Skip to content

[ci] restore macOS runners and secure the packaging toolchain (STAR-100) #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
vt128 wants to merge 4 commits into from
Closed

[ci] restore macOS runners and secure the packaging toolchain (STAR-100) #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d6fcc11
[ci] restore supported macOS runners (STAR-100)
vt128 Nov 6, 2026
7c8f099
[ci] use Go 1.27.3 for secure packaging (STAR-100)
vt128 Nov 6, 2026
ed715a1
[ci] run stacked pull request checks (LOCAL-020)
vt128 Nov 7, 2026
50258c2
[ci] use Go 1.27.4 for production security builds
vt128 Nov 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ on:
push:
branches: ["master"]
pull_request:
branches: ["master"]
branches: ["master", "codex/**"]

permissions: read-all

Expand All @@ -15,7 +15,7 @@ jobs:
- uses: actions/checkout@v5
- uses: actions/setup-go@v6
with:
go-version: "1.27.1"
go-version: "1.27.4"
- name: Verify the pinned interpreter
run: test "$(go list -m -f '{{.Version}}' go.starlark.net)" = "v0.0.0-20260324133313-ffb3f39dd27a"
- name: Guard the compatible crypto dependency boundary
Expand All @@ -36,7 +36,7 @@ jobs:
- uses: actions/checkout@v5
- uses: actions/setup-go@v6
with:
go-version: "1.27.1"
go-version: "1.27.4"
- name: Build the runtime image
run: |
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -o starcli .
Expand All @@ -54,7 +54,7 @@ jobs:
# Star* module's pipeline. Pinned to a commit SHA for supply-chain safety;
# bump the pin when meta's workflow changes (Dependabot github-actions can
# automate this).
uses: 1set/meta/.github/workflows/go-ci.yml@23f088bcd6dce16c93e0056d7b70b4f4434208e8
uses: 1set/meta/.github/workflows/go-ci.yml@6b334e6a2762acaeefcea9fc7d3e86964e9246be
with:
# Match go.mod's compatibility floor; the shared workflow also tests
# the current stable Go release.
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ on:
branches: ["master"]
tags: ["v*"]
pull_request:
branches: ["master"]
branches: ["master", "codex/**"]

permissions:
contents: read
Expand All @@ -25,7 +25,7 @@ jobs:
persist-credentials: false
- uses: actions/setup-go@v6
with:
go-version: "1.27.1"
go-version: "1.27.4"
- name: Check source vulnerabilities
run: go run golang.org/x/vuln/cmd/govulncheck@v1.8.0 ./...
- name: Select release or snapshot build
Expand Down Expand Up @@ -79,7 +79,7 @@ jobs:
target: linux_arm64.tar.gz
- os: macos-15-intel
target: macOS_amd64.tar.gz
- os: macos-14
- os: macos-15
target: macOS_arm64.tar.gz
- os: windows-2022
target: windows_amd64.zip
Expand All @@ -91,7 +91,7 @@ jobs:
persist-credentials: false
- uses: actions/setup-go@v6
with:
go-version: "1.27.1"
go-version: "1.27.4"
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
with:
python-version: "3.13"
Expand Down
Loading