AST-162098: Migrate CI/CD from CircleCI to GitHub Actions - #49
Open
cx-avi-sabzerou wants to merge 7 commits into
Open
AST-162098: Migrate CI/CD from CircleCI to GitHub Actions#49cx-avi-sabzerou wants to merge 7 commits into
cx-avi-sabzerou wants to merge 7 commits into
Conversation
CircleCI is no longer in use org-wide. Replaces the CircleCI lint job with a GitHub Actions workflow, migrates golangci-lint config to v2 (EOL v1 line), and adds govulncheck + PR title linting adopted from the ast-cli repo's GitHub Actions setup. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
Original alert (resolved)Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-avi-sabzerou) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Contributor
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-avi-sabzerou) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Move secrets.GITHUB_TOKEN out of inline run: script interpolation and
into env:, since GitHub expands ${{ }} before the shell sees it,
making inline use flaggable as template injection.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The repo's allowlist-style .gitignore silently dropped CLAUDE.md since *.md wasn't in the allowed patterns, so it was never actually tracked. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Upgrade google.golang.org/grpc v1.80.0 -> v1.82.1, remediating GHSA-hrxh-6v49-42gf (High, CVSS 8.8): xDS RBAC authorization bypass and HTTP/2 Rapid Reset DoS in grpc-go. Upgrade golang.org/x/net v0.54.0 -> v0.57.0, remediating CVE-2026-25680 (Medium, CVSS 6.5): excessive CPU consumption when parsing crafted HTML. The manual golang.org/x/crypto and github.com/go-jose/go-jose/v4 pins are no longer needed as explicit requires — the upgraded grpc and x/net now pull the same safe versions (v0.54.0 / v4.1.4) transitively, confirmed via `go list -m all`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Codecov's GPG signature check fetches its public key from keybase.io, which has been sunset — verification now fails with "no valid OpenPGP data found" regardless of network access, even after DevOps allowlisted the egress. Pass skip_validation: true (Codecov's own documented escape hatch for this) so coverage upload can proceed. Fix remaining Zizmor findings flagged by DevOps on the pre-existing codecov-scan.yaml and cx-one-scan.yaml (not touched by the CircleCI migration itself): missing persist-credentials: false, missing job name, missing concurrency group, and missing top-level permissions block. Patterned after Checkmarx/ast-cli-java-wrapper's checkmarx-one-scan.yml per DevOps's suggestion. Also fix two lll (line-too-long) violations in maskSecrets.go introduced by the earlier golangci-lint v2 migration's severityHigh constant extraction. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…computed coverage DevOps flagged govulncheck.yaml for an unnecessary CheckmarxDev/GOPRIVATE git-credential rewrite step. This repo has zero actual CheckmarxDev private dependencies (confirmed via go.mod/go.sum/grep) — the step was dead weight copied forward from the old CircleCI config. Removed from govulncheck.yaml, lint.yaml, and codecov-scan.yaml, all of which carried the same unused pattern, since none of them touch private modules. Replaced the Codecov-based coverage workflow with a self-computed coverage report, matching Checkmarx/ast-cli's unit-tests.yml approach: `go tool cover -func` computes the percentage, printed to the job summary, with the HTML report uploaded as a build artifact. This drops the CODECOV_TOKEN dependency entirely, which had been blocking this check regardless of StepSecurity/Harden-Runner egress fixes (Codecov requires a token for protected-branch uploads that was never actually provisioned on this repo). No hard coverage gate is enforced yet since current coverage (~20%) is well below a reasonable bar — can add one once coverage improves. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.circleci/config.ymland replaces itslintjob with.github/workflows/lint.yaml(GitHub Actions)..golangci.ymlfrom the frozen golangci-lint v1 schema to v2 (same effective linter set; two small source fixes ininternal/secrets/maskSecrets.gosurfaced along the way — a duplicated"HIGH"literal extracted to a constant, and a variable rename to fix an import shadow)..github/workflows/govulncheck.yaml(Go vulnerability scanning on PRs) and.github/workflows/pr-linter.yaml(validates PR title formatAST-XXXX: Description), adopted from theast-clirepo's GitHub Actions setup and adapted for this repo's private-module (GOPRIVATE) needs and PR title conventions.Test plan
go build ./...,go vet ./...,go test ./...pass locally.golangci-lint run(v2.12.2) passes with only pre-existing findings (verified no new findings introduced by the v1→v2 config migration).