Update deps

.github/workflows/ci.yml

@@ -9,33 +9,42 @@ on:
       - main
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
     runs-on: ubuntu-24.04
+    timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./go.mod
       - name: Install Pkger
         run: go install --mod=readonly github.com/markbates/pkger/cmd/pkger
       - name: Build
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
-          version: latest
+          version: v2.18.2
           args: --clean --snapshot
 
   test:
     name: Test
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./go.mod
       - name: Test
@@ -44,56 +53,68 @@ jobs:
   integration_ghes:
     name: Integration Test (GitHub Enterprise Server)
     runs-on: ubuntu-latest-xl
-    if: ${{ github.event != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+    timeout-minutes: 30
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./go.mod
       - name: Build
         run: go build
       - name: Test
-        run: ./codeql-action-sync sync --destination-url https://ghe.io/ --destination-repository codeql-action-sync-tool/integration-test
+        run: >-
+          ./codeql-action-sync sync
+          --source-token "$SOURCE_TOKEN"
+          --destination-url https://ghe.io/
+          --destination-repository codeql-action-sync-tool/integration-test
         env:
+          SOURCE_TOKEN: ${{ github.token }}
           CODEQL_ACTION_SYNC_TOOL_DESTINATION_TOKEN: ${{ secrets.INTEGRATION_TEST_GHES_TOKEN }}
 
   lint:
     name: Lint
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./go.mod
       - name: Check Modules
         run: |
           go mod tidy
-          if [ ! -z "$(git status --porcelain=v1)" ]; then
-            >&2 echo "Please run \`go mod tidy\` and commit the result."
-            exit 1
-          fi
+          git diff --exit-code -- go.mod go.sum
       - name: Lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.1.6
+          version: v2.13.2
 
   licensedci:
     name: Check Licenses
     runs-on: ubuntu-24.04
+    timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./go.mod
       - name: Setup licensedci
-        uses: jonabc/setup-licensed@d6b3a6f7058c2b40c06d205e13e15c2418977566 # v1.1.4
+        uses: licensee/setup-licensed@0d52e575b3258417672be0dff2f115d7db8771d8 # v1.3.2
         with:
-          version: 2.x
+          version: 2.15.2
+          github_token: ${{ github.token }}
       - name: Run licensedci
         run: licensed status

.github/workflows/release.yml

@@ -5,25 +5,30 @@ on:
     tags:
       - "**"
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./go.mod
       - name: Install Pkger
         run: go install --mod=readonly github.com/markbates/pkger/cmd/pkger
       - name: Release
-        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
-          version: latest
+          version: v2.18.2
           args: release --clean
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}

.goreleaser.yml

@@ -1,11 +1,15 @@
+version: 2
+
 project_name: codeql-action-sync
 
 before:
   hooks:
     - pkger
 
 builds:
-  - goos: [linux, darwin, windows]
+  - flags:
+      - -mod=mod
+    goos: [linux, darwin, windows]
     goarch: [386, amd64, arm64]
     ignore:
       - goos: darwin

.licensed.yml

@@ -9,3 +9,7 @@ ignored:
   go:
     - golang.org/x/**/*
     - github.com/ProtonMail/go-crypto/**/* # A fork of golang.org/x/crypto/openpgp.
+
+reviewed:
+  go:
+    - github.com/cloudflare/circl/**/* # BSD-3-Clause; licensed classifies the combined license text as other.