Skip to content

chore: update workflows#547

Open
ldez wants to merge 1 commit into
letsencrypt:mainfrom
ldez:feat/update-workflows
Open

chore: update workflows#547
ldez wants to merge 1 commit into
letsencrypt:mainfrom
ldez:feat/update-workflows

Conversation

@ldez

@ldez ldez commented May 26, 2026

Copy link
Copy Markdown
Contributor

I updated the versions of the actions to the latest possible and applied some security good practices.

I also updated golangci-lint to the latest version and lego to v5.


Not in this PR, but I recommend several things to improve security and maintainability:

  • use goreleaser to simplify the maintenance of the release process and review the permissions related to this process
  • use immutable releases (I think this is not possible with the current release process)
  • pin the versions of the actions and use dependabot or renovatebot to keep them up to date
  • add zizmor as a check

The fact to use goreleaser was rejected in 2019, but it's still think that it's the best way to automate the release process.
This is more maintainable than the current process with upload and download of artifacts.

@ldez ldez force-pushed the feat/update-workflows branch from 95ca792 to e324a87 Compare May 26, 2026 00:49
persist-credentials: false
- uses: actions/setup-go@v6
with:
go-version: stable

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why change this?

Suggested change
go-version: stable
go-version-file: go.mod

@ldez ldez May 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because lego requires min go1.25 but pebble uses go1.24.

The Go version used to compile lego doesn't have to match the Go version used to compile pebble.

I can use oldstable if you want, as lego always uses Go latest-1 (== oldstable).

@ldez ldez force-pushed the feat/update-workflows branch from e324a87 to f32156b Compare June 11, 2026 13:39
@ldez

ldez commented Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

Because of PR #548 I was forced to rewrite the PR from scratch, this was not fun.
I don't understand why you didn't ask me to split my PR or to add zizmor.

@ldez ldez force-pushed the feat/update-workflows branch 4 times, most recently from 8fc5076 to ff789b1 Compare June 11, 2026 13:46
@ldez ldez force-pushed the feat/update-workflows branch from ff789b1 to d03f80f Compare June 11, 2026 15:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants