Update third-party rules as of 2026-06-07 #4507
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright 2024 Chainguard, Inc. | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Go Tests | |
| on: | |
| push: | |
| branches: | |
| - "main" | |
| pull_request: | |
| branches: | |
| - "main" | |
| env: | |
| CGO_ENABLED: "1" | |
| GO_RELEASE: "go-1.26" | |
| YARA_X_RELEASE: "1.17.0" | |
| permissions: {} | |
| jobs: | |
| test: | |
| if: ${{ github.repository == 'chainguard-dev/malcontent' }} | |
| runs-on: ubuntu-latest-arm-16-core | |
| permissions: | |
| contents: read | |
| container: | |
| image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4 | |
| options: >- | |
| --cap-add DAC_OVERRIDE | |
| --cap-add SETGID | |
| --cap-add SETUID | |
| --cap-drop ALL | |
| --cgroupns private | |
| --cpu-shares=16384 | |
| --memory-swappiness=0 | |
| --security-opt no-new-privileges | |
| --ulimit core=0 | |
| --ulimit nofile=65535:65535 | |
| --ulimit nproc=65535:65535 | |
| steps: | |
| - name: Install dependencies | |
| run: | | |
| apk update | |
| apk add curl findutils gcc git gnutar "${GO_RELEASE}" make nodejs pkgconf upx xz "yara-x~${YARA_X_RELEASE}" | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Trust repository | |
| run: git config --global --add safe.directory "${GITHUB_WORKSPACE}" | |
| - name: Get Go cache paths | |
| id: go-env | |
| run: | | |
| echo "modcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT" | |
| echo "cache=$(go env GOCACHE)" >> "$GITHUB_OUTPUT" | |
| - name: Cache Go dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ${{ steps.go-env.outputs.modcache }} | |
| ${{ steps.go-env.outputs.cache }} | |
| key: go-${{ hashFiles('go.sum') }} | |
| restore-keys: go- | |
| - name: Unit tests | |
| run: make test | |
| integration: | |
| if: ${{ github.repository == 'chainguard-dev/malcontent' }} | |
| runs-on: ubuntu-latest-arm-16-core | |
| permissions: | |
| contents: read | |
| container: | |
| image: cgr.dev/chainguard/wolfi-base:latest@sha256:9a74366aa10eff2bf14dab0948123bd2c51703e1c553a73740ef687f723aecf4 | |
| options: >- | |
| --cap-add DAC_OVERRIDE | |
| --cap-add SETGID | |
| --cap-add SETUID | |
| --cap-drop ALL | |
| --cgroupns private | |
| --cpu-shares=32768 | |
| --memory-swappiness=0 | |
| --security-opt no-new-privileges | |
| --ulimit core=0 | |
| --ulimit nofile=65535:65535 | |
| --ulimit nproc=65535:65535 | |
| steps: | |
| - name: Install dependencies | |
| run: | | |
| apk update | |
| apk add curl findutils gcc git gnutar "${GO_RELEASE}" make nodejs pkgconf upx xz "yara-x~${YARA_X_RELEASE}" | |
| - name: Checkout code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Trust repository | |
| run: git config --global --add safe.directory "${GITHUB_WORKSPACE}" | |
| - name: Get Go cache paths | |
| id: go-env | |
| run: | | |
| echo "modcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT" | |
| echo "cache=$(go env GOCACHE)" >> "$GITHUB_OUTPUT" | |
| - name: Cache Go dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: | | |
| ${{ steps.go-env.outputs.modcache }} | |
| ${{ steps.go-env.outputs.cache }} | |
| key: go-${{ hashFiles('go.sum') }} | |
| restore-keys: go- | |
| - name: Get samples commit | |
| id: samples | |
| run: echo "commit=$(grep '^SAMPLES_COMMIT' Makefile | head -1 | cut -d'=' -f2 | tr -d ' ?')" >> "$GITHUB_OUTPUT" | |
| - name: Cache malcontent samples | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 | |
| with: | |
| path: out/chainguard-sandbox/malcontent-samples | |
| key: samples-${{ steps.samples.outputs.commit }} | |
| - name: Prepare samples | |
| run: make samples | |
| - name: Integration tests | |
| run: make integration |