ci: adopt tctest's pinned tooling, workflow hardening, and release signing; go 1.26.6

.github/actionlint-matcher.json

@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+# Configuration for rhysd/actionlint (run by .github/workflows/workflow-actionlint.yml); this is
+# actionlint's default config path, so it is picked up automatically.
+
+# No configuration variables (the `vars` context) are defined for this repository; declaring an
+# empty list makes actionlint error on any ${{ vars.* }} reference instead of accepting it silently.
+config-variables: []

.github/dependabot.yml

@@ -11,3 +11,10 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+
+  # dev tools (actionlint, golangci-lint, gofumpt) pinned in .tools/go.mod; tools move slowly,
+  # so only check quarterly
+  - package-ecosystem: "gomod"
+    directory: "/.tools"
+    schedule:
+      interval: "quarterly"

.github/workflows/build.yaml

@@ -1,5 +1,5 @@
 ---
-name: build
+name: Build
 on:
   push:
     branches: [ 'main' ]
@@ -18,8 +18,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./.go-version
       - run: make build

.github/workflows/codeql-analysis.yml

@@ -9,7 +9,7 @@
 # the `language` matrix defined below to confirm you have the correct set of
 # supported CodeQL languages.
 #
-name: "codeQL"
+name: CodeQL
 
 on:
   push:
@@ -20,6 +20,9 @@ on:
   schedule:
     - cron: '33 3 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -33,29 +36,29 @@ jobs:
       fail-fast: false
       matrix:
         include:
-        - language: go
-          build-mode: autobuild
-        - language: actions
-          build-mode: none
-        # CodeQL also supports cpp, csharp, java, javascript, python, ruby, swift, kotlin
-        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+          # CodeQL also supports cpp, csharp, java, javascript, python, ruby, swift, kotlin
+          # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+          - language: go
+            build-mode: autobuild
+          - language: actions
+            build-mode: none
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v7
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-        queries: security-extended,security-and-quality
-        config: |
-          paths-ignore:
-            - vendor
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended,security-and-quality
+          config: |
+            paths-ignore:
+              - vendor
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:${{ matrix.language }}"
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/check-against-providers.yaml → .github/workflows/pr-check-against-providers.yaml

@@ -1,5 +1,5 @@
 ---
-name: check against providers
+name: Check Against Providers
 on:
   pull_request:
     types: ['opened', 'synchronize']
@@ -8,7 +8,7 @@ on:
       - 'go.mod'
       - 'vendor/**'
       - 'scripts/check-against-providers.sh'
-      - '.github/workflows/check-against-providers.yaml'
+      - '.github/workflows/pr-check-against-providers.yaml'
 
 permissions:
   contents: read
@@ -17,10 +17,10 @@ jobs:
   check-against-providers:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # the golden comparison builds origin/main too
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./.go-version
       - name: checkout provider repos (sparse)

.github/workflows/depscheck.yaml → .github/workflows/pr-depscheck.yaml

@@ -1,5 +1,5 @@
 ---
-name: vendor dependencies check
+name: Vendor Dependencies Check
 on:
   push:
     branches: [ 'main' ]
@@ -9,6 +9,7 @@ on:
       - '.github/**'
       - '**.go'
       - 'vendor/**'
+      - '.tools/**'
       - '.github/workflows/**'
 
 permissions:
@@ -18,8 +19,8 @@ jobs:
   depscheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./.go-version
       - run: make depscheck

.github/workflows/pr-golangci-lint.yaml

@@ -0,0 +1,38 @@
+---
+name: GolangCI Lint
+on:
+  push:
+    branches: [ 'main' ]
+  pull_request:
+    types: ['opened', 'synchronize']
+    paths:
+      - '.github/**'
+      - '**.go'
+      - 'vendor/**'
+      - '.tools/**'
+      - '.github/workflows/**'
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: ./.go-version
+      # build the custom binary (golangci-lint + azproviderlint plugin, versions pinned in
+      # .tools/.custom-gcl.yml) so CI and make use the same binary, then hand it to the action
+      # as `golangci-lint` (install-mode: none) which still provides caching and annotations
+      - name: Build golangci-lint with plugins from .tools
+        run: |
+          make .tools/bin/golangci-with-modules
+          mkdir -p "$RUNNER_TEMP/gclbin"
+          ln -s "$PWD/.tools/bin/golangci-with-modules" "$RUNNER_TEMP/gclbin/golangci-lint"
+          echo "$RUNNER_TEMP/gclbin" >> "$GITHUB_PATH"
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
+        with:
+          install-mode: none
+          args: -v

.github/workflows/govulncheck.yaml → .github/workflows/pr-govulncheck.yaml

@@ -1,5 +1,5 @@
 ---
-name: govulncheck
+name: Go Vulnerability Check
 on:
   push:
     branches: [ 'main' ]
@@ -10,7 +10,7 @@ on:
       - 'go.mod'
       - 'go.sum'
       - 'vendor/**'
-      - '.github/workflows/govulncheck.yaml'
+      - '.github/workflows/pr-govulncheck.yaml'
   schedule:
     - cron: '17 4 * * 1' # weekly, so new CVEs against unchanged code still get flagged
 

.github/workflows/test.yaml → .github/workflows/pr-tests.yaml

@@ -1,5 +1,5 @@
 ---
-name: test
+name: Tests
 on:
   push:
     branches: [ 'main' ]
@@ -8,6 +8,9 @@ on:
     paths:
       - '.github/**'
       - '**.go'
+      - 'go.mod'
+      - 'go.sum'
+      - 'makefile'
       - 'vendor/**'
       - '.github/workflows/**'
 
@@ -18,8 +21,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./.go-version
       - run: make test

.github/workflows/release.yaml

@@ -1,34 +1,59 @@
 ---
-name: release
+name: Release
 on:
   push:
     tags: ['v*']
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # goreleaser uploads the release and its assets
+      id-token: write # cosign keyless signing and attestation signing via OIDC
+      attestations: write # actions/attest-build-provenance stores attestations
+    outputs:
+      hashes: ${{ steps.hashes.outputs.hashes }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0 # goreleaser derives the changelog and version from tag history
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ./.go-version
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           version: '~> v2'
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: export artifact hashes for slsa provenance
+        id: hashes
+        run: echo "hashes=$(base64 -w0 < ./dist/checksums.txt)" >> "$GITHUB_OUTPUT"
+      - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-checksums: ./dist/checksums.txt # attest every artifact goreleaser published
+
+  provenance:
+    needs: goreleaser
+    permissions:
+      actions: read # read the workflow run to record the build context
+      id-token: write # sign the provenance
+      contents: write # upload multiple.intoto.jsonl to the release
+    # the slsa builder must be referenced by tag, not commit hash; it verifies its own ref at runtime
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    with:
+      base64-subjects: ${{ needs.goreleaser.outputs.hashes }}
+      upload-assets: true
 
   homebrew:
     needs: goreleaser
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: update tap formula (source build)
         env:
           TAG: ${{ github.ref_name }}

.github/workflows/shellcheck.yaml

@@ -0,0 +1,21 @@
+name: ShellCheck
+on:
+  push:
+    branches: [ 'main' ]
+  pull_request:
+    types: ['opened', 'synchronize']
+    paths:
+      - '**.sh'
+      - 'makefile'
+      - '.github/workflows/shellcheck.yaml'
+
+permissions:
+  contents: read
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # shellcheck is preinstalled on ubuntu-latest
+      - run: make shellcheck