AST-162098: Migrate CI/CD from CircleCI to GitHub Actions - #49
AST-162098: Migrate CI/CD from CircleCI to GitHub Actions#49cx-avi-sabzerou wants to merge 5 commits into
Conversation
CircleCI is no longer in use org-wide. Replaces the CircleCI lint job with a GitHub Actions workflow, migrates golangci-lint config to v2 (EOL v1 line), and adds govulncheck + PR title linting adopted from the ast-cli repo's GitHub Actions setup. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-avi-sabzerou) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Security Policy Alert: Secret Policy ViolationThis workflow run has been blocked by StepSecurity's secrets policy because it accesses secrets and the workflow file differs from the default branch. Secret references detected:
To approve this workflow, please add the Note: The label must be added by someone other than the PR author (cx-avi-sabzerou) or automation bots to ensure proper security review. After the label is added, you can re-run the blocked workflow to proceed. This workflow will be automatically approved once merged into the default branch. For more information, see StepSecurity's Secret Exfiltration Policy documentation. |
Move secrets.GITHUB_TOKEN out of inline run: script interpolation and
into env:, since GitHub expands ${{ }} before the shell sees it,
making inline use flaggable as template injection.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The repo's allowlist-style .gitignore silently dropped CLAUDE.md since *.md wasn't in the allowed patterns, so it was never actually tracked. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Upgrade google.golang.org/grpc v1.80.0 -> v1.82.1, remediating GHSA-hrxh-6v49-42gf (High, CVSS 8.8): xDS RBAC authorization bypass and HTTP/2 Rapid Reset DoS in grpc-go. Upgrade golang.org/x/net v0.54.0 -> v0.57.0, remediating CVE-2026-25680 (Medium, CVSS 6.5): excessive CPU consumption when parsing crafted HTML. The manual golang.org/x/crypto and github.com/go-jose/go-jose/v4 pins are no longer needed as explicit requires — the upgraded grpc and x/net now pull the same safe versions (v0.54.0 / v4.1.4) transitively, confirmed via `go list -m all`. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
1 participant
Summary
.circleci/config.ymland replaces itslintjob with.github/workflows/lint.yaml(GitHub Actions)..golangci.ymlfrom the frozen golangci-lint v1 schema to v2 (same effective linter set; two small source fixes ininternal/secrets/maskSecrets.gosurfaced along the way — a duplicated"HIGH"literal extracted to a constant, and a variable rename to fix an import shadow)..github/workflows/govulncheck.yaml(Go vulnerability scanning on PRs) and.github/workflows/pr-linter.yaml(validates PR title formatAST-XXXX: Description), adopted from theast-clirepo's GitHub Actions setup and adapted for this repo's private-module (GOPRIVATE) needs and PR title conventions.Test plan
go build ./...,go vet ./...,go test ./...pass locally.golangci-lint run(v2.12.2) passes with only pre-existing findings (verified no new findings introduced by the v1→v2 config migration).