Repository navigation
Conversation
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
8fbeb38 to
d583c1d
Compare
| uses: actions/setup-go@v5 | ||
| with: | ||
| go-version: 1.22 | ||
| cache: true |
There was a problem hiding this comment.
I believe from reading https://github.com/actions/setup-go?tab=readme-ov-file that we don't need to explicitly add caching for this action, since as of v4 caching is the default behavior.
|
|
||
| - name: Check out code | ||
| uses: actions/checkout@v4 | ||
| cache: true |
There was a problem hiding this comment.
Same as the above comment, seems like this is unneeded.
| - name: Get dependencies | ||
| run: | | ||
| go mod download | ||
| - name: Build |
There was a problem hiding this comment.
Genuine question, does this work? don't we still need to build everything for the analyzer to be able to run?
…b summary setup-go v4+ caches by default, so the cache: true lines are removed and the job layout matches main again (action versions, matrix, go.mod). The analyzer prints through log.Println, i.e. to stderr, so the old "./analyzer > analyzer-output.txt" produced an empty file. A pull_request run from a fork also gets a read-only GITHUB_TOKEN, so creating a PR comment fails with 403. Capture stderr and write the report to GITHUB_STEP_SUMMARY instead; the artifact upload is dropped as redundant.
d583c1d to
90f2b19
Compare
…missions The zizmor check on this PR requires every action pinned to a hash. Pins checkout and setup-go to the commits their v6 tags point at today (v6.1.0, v6.5.0), adds a read-only permissions block, and turns off checkout credential persistence, which no step needs.
2 participants
No description provided.