From cc0f8da2232fc4114b66374b5fa6f5223660218c Mon Sep 17 00:00:00 2001 From: alex <53851759+alxxjohn@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:07:37 -0400 Subject: [PATCH 1/2] test(ci): pin passing action fixtures to SHAs --- tests/checks/ci_test.go | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/tests/checks/ci_test.go b/tests/checks/ci_test.go index 1d6e3db..b559caa 100644 --- a/tests/checks/ci_test.go +++ b/tests/checks/ci_test.go @@ -30,9 +30,9 @@ func TestCICheckFailsWhenRequiredAssetsAreMissing(t *testing.T) { func TestCICheckPassesWhenRequiredAssetsExist(t *testing.T) { dir := t.TempDir() - writeFile(t, filepath.Join(dir, ".github", "workflows", "ci.yml"), "name: ci\njobs:\n test:\n steps:\n - uses: actions/checkout@v4\n - run: go test ./...\n") - writeFile(t, filepath.Join(dir, ".github", "workflows", "cd.yml"), "name: cd\njobs:\n release-please:\n steps:\n - uses: googleapis/release-please-action@v5\n - run: echo RELEASE_PLEASE_TOKEN\n - run: echo uses: ./.github/workflows/release.yml\n") - writeFile(t, filepath.Join(dir, ".github", "workflows", "release.yml"), "name: release\njobs:\n build-release:\n steps:\n - uses: goreleaser/goreleaser-action@v7\n - run: echo sync-homebrew-formula\n - run: echo Formula/codeguard.rb\n") + writeFile(t, filepath.Join(dir, ".github", "workflows", "ci.yml"), "name: ci\njobs:\n test:\n steps:\n - uses: actions/checkout@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: go test ./...\n") + writeFile(t, filepath.Join(dir, ".github", "workflows", "cd.yml"), "name: cd\njobs:\n release-please:\n steps:\n - uses: googleapis/release-please-action@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: echo RELEASE_PLEASE_TOKEN\n - run: echo uses: ./.github/workflows/release.yml\n") + writeFile(t, filepath.Join(dir, ".github", "workflows", "release.yml"), "name: release\njobs:\n build-release:\n steps:\n - uses: goreleaser/goreleaser-action@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: echo sync-homebrew-formula\n - run: echo Formula/codeguard.rb\n") writeFile(t, filepath.Join(dir, ".goreleaser.yaml"), "version: 2\n") writeFile(t, filepath.Join(dir, ".github", "release-please-config.json"), "{}\n") writeFile(t, filepath.Join(dir, ".release-please-manifest.json"), "{\n \".\": \"0.1.0\"\n}\n") @@ -211,9 +211,9 @@ func ciRuleMessages(report codeguard.Report, ruleID string) []string { func TestCICheckAllowsEmptyReleaseFileOverride(t *testing.T) { dir := t.TempDir() - writeFile(t, filepath.Join(dir, ".github", "workflows", "ci.yml"), "name: ci\njobs:\n test:\n steps:\n - uses: actions/checkout@v4\n - run: make codeguard-ci\n") - writeFile(t, filepath.Join(dir, ".github", "workflows", "cd.yml"), "name: cd\njobs:\n release-please:\n steps:\n - uses: googleapis/release-please-action@v5\n - run: echo RELEASE_PLEASE_TOKEN\n - run: echo uses: ./.github/workflows/release.yml\n") - writeFile(t, filepath.Join(dir, ".github", "workflows", "release.yml"), "name: release\njobs:\n build-release:\n steps:\n - uses: goreleaser/goreleaser-action@v7\n - run: echo sync-homebrew-formula\n - run: echo Formula/codeguard.rb\n") + writeFile(t, filepath.Join(dir, ".github", "workflows", "ci.yml"), "name: ci\njobs:\n test:\n steps:\n - uses: actions/checkout@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: make codeguard-ci\n") + writeFile(t, filepath.Join(dir, ".github", "workflows", "cd.yml"), "name: cd\njobs:\n release-please:\n steps:\n - uses: googleapis/release-please-action@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: echo RELEASE_PLEASE_TOKEN\n - run: echo uses: ./.github/workflows/release.yml\n") + writeFile(t, filepath.Join(dir, ".github", "workflows", "release.yml"), "name: release\njobs:\n build-release:\n steps:\n - uses: goreleaser/goreleaser-action@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: echo sync-homebrew-formula\n - run: echo Formula/codeguard.rb\n") writeFile(t, filepath.Join(dir, "Makefile"), "codeguard-ci:\n\tgo test ./...\n") writeFile(t, filepath.Join(dir, "scripts", "commit.sh"), "#!/usr/bin/env bash\n") @@ -234,7 +234,7 @@ func TestCICheckAllowsEmptyReleaseFileOverride(t *testing.T) { RequiredContains: []string{"googleapis/release-please-action", "uses: ./.github/workflows/release.yml", "RELEASE_PLEASE_TOKEN"}, }, { Path: ".github/workflows/release.yml", - RequiredContains: []string{"goreleaser/goreleaser-action@v7", "sync-homebrew-formula", "Formula/codeguard.rb"}, + RequiredContains: []string{"goreleaser/goreleaser-action@8f3c2b1a4d5e6f7890abc1234567890abc123456", "sync-homebrew-formula", "Formula/codeguard.rb"}, }} report, err := codeguard.Run(context.Background(), cfg) From efa123485eae426de6189e538ea00118a18f6cbe Mon Sep 17 00:00:00 2001 From: alex <53851759+alxxjohn@users.noreply.github.com> Date: Tue, 18 Aug 2026 22:07:51 -0400 Subject: [PATCH 2/2] test(ci): pin configless scan fixture to SHA --- tests/cli/scan_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cli/scan_test.go b/tests/cli/scan_test.go index e551c4e..3d6255e 100644 --- a/tests/cli/scan_test.go +++ b/tests/cli/scan_test.go @@ -177,7 +177,7 @@ func TestRunScanFolderWithoutConfigUsesDefaultProfile(t *testing.T) { writeScanTestFile(t, filepath.Join(dir, "sub", "Makefile"), "test:\n\tgo test ./...\n") writeScanTestFile(t, filepath.Join(dir, "sub", "README.md"), "# Configless scan\n\nRun `make test`.\n") writeScanTestFile(t, filepath.Join(dir, "sub", "AGENTS.md"), "# Agent Notes\n\n## Build & test\n- `make test` runs the unit suite.\n") - writeScanTestFile(t, filepath.Join(dir, "sub", ".github", "workflows", "ci.yml"), "name: ci\non: [push]\njobs:\n test:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n - run: go test ./...\n") + writeScanTestFile(t, filepath.Join(dir, "sub", ".github", "workflows", "ci.yml"), "name: ci\non: [push]\njobs:\n test:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@8f3c2b1a4d5e6f7890abc1234567890abc123456\n - run: go test ./...\n") var stdout, stderr bytes.Buffer code := cli.Run([]string{"scan", "-folder", "sub", "-profile", "startup"}, strings.NewReader(""), &stdout, &stderr)