BeyondTrust · thejurysays · Feb 27, 2024 · Feb 27, 2024
@@ -1,4 +1,4 @@
--  params:
+- params:
     git:
       repoName: go-client-library-passwordsafe
       branches:
@@ -8,4 +8,4 @@
       failOnSecurityIssues: false
       projects:
         - workingDirs:
-            - "."
+            - "."
@@ -3,4 +3,4 @@ updates:
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "weekly"
@@ -1 +1 @@
-releaseType: simple
+releaseType: simple
@@ -1,4 +1,3 @@
 _extends: .github
 repository:
   private: false
-
@@ -12,7 +12,7 @@ permissions:
 jobs:
   analyze_on_PR:
     name: Analyze on PR
-    if: ${{ github.actor != 'dependabot[bot]' && ( github.event_name == 'pull_request' ||  github.event_name == 'pull_request_target' )}}
+    if: ${{ github.actor != 'dependabot[bot]' && ( github.event_name == 'pull_request' ||  github.event_name == 'pull_request_target' ) }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -21,26 +21,25 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
           ref: ${{ github.head_ref }}
-
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5
         with:
           config-file: codeql-config.yml
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
-    
+        uses: github/codeql-action/analyze@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5
+
   analyze_on_branch:
-    name: Analyze on branch 
+    name: Analyze on branch
     if: ${{ github.actor != 'dependabot[bot]' && ( github.event_name != 'pull_request' &&  github.event_name != 'pull_request_target' ) }}
     runs-on: ubuntu-latest
     strategy:
@@ -50,7 +49,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
           ref: ${{ github.ref }}
@@ -60,13 +59,13 @@ jobs:
           echo ${{ github.event_name }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5
         with:
           config-file: codeql-config.yml
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@47b3d888fe66b639e431abf22ebca059152f1eea # v3.24.5
@@ -12,19 +12,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/[email protected]
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
-      
+
       - name: Set up JFrog
-        uses: jfrog/setup-jfrog-cli@v4
+        uses: jfrog/setup-jfrog-cli@26da2259ee7690e63b5410d7451b2938d08ce1f9 # v4.0.0
         env:
           JF_ENV_1: ${{ secrets.ARTIFACTORY_DEPLOYER }}
-          
+
       - name: Run XRay scan
-        uses: jfrog/[email protected]
+        uses: jfrog/frogbot@ba42e26db24cec85bd14e096dfc2e01fb85ac29f # v2.19.10
         env:
           JF_URL: https://beyondtrust.jfrog.io
           JF_ACCESS_TOKEN: ${{ secrets.ARTIFACTORY_FROGBOT_TOKEN }}
-          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -5,7 +5,7 @@ on:
     types: [opened, synchronize]
   push:
     branches:
-    - main
+      - main
   workflow_dispatch:
 
 permissions:
@@ -19,8 +19,8 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      
+
       - name: Go Lint
-        uses: golangci/[email protected]
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
         with:
-          version: v1.54
+          version: v1.54
@@ -10,7 +10,7 @@ on:
     types: [opened, synchronize]
   push:
     branches:
-    - main
+      - main
   workflow_dispatch:
 
 permissions:
@@ -28,21 +28,21 @@ jobs:
       - name: Build library
         run: |
           go build
-        
+
       - name: Run unit tests
         run: |
           cd api
           go test -race -coverprofile=coverage.out -v ./...
           go tool cover -func="coverage.out"
 
       - name: Save unit tests coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: coverage
           path: api/coverage.out
 
       - name: Save built library
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: library
           path: go-client-library-passwordsafe
@@ -55,31 +55,31 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
-      
+
       - name: Download coverage
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85 # v4.1.3
         with:
           name: coverage
 
       - name: SonarQube Scan on PR
-        if: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request' }} 
-        uses: sonarsource/sonarqube-scan-action@master
+        if: ${{ github.actor != 'dependabot[bot]' && github.event_name == 'pull_request' }}
+        uses: sonarsource/sonarqube-scan-action@69c1a75940dec6249b86dace6b630d3a2ae9d2a7 # v2.0.1
         with:
           projectBaseDir: .
           args: >
             -Dsonar.projectKey=${{ github.event.repository.name }}
             -Dsonar.pullrequest.key=${{ github.event.number }}
             -Dsonar.pullrequest.branch=${{ github.head_ref }}
-            -Dsonar.pullrequest.base=${{ github.base_ref }}}
+            -Dsonar.pullrequest.base=${{ github.base_ref }}
             -Dsonar.go.coverage.reportPaths=coverage.out
             -Dsonar.exclusions=api/**/**_test.go,api/entities/**,api/logging/**,api/utils/**,TestClient.go
         env:
           SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
           SONAR_HOST_URL: https://sonar.dev.beyondtrust.com
-          
+
       - name: SonarQube Scan on branch
-        if: ${{ github.actor != 'dependabot[bot]' && github.event_name != 'pull_request' }} 
-        uses: sonarsource/sonarqube-scan-action@master
+        if: ${{ github.actor != 'dependabot[bot]' && github.event_name != 'pull_request' }}
+        uses: sonarsource/sonarqube-scan-action@69c1a75940dec6249b86dace6b630d3a2ae9d2a7 # v2.0.1
         with:
           projectBaseDir: .
           args: >
@@ -91,12 +91,12 @@ jobs:
           SONAR_HOST_URL: https://sonar.dev.beyondtrust.com
 
       - name: SonarQube Quality Gate check
-        if: ${{ github.actor != 'dependabot[bot]' && inputs.quality_gate_check }} 
-        uses: sonarsource/sonarqube-quality-gate-action@master
+        if: ${{ github.actor != 'dependabot[bot]' }}
+        uses: sonarsource/sonarqube-quality-gate-action@d304d050d930b02a896b0f85935344f023928496 # v1.1.0
         timeout-minutes: 5
         env:
           SONAR_TOKEN: ${{ env.SONAR_TOKEN }}
-          
+
   x-ray:
     needs: [build, sonarqube]
     runs-on: ubuntu-latest
@@ -107,23 +107,23 @@ jobs:
           fetch-depth: 0
 
       - name: Jfrog setup
-        uses: jfrog/[email protected]
+        uses: jfrog/setup-jfrog-cli@26da2259ee7690e63b5410d7451b2938d08ce1f9 # v4.0.0
         env:
           JF_ENV_1: ${{ secrets.ARTIFACTORY_DEPLOYER }}
-        
+
       - name: Setting up artifactory
         run: |
           mkdir go-library-passwordsafe
 
       - name: Download library binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@87c55149d96e628cc2ef7e6fc2aab372015aec85 # v4.1.3
         with:
           name: library
           path: go-library-passwordsafe
-    
-      - name: Send artifacts to Jfrog 
+
+      - name: Send artifacts to Jfrog
         run: |
-          jfrog rt u "go-library-passwordsafe/*" ${{ env.JFROG_SERVER}}
+          jfrog rt u "go-library-passwordsafe/*" ${{ env.JFROG_SERVER }}
 
       - name: Publish Build Information
         run: |
@@ -132,4 +132,4 @@ jobs:
           jfrog rt build-publish ${{ env.JFROG_CLI_BUILD_NAME }} ${{ env.JFROG_CLI_BUILD_NUMBER }}
 
       - name: Scan Build
-        run: jfrog rt build-scan ${{ env.JFROG_CLI_BUILD_NAME }} ${{ env.JFROG_CLI_BUILD_NUMBER }}
+        run: jfrog rt build-scan ${{ env.JFROG_CLI_BUILD_NAME }} ${{ env.JFROG_CLI_BUILD_NUMBER }}
@@ -4,7 +4,7 @@
 
 #### Bug Fixes
 
-* solve minnor issues and linting issues ([#30](https://github.com/BeyondTrust/go-client-library-passwordsafe/issues/30))
+* solve minor issues and linting issues ([#30](https://github.com/BeyondTrust/go-client-library-passwordsafe/issues/30))
 
 ### [0.2.0](https://github.com/BeyondTrust/go-client-library-passwordsafe/compare/v0.1.0...v0.2.0) / 2024-02-23
 

@@ -112,11 +112,11 @@ community.
 ## Attribution
 This Code of Conduct is adapted from the Contributor Covenant,
 version 2.1, available at
-[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+[v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).
 
 Community Impact Guidelines were inspired by
 Mozilla's code of conduct enforcement ladder.
 
 For answers to common questions about this code of conduct, see the FAQ at
-[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
-[https://www.contributor-covenant.org/translations][translations].
+[FAQ](https://www.contributor-covenant.org/faq). Translations are available at
+[translations](https://www.contributor-covenant.org/translations).