initOauth2Handler(p, Oauth2Handler{ name: "battlenet", - endpoint: oauth2.Endpoint{ + endpoint: oauth2.Endpoint{ //nolint:gosec // G101 false positive, oauth endpoint urls are not credentials AuthURL: "https://eu.battle.net/oauth/authorize", TokenURL: "https://eu.battle.net/oauth/token", AuthStyle: oauth2.AuthStyleInParams, @@ -241,7 +241,7 @@ func NewPatreon(p Params) Oauth2Handler { return initOauth2Handler(p, Oauth2Handler{ name: "patreon", // see https://docs.patreon.com/?shell#oauth - endpoint: oauth2.Endpoint{ + endpoint: oauth2.Endpoint{ //nolint:gosec // G101 false positive, oauth endpoint urls are not credentials AuthURL: "https://www.patreon.com/oauth2/authorize", TokenURL: "https://api.patreon.com/oauth2/token", AuthStyle: oauth2.AuthStyleInParams, @@ -276,7 +276,7 @@ func NewDiscord(p Params) Oauth2Handler { return initOauth2Handler(p, Oauth2Handler{ name: "discord", // see https://discord.com/developers/docs/topics/oauth2 - endpoint: oauth2.Endpoint{ + endpoint: oauth2.Endpoint{ //nolint:gosec // G101 false positive, oauth endpoint urls are not credentials AuthURL: "https://discord.com/oauth2/authorize", TokenURL: "https://discord.com/api/oauth2/token", }, diff --git a/v2/token/jwt.go b/v2/token/jwt.go index 8daf4a4..deceb9d 100644 --- a/v2/token/jwt.go +++ b/v2/token/jwt.go @@ -277,11 +277,11 @@ func (j *Service) Set(w http.ResponseWriter, claims Claims) (Claims, error) { cookieExpiration = int(j.CookieDuration.Seconds()) } - jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: tokenString, HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain, + jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: tokenString, HttpOnly: true, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // Secure and SameSite come from service config MaxAge: cookieExpiration, Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &jwtCookie) - xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: claims.ID, HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, + xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: claims.ID, HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // HttpOnly false by design, JS reads it for the X-XSRF-Token header MaxAge: cookieExpiration, Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &xsrfCookie) @@ -357,11 +357,11 @@ func (j *Service) IsExpired(claims Claims) bool { // Reset token's cookies func (j *Service) Reset(w http.ResponseWriter) { - jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, + jwtCookie := http.Cookie{Name: j.JWTCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // expired removal cookie, carries no value MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &jwtCookie) - xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, + xsrfCookie := http.Cookie{Name: j.XSRFCookieName, Value: "", HttpOnly: false, Path: "/", Domain: j.JWTCookieDomain, //nolint:gosec // expired removal cookie, carries no value MaxAge: -1, Expires: time.Unix(0, 0), Secure: j.SecureCookies, SameSite: j.SameSite} http.SetCookie(w, &xsrfCookie) From e6ab9b6c00340df68c693905da8207adcc603216 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 10 Jul 2026 08:16:29 +0100 Subject: [PATCH 3/5] chore: apply gofmt to avatar tests --- avatar/avatar_test.go | 18 +++++++++--------- v2/avatar/avatar_test.go | 18 +++++++++--------- 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/avatar/avatar_test.go b/avatar/avatar_test.go index c1454f1..ca2ef71 100644 --- a/avatar/avatar_test.go +++ b/avatar/avatar_test.go @@ -543,15 +543,15 @@ func TestEtagMatches(t *testing.T) { header string want bool }{ - {etag, true}, // exact match — what browsers send - {`W/"abc123"`, true}, // weak validator - {`"other", "abc123"`, true}, // comma-separated, second matches - {` "abc123" `, true}, // leading/trailing whitespace - {`*`, true}, // wildcard matches anything - {`"abc"`, false}, // different etag - {`"abc123x"`, false}, // substring shouldn't match - {``, false}, // empty - {`abc123`, false}, // unquoted — invalid per RFC, must not match + {etag, true}, // exact match — what browsers send + {`W/"abc123"`, true}, // weak validator + {`"other", "abc123"`, true}, // comma-separated, second matches + {` "abc123" `, true}, // leading/trailing whitespace + {`*`, true}, // wildcard matches anything + {`"abc"`, false}, // different etag + {`"abc123x"`, false}, // substring shouldn't match + {``, false}, // empty + {`abc123`, false}, // unquoted — invalid per RFC, must not match } for _, tt := range tbl { t.Run(tt.header, func(t *testing.T) { diff --git a/v2/avatar/avatar_test.go b/v2/avatar/avatar_test.go index f3593ab..6acc049 100644 --- a/v2/avatar/avatar_test.go +++ b/v2/avatar/avatar_test.go @@ -543,15 +543,15 @@ func TestEtagMatches(t *testing.T) { header string want bool }{ - {etag, true}, // exact match — what browsers send - {`W/"abc123"`, true}, // weak validator - {`"other", "abc123"`, true}, // comma-separated, second matches - {` "abc123" `, true}, // leading/trailing whitespace - {`*`, true}, // wildcard matches anything - {`"abc"`, false}, // different etag - {`"abc123x"`, false}, // substring shouldn't match - {``, false}, // empty - {`abc123`, false}, // unquoted — invalid per RFC, must not match + {etag, true}, // exact match — what browsers send + {`W/"abc123"`, true}, // weak validator + {`"other", "abc123"`, true}, // comma-separated, second matches + {` "abc123" `, true}, // leading/trailing whitespace + {`*`, true}, // wildcard matches anything + {`"abc"`, false}, // different etag + {`"abc123x"`, false}, // substring shouldn't match + {``, false}, // empty + {`abc123`, false}, // unquoted — invalid per RFC, must not match } for _, tt := range tbl { t.Run(tt.header, func(t *testing.T) { From 7fa0ff7161154b7f36162d264a126d5280174db0 Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 10 Jul 2026 08:26:34 +0100 Subject: [PATCH 4/5] ci: address review findings - mirror apple redirect nolint to v2 to keep modules in sync - set explicit branches/tags match-all on push triggers, actionlint flags the empty form - use --config= form for golangci-lint-action v9 args --- .github/workflows/ci-v2.yml | 6 +++--- .github/workflows/ci.yml | 4 ++-- v2/provider/apple.go | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci-v2.yml b/.github/workflows/ci-v2.yml index 9a53678..9d42f5f 100644 --- a/.github/workflows/ci-v2.yml +++ b/.github/workflows/ci-v2.yml @@ -2,8 +2,8 @@ name: build-v2 on: push: - branches: - tags: + branches: ["**"] + tags: ["**"] paths: - ".github/workflows/ci-v2.yml" - "v2/**" @@ -59,7 +59,7 @@ jobs: uses: golangci/golangci-lint-action@v9 with: version: v2.12.2 - args: --config ../.golangci.yml + args: --config=../.golangci.yml working-directory: v2 - name: submit coverage diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 344b194..0402372 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -2,8 +2,8 @@ name: build on: push: - branches: - tags: + branches: ["**"] + tags: ["**"] paths-ignore: - ".github/workflows/ci-v2.yml" - "v2/**" diff --git a/v2/provider/apple.go b/v2/provider/apple.go index a4fed33..aec66bb 100644 --- a/v2/provider/apple.go +++ b/v2/provider/apple.go @@ -288,7 +288,7 @@ func (ah *AppleHandler) LoginHandler(w http.ResponseWriter, r *http.Request) { } ah.Logf("[DEBUG] login url %s, claims=%+v", loginURL, claims) - http.Redirect(w, r, loginURL, http.StatusFound) + http.Redirect(w, r, loginURL, http.StatusFound) //nolint:gosec // redirect goes to the fixed apple auth endpoint, request path only affects redirect_uri query param } // AuthHandler fills user info and redirects to "from" url. This is callback url redirected locally by browser From 555769e435ad555fa6187a5ee8df580971f94fbc Mon Sep 17 00:00:00 2001 From: Dmitry Verkhoturov Date: Fri, 10 Jul 2026 09:13:12 +0100 Subject: [PATCH 5/5] ci: update checkout to v7 and codeql-action to v4, quote GITHUB_WORKSPACE --- .github/workflows/ci-v2.yml | 6 +++--- .github/workflows/ci.yml | 6 +++--- .github/workflows/codeql-analysis.yml | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci-v2.yml b/.github/workflows/ci-v2.yml index 9d42f5f..d43550b 100644 --- a/.github/workflows/ci-v2.yml +++ b/.github/workflows/ci-v2.yml @@ -25,7 +25,7 @@ jobs: sudo systemctl disable mono-xsp4.service || true - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: set up go uses: actions/setup-go@v6 @@ -48,7 +48,7 @@ jobs: - name: build and test run: | - go test -timeout=60s -v -race -p 1 -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov ./... + go test -timeout=60s -v -race -p 1 -covermode=atomic -coverprofile="$GITHUB_WORKSPACE/profile.cov" ./... go build -race working-directory: v2 env: @@ -65,6 +65,6 @@ jobs: - name: submit coverage run: | go install github.com/mattn/goveralls@latest - goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov + goveralls -service="github" -coverprofile="$GITHUB_WORKSPACE/profile.cov" env: COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0402372..68172bb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: sudo systemctl disable mono-xsp4.service || true - name: checkout - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: set up go uses: actions/setup-go@v6 @@ -40,7 +40,7 @@ jobs: - name: build and test run: | - go test -timeout=60s -v -race -p 1 -covermode=atomic -coverprofile=$GITHUB_WORKSPACE/profile.cov ./... + go test -timeout=60s -v -race -p 1 -covermode=atomic -coverprofile="$GITHUB_WORKSPACE/profile.cov" ./... go build -race env: TZ: "America/Chicago" @@ -54,6 +54,6 @@ jobs: - name: submit coverage run: | go install github.com/mattn/goveralls@latest - goveralls -service="github" -coverprofile=$GITHUB_WORKSPACE/profile.cov + goveralls -service="github" -coverprofile="$GITHUB_WORKSPACE/profile.cov" env: COVERALLS_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 68ab758..b7f490f 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -35,11 +35,11 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@v3 + uses: github/codeql-action/init@v4 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -53,4 +53,4 @@ jobs: TZ: "America/Chicago" - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 + uses: github/codeql-action/analyze@v4