From e47f03705c6ff80a22b04bce21592eaf909b8d64 Mon Sep 17 00:00:00 2001 From: Carlos Panato Date: Sat, 14 Nov 2026 11:33:22 -0600 Subject: [PATCH 1/2] Consolidate open dependency updates --- .github/workflows/go-build-and-test.yaml | 2 +- .github/workflows/golangci-lint.yaml | 2 +- .github/workflows/release.yaml | 4 ++-- go.mod | 16 +++++++------- go.sum | 28 ++++++++++++------------ 5 files changed, 26 insertions(+), 26 deletions(-) diff --git a/.github/workflows/go-build-and-test.yaml b/.github/workflows/go-build-and-test.yaml index 1675501..5667824 100644 --- a/.github/workflows/go-build-and-test.yaml +++ b/.github/workflows/go-build-and-test.yaml @@ -24,7 +24,7 @@ jobs: - name: Determine Go versions id: versions - uses: carabiner-dev/actions/go/versions@d41fe10fe88deaf493ce026007da73738b9f570c # v1.3.0 + uses: carabiner-dev/actions/go/versions@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # v1.3.1 test: needs: go-versions diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml index efa6748..5c6a9fe 100644 --- a/.github/workflows/golangci-lint.yaml +++ b/.github/workflows/golangci-lint.yaml @@ -23,7 +23,7 @@ jobs: - name: Determine Go versions id: versions - uses: carabiner-dev/actions/go/versions@d41fe10fe88deaf493ce026007da73738b9f570c # v1.3.0 + uses: carabiner-dev/actions/go/versions@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # v1.3.1 golangci: name: lint diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 256b4fb..d43a1f3 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: Setup bnd - uses: carabiner-dev/actions/install/bnd@d41fe10fe88deaf493ce026007da73738b9f570c # v1.3.0 + uses: carabiner-dev/actions/install/bnd@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # v1.3.1 - name: Check out code uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 @@ -52,7 +52,7 @@ jobs: - name: Generate SBOM id: sbom - uses: carabiner-dev/actions/unpack/sbom@d41fe10fe88deaf493ce026007da73738b9f570c # v1.3.0 + uses: carabiner-dev/actions/unpack/sbom@63d43b57262e65927864c8f7ca0a6a8efe06acc0 # v1.3.1 with: push-to-release: ${{ steps.tag.outputs.tag_name }} env: diff --git a/go.mod b/go.mod index 76c2760..557d7f4 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/carabiner-dev/deadrop -go 1.26.0 +go 1.27 require ( github.com/adrg/xdg v0.5.3 @@ -8,10 +8,10 @@ require ( github.com/carabiner-dev/signer v0.6.2 github.com/chainguard-dev/clog v1.8.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/sigstore/sigstore v1.10.9 + github.com/sigstore/sigstore v1.11.3 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.12.1 - golang.org/x/term v0.47.0 + golang.org/x/term v0.48.0 google.golang.org/protobuf v1.36.12 gopkg.in/yaml.v3 v3.0.1 ) @@ -19,20 +19,20 @@ require ( require ( github.com/ProtonMail/go-crypto v1.5.2 // indirect github.com/cloudflare/circl v1.6.5 // indirect - github.com/coreos/go-oidc/v3 v3.20.0 // indirect - github.com/go-jose/go-jose/v4 v4.1.5 // indirect + github.com/coreos/go-oidc/v3 v3.21.0 // indirect + github.com/go-jose/go-jose/v4 v4.1.6 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/kr/pretty v0.3.1 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/policylabs/signer v0.6.4 // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect - github.com/secure-systems-lab/go-securesystemslib v0.11.0 // indirect + github.com/secure-systems-lab/go-securesystemslib v0.11.1 // indirect github.com/sirupsen/logrus v1.10.2 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/crypto v0.57.0 // indirect - golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sys v0.49.0 // indirect + golang.org/x/oauth2 v0.37.0 // indirect + golang.org/x/sys v0.50.0 // indirect gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect ) diff --git a/go.sum b/go.sum index 909a00c..206b254 100644 --- a/go.sum +++ b/go.sum @@ -10,12 +10,12 @@ github.com/chainguard-dev/clog v1.8.1 h1:Lab3GEDsVm1J9XGlpWEBuzXX7eETRmd0vN5PYoN github.com/chainguard-dev/clog v1.8.1/go.mod h1:5MQOZi+Iu7fV7GcJG8ag8rCB5elEOpqRMKEASgnGVdo= github.com/cloudflare/circl v1.6.5 h1:O64F26HEqNhznd/hrC5KZXVKYuKM2rx4deZDTc4ihQA= github.com/cloudflare/circl v1.6.5/go.mod h1:h5LNyxAc5nTue9DS5jT+48en2PSDYt3zdGnz5OstK6c= -github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= -github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= +github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM= +github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= -github.com/go-jose/go-jose/v4 v4.1.5 h1:RjgjO2LOtWOJKUC5wpwY9LR3B3vwVAz6JS2YHfYU6eA= -github.com/go-jose/go-jose/v4 v4.1.5/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4= +github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-rod/rod v0.116.2 h1:A5t2Ky2A+5eD/ZJQr1EfsQSe5rms5Xof/qj296e+ZqA= github.com/go-rod/rod v0.116.2/go.mod h1:H+CMO9SCNc2TJ2WfrG+pKhITz57uGNYU43qYHh438Mg= github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= @@ -40,10 +40,10 @@ github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/f github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= -github.com/secure-systems-lab/go-securesystemslib v0.11.0 h1:iuCR9kcMFD4QurdKrGvPLoKZLv9YvwPYVr0473BdtFs= -github.com/secure-systems-lab/go-securesystemslib v0.11.0/go.mod h1:+PMOTjUGwHj2vcZ+TFKlb1tXRbrdWE1LYDT5i9JC80Q= -github.com/sigstore/sigstore v1.10.9 h1:7Dcpt+ibnltHQZ8XhaU0dFmhHaf/T491eJfA9WDex4Y= -github.com/sigstore/sigstore v1.10.9/go.mod h1:LYW9+qH7bK8wZmLm6lPxIC5lkHtkJDCgkqjChzTAIBs= +github.com/secure-systems-lab/go-securesystemslib v0.11.1 h1:ayahDPjfSIqKegyt5YVGEvQ7SAi72GHXTy+b2YjUd5w= +github.com/secure-systems-lab/go-securesystemslib v0.11.1/go.mod h1:UyOjhoZLi76ir63u1ptubEevVe6dlNPmNxwgVvKqFFY= +github.com/sigstore/sigstore v1.11.3 h1:gPjEXTOfVNDFQgkEjyLUo+DDh6EA+iklLp1t5slnuGs= +github.com/sigstore/sigstore v1.11.3/go.mod h1:72vQpQeeHgCFJzQnLX1w2sD1HjSJTEeW300ialacOkI= github.com/sirupsen/logrus v1.10.2 h1:G2SED73/qrAu6YwbdxOD6peLkCBI3z7L+ykJFTXJBBo= github.com/sirupsen/logrus v1.10.2/go.mod h1:SLEg8TqYulVKKfIGHldVp2K2aYz2DKSVBq4g/H5bR7Q= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= @@ -70,13 +70,13 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= -golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= -golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98= +golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= -golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= -golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= +golang.org/x/sys v0.50.0 h1:dkKZEFTEKaLr1sjhs0WiKqoi8Jj5nHbS3Njmx1UoMJs= +golang.org/x/sys v0.50.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.48.0 h1:G6UU1eiSB8nl3DzeUGt7Mg+2SctI8tPS6Z5/mBt6cOk= +golang.org/x/term v0.48.0/go.mod h1:BRDLHCZr2SUjIeBHHpRyQeC9xzSAVbzY2rvKgafnHf4= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 5484e853e46381896337211749da817243e21fcc Mon Sep 17 00:00:00 2001 From: Carlos Panato Date: Sat, 14 Nov 2026 11:36:43 -0600 Subject: [PATCH 2/2] Temporarily run live token exchange only on manual dispatch --- .github/workflows/token-exchange.yaml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/token-exchange.yaml b/.github/workflows/token-exchange.yaml index 03dc165..1f009e2 100644 --- a/.github/workflows/token-exchange.yaml +++ b/.github/workflows/token-exchange.yaml @@ -4,6 +4,8 @@ name: token-exchange on: + # Temporarily manual-only until the auth server has a tenant for this repository. + # Restore PR and push triggers once tenant ownership is configured. workflow_dispatch: inputs: server: @@ -13,10 +15,6 @@ on: options: - https://auth.carabiner.dev - https://auth.dev.carabiner.dev - pull_request: - branches: [ "main" ] - push: - branches: [ "main" ] permissions: {} @@ -41,7 +39,6 @@ jobs: cache: true - name: Log in exchanging the ambient actions token - # PR and push runs always test against prod; manual runs can choose env: - DEADROP_SERVER: ${{ inputs.server || 'https://auth.carabiner.dev' }} + DEADROP_SERVER: ${{ inputs.server }} run: go run ./cmd/deadrop login --auth-server "$DEADROP_SERVER"