Bump actions/setup-go from 5 to 6 in /.github/workflows #429

Workflow file for this run

	name: 💣 ClickBOM Tests
	on: [push]
	permissions:
	security-events: write
	contents: write
	jobs:
	# Unit tests
	test_unit:
	name: 🧪 Unit Tests
	runs-on: ubuntu-latest

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: 📦 Download dependencies
	run: go mod download

	- name: 🧪 Run unit tests
	run: go test -v -race -coverprofile=coverage.out -covermode=atomic ./...

	- name: 📊 Upload coverage to Codecov
	uses: codecov/codecov-action@v6
	with:
	files: ./coverage.out
	flags: unittests
	name: codecov-umbrella
	token: ${{ secrets.CODECOV_TOKEN }}

	# Integration tests
	test_integration:
	name: 🔗 Integration Tests
	runs-on: ubuntu-latest

	services:
	# ClickHouse for the (currently commented-out) integration tests.
	clickhouse:
	image: clickhouse/clickhouse-server:latest
	ports:
	- 8123:8123
	options: >-
	--health-cmd "wget --spider -q localhost:8123/ping"
	--health-interval 10s
	--health-timeout 5s
	--health-retries 5

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: 📦 Install CycloneDX CLI
	run: \|
	wget -O /tmp/cyclonedx "https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.27.2/cyclonedx-linux-x64"
	sudo mv /tmp/cyclonedx /usr/local/bin/cyclonedx
	sudo chmod +x /usr/local/bin/cyclonedx

	# Mock S3 using the official MinIO image (S3-compatible). Started as a
	# plain `docker run` step rather than a service container because the
	# image needs `server /data` passed as command, and GitHub Actions
	# service containers can't override a container's command/entrypoint.
	# LocalStack would have been the prior choice but its :latest now
	# requires a paid auth token.
	- name: 🪣 Start MinIO
	run: \|
	docker run -d --name minio \
	-p 9000:9000 \
	-e MINIO_ROOT_USER=minioadmin \
	-e MINIO_ROOT_PASSWORD=minioadmin \
	minio/minio:latest server /data
	# Wait up to 60s for MinIO to be live before continuing.
	for i in $(seq 1 60); do
	if curl --silent --fail http://localhost:9000/minio/health/live; then
	echo "MinIO ready after ${i}s"
	break
	fi
	sleep 1
	done

	- name: ⚙️ Create MinIO bucket
	run: \|
	aws --endpoint-url=http://localhost:9000 s3 mb s3://test-bucket
	env:
	AWS_ACCESS_KEY_ID: minioadmin
	AWS_SECRET_ACCESS_KEY: minioadmin
	AWS_DEFAULT_REGION: us-east-1

	# - name: 🧪 Run integration tests
	# run: go test -v -tags=integration ./...
	# env:
	# AWS_ENDPOINT_URL: http://localhost:9000
	# CLICKHOUSE_URL: http://localhost:8123
	# AWS_ACCESS_KEY_ID: minioadmin
	# AWS_SECRET_ACCESS_KEY: minioadmin
	# AWS_DEFAULT_REGION: us-east-1

	# Lint and format checks
	test_lint:
	name: 🔍 Lint & Format
	runs-on: ubuntu-latest

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: 🔍 Run golangci-lint
	uses: golangci/golangci-lint-action@v9
	with:
	version: latest
	args: --timeout=5m

	- name: 📝 Check formatting
	run: \|
	if [ "$(gofmt -s -l . \| wc -l)" -gt 0 ]; then
	echo "Code is not formatted. Run 'gofmt -s -w .'"
	gofmt -s -l .
	exit 1
	fi

	- name: 🔒 Run gosec security scanner
	uses: securego/gosec@master
	with:
	args: '-severity high -confidence high -no-fail -fmt sarif -out results.sarif ./...'

	- name: 📤 Upload SARIF file
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: results.sarif

	# Build tests
	test_build:
	name: 🏗️ Build Tests
	runs-on: ubuntu-latest
	strategy:
	matrix:
	goos: [linux, darwin, windows]
	goarch: [amd64, arm64]
	exclude:
	- goos: windows
	goarch: arm64

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: 🏗️ Build for ${{ matrix.goos }}/${{ matrix.goarch }}
	run: \|
	GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
	go build -v -o clickbom-${{ matrix.goos }}-${{ matrix.goarch }} \
	./cmd/clickbom

	- name: 📤 Upload artifacts
	uses: actions/upload-artifact@v4
	with:
	name: clickbom-${{ matrix.goos }}-${{ matrix.goarch }}
	path: clickbom-${{ matrix.goos }}-${{ matrix.goarch }}*

	# Docker build test
	test_docker:
	name: 🐳 Docker Build
	runs-on: ubuntu-latest

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: 🏗️ Build Docker image
	uses: docker/build-push-action@v5
	with:
	context: .
	push: false
	tags: clickbom:test
	cache-from: type=gha
	cache-to: type=gha,mode=max
	build-args: \|
	VERSION=test
	BUILD_DATE=${{ github.event.head_commit.timestamp }}
	VCS_REF=${{ github.sha }}

	- name: 🧪 Test Docker image
	run: \|
	docker run --rm clickbom:test --version \|\| true
	docker run --rm clickbom:test --help \|\| true

	# Preflight: only run the E2E job when the required secrets are actually
	# configured on the repo. Without this, the E2E job fails on any fork/contrib
	# push (or any repo that hasn't set TEST_S3_BUCKET / AWS_* secrets) with a
	# confusing "S3_BUCKET is required" validation error from clickbom itself.
	e2e_preflight:
	name: 🔐 E2E Preflight
	runs-on: ubuntu-latest
	if: github.event_name == 'push' && (github.ref == 'refs/heads/main' \|\| startsWith(github.ref, 'refs/heads/feature/'))
	outputs:
	has_secrets: ${{ steps.check.outputs.has_secrets }}
	steps:
	- name: Check for required secrets
	id: check
	env:
	TEST_S3_BUCKET: ${{ secrets.TEST_S3_BUCKET }}
	AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	run: \|
	if [[ -n "$TEST_S3_BUCKET" && -n "$AWS_ACCESS_KEY_ID" && -n "$AWS_SECRET_ACCESS_KEY" ]]; then
	echo "has_secrets=true" >> "$GITHUB_OUTPUT"
	else
	echo "::notice::Skipping E2E: TEST_S3_BUCKET / AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY are not configured on this repo."
	echo "has_secrets=false" >> "$GITHUB_OUTPUT"
	fi

	# End-to-end tests with real GitHub API
	test_e2e:
	name: 🎯 E2E Tests
	runs-on: ubuntu-latest
	needs: e2e_preflight
	if: needs.e2e_preflight.outputs.has_secrets == 'true'

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: 🏗️ Build
	run: go build -v -o clickbom ./cmd/clickbom

	- name: 📦 Install dependencies
	run: \|
	wget -O /tmp/cyclonedx "https://github.com/CycloneDX/cyclonedx-cli/releases/download/v0.27.2/cyclonedx-linux-x64"
	sudo mv /tmp/cyclonedx /usr/local/bin/cyclonedx
	sudo chmod +x /usr/local/bin/cyclonedx

	- name: 🧪 Run E2E test with GitHub
	run: ./clickbom
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	REPOSITORY: ${{ github.repository }}
	AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
	AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
	S3_BUCKET: ${{ secrets.TEST_S3_BUCKET }}
	S3_KEY: test-e2e-${{ github.sha }}.json
	SBOM_SOURCE: github
	SBOM_FORMAT: cyclonedx

	# Benchmarks
	benchmark:
	name: ⚡ Benchmarks
	runs-on: ubuntu-latest
	if: github.event_name == 'push'

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: ⚡ Run benchmarks
	run: go test -bench=. -benchmem -run=^$ ./... \| tee benchmark.txt

	- name: 📊 Store benchmark result
	uses: benchmark-action/github-action-benchmark@v1
	with:
	tool: 'go'
	output-file-path: benchmark.txt
	github-token: ${{ secrets.GITHUB_TOKEN }}
	auto-push: true

	# Dependency vulnerability scan
	test_security:
	name: 🔒 Security Scan
	runs-on: ubuntu-latest

	steps:
	- name: 🧾 Checkout
	uses: actions/checkout@v6

	- name: 🔧 Setup Go
	uses: actions/setup-go@v6
	with:
	go-version: '1.25.10'
	cache: true

	- name: 🔍 Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: '.'
	format: 'sarif'
	output: 'trivy-results.sarif'

	- name: 📤 Upload Trivy results to GitHub Security
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'trivy-results.sarif'

	- name: 🔍 Run govulncheck
	run: \|
	go install golang.org/x/vuln/cmd/govulncheck@latest
	govulncheck ./...

Navigation Menu

Uh oh!

Bump actions/setup-go from 5 to 6 in /.github/workflows #429

Workflow file

Bump actions/setup-go from 5 to 6 in /.github/workflows #429

Uh oh!

Workflow file for this run