From d6fcc11b319153d103445f2fd07c4445804f2894 Mon Sep 17 00:00:00 2001 From: Kevin Tang <73975146+vt128@users.noreply.github.com> Date: Sat, 7 Nov 2026 03:48:13 +0800 Subject: [PATCH 1/4] [ci] restore supported macOS runners (STAR-100) --- .github/workflows/build.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 62254f5..b223393 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -54,7 +54,7 @@ jobs: # Star* module's pipeline. Pinned to a commit SHA for supply-chain safety; # bump the pin when meta's workflow changes (Dependabot github-actions can # automate this). - uses: 1set/meta/.github/workflows/go-ci.yml@23f088bcd6dce16c93e0056d7b70b4f4434208e8 + uses: 1set/meta/.github/workflows/go-ci.yml@6b334e6a2762acaeefcea9fc7d3e86964e9246be with: # Match go.mod's compatibility floor; the shared workflow also tests # the current stable Go release. diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c4aea23..db89bb5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -79,7 +79,7 @@ jobs: target: linux_arm64.tar.gz - os: macos-15-intel target: macOS_amd64.tar.gz - - os: macos-14 + - os: macos-15 target: macOS_arm64.tar.gz - os: windows-2022 target: windows_amd64.zip From 7c8f0996790fcdc8b843cf9b5e43cf2b8a50e719 Mon Sep 17 00:00:00 2001 From: Kevin Tang <73975146+vt128@users.noreply.github.com> Date: Sat, 7 Nov 2026 04:13:03 +0800 Subject: [PATCH 2/4] [ci] use Go 1.27.3 for secure packaging (STAR-100) --- .github/workflows/build.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b223393..6289312 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,7 +15,7 @@ jobs: - uses: actions/checkout@v5 - uses: actions/setup-go@v6 with: - go-version: "1.27.1" + go-version: "1.27.3" - name: Verify the pinned interpreter run: test "$(go list -m -f '{{.Version}}' go.starlark.net)" = "v0.0.0-20260324133313-ffb3f39dd27a" - name: Guard the compatible crypto dependency boundary @@ -36,7 +36,7 @@ jobs: - uses: actions/checkout@v5 - uses: actions/setup-go@v6 with: - go-version: "1.27.1" + go-version: "1.27.3" - name: Build the runtime image run: | CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o starcli . diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index db89bb5..7565a61 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@v6 with: - go-version: "1.27.1" + go-version: "1.27.3" - name: Check source vulnerabilities run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./... - name: Select release or snapshot build @@ -91,7 +91,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@v6 with: - go-version: "1.27.1" + go-version: "1.27.3" - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13" From ed715a101c353acb6f9f5ea8ffcdbc62a1df7f5c Mon Sep 17 00:00:00 2001 From: Kevin Tang <73975146+vt128@users.noreply.github.com> Date: Sat, 7 Nov 2026 23:35:28 +0800 Subject: [PATCH 3/4] [ci] run stacked pull request checks (LOCAL-020) --- .github/workflows/build.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 6289312..3a03ee2 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -4,7 +4,7 @@ on: push: branches: ["master"] pull_request: - branches: ["master"] + branches: ["master", "codex/**"] permissions: read-all diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7565a61..114ebf5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,7 +7,7 @@ on: branches: ["master"] tags: ["v*"] pull_request: - branches: ["master"] + branches: ["master", "codex/**"] permissions: contents: read From 50258c2b17dcabe79129227272682915d2b74306 Mon Sep 17 00:00:00 2001 From: Kevin Tang <73975146+vt128@users.noreply.github.com> Date: Wed, 11 Nov 2026 20:40:46 +0800 Subject: [PATCH 4/4] [ci] use Go 1.27.4 for production security builds --- .github/workflows/build.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3a03ee2..f3b0a4e 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -15,7 +15,7 @@ jobs: - uses: actions/checkout@v5 - uses: actions/setup-go@v6 with: - go-version: "1.27.3" + go-version: "1.27.4" - name: Verify the pinned interpreter run: test "$(go list -m -f '{{.Version}}' go.starlark.net)" = "v0.0.0-20260324133313-ffb3f39dd27a" - name: Guard the compatible crypto dependency boundary @@ -36,7 +36,7 @@ jobs: - uses: actions/checkout@v5 - uses: actions/setup-go@v6 with: - go-version: "1.27.3" + go-version: "1.27.4" - name: Build the runtime image run: | CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o starcli . diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 114ebf5..904ece0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@v6 with: - go-version: "1.27.3" + go-version: "1.27.4" - name: Check source vulnerabilities run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./... - name: Select release or snapshot build @@ -91,7 +91,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@v6 with: - go-version: "1.27.3" + go-version: "1.27.4" - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 with: python-version: "3.13"