Merge branch 'main' into bumpcos

ci/go-ossf-slsa3-publish.yml

@@ -0,0 +1,35 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow lets you compile your Go project using a SLSA3 compliant builder. 
+# This workflow will generate a so-called "provenance" file describing the steps 
+# that were performed to generate the final binary.
+# The project is an initiative of the OpenSSF (openssf.org) and is developed at 
+# https://github.com/slsa-framework/slsa-github-generator.
+# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
+# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.
+
+name: SLSA Go releaser
+on:
+  workflow_dispatch:
+  release:
+    types: [created]
+
+permissions: read-all
+
+jobs:
+  build:
+    permissions:
+      id-token: write # To sign.
+      contents: write # To upload release assets.
+      actions: read   # To read workflow path.
+    # If you need more configuration options, such as ldflag examples, 
+    # visit https://github.com/slsa-framework/slsa-github-generator#golang-projects.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.1.1
+    with:
+      # By default, the config file is .slsa-goreleaser.yml in the root directory.
+      # The format of the config file is described in 
+      # https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/go/README.md#configuration-file.
+      go-version: 1.17

ci/gradle-publish.yml

@@ -30,14 +30,14 @@ jobs:
         settings-path: ${{ github.workspace }} # location for the settings.xml file
 
     - name: Build with Gradle
-      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee
+      uses: gradle/gradle-build-action@67421db6bd0bf253fb4bd25b31ebb98943c375e1
       with:
         arguments: build
 
     # The USERNAME and TOKEN need to correspond to the credentials environment variables used in
     # the publishing section of your build.gradle
     - name: Publish to GitHub Packages
-      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee
+      uses: gradle/gradle-build-action@67421db6bd0bf253fb4bd25b31ebb98943c375e1
       with:
         arguments: publish
       env:

ci/gradle.yml

@@ -29,6 +29,6 @@ jobs:
         java-version: '11'
         distribution: 'temurin'
     - name: Build with Gradle
-      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee
+      uses: gradle/gradle-build-action@67421db6bd0bf253fb4bd25b31ebb98943c375e1
       with:
         arguments: build

ci/properties/go-ossf-slsa3-publish.properties.json

@@ -0,0 +1,7 @@
+{
+    "name": "SLSA Go releaser",
+    "creator": "Open Source Security Foundation (OpenSSF)",
+    "description": "Compile your Go project using a SLSA3 compliant builder",
+    "iconName": "go-ossf-slsa3-publish",
+    "categories": ["Continuous integration", "Go"]
+}

ci/scala.yml

@@ -21,5 +21,6 @@ jobs:
       with:
         java-version: '11'
         distribution: 'temurin'
+        cache: 'sbt'
     - name: Run tests
       run: sbt test