ci(actions): bump codecov-action from v6 to v7

- Update codecov/codecov-action from v6 to v7
chore: bump go directive to 1.25.10
2026-06-13 18:51:38 +08:00 · 2026-06-13 15:46:29 +08:00 · 2026-05-08 21:19:20 +08:00 · 2026-05-08 20:13:39 +08:00 · 2026-04-25 16:51:02 +08:00 · 2026-04-16 23:23:44 +08:00
10 changed files with 154 additions and 34 deletions
@@ -38,11 +38,11 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,4 +51,4 @@ jobs:
          # queries: ./path/to/local/query, your-org/your-repo/queries@main

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
@@ -10,16 +10,22 @@ on:
    branches:
      - "master"

+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
 jobs:
  build-docker:
    runs-on: ubuntu-latest
    steps:
      - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: "^1"
+          check-latest: true
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

@@ -28,19 +34,19 @@ jobs:
          make build_linux_amd64
          make build_linux_arm64
      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -48,7 +54,7 @@ jobs:

      - name: Docker meta
        id: docker-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ github.repository }}
@@ -59,8 +65,34 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

+      - name: Build image for scanning
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: drone-discord:scan
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "drone-discord:scan"
+          format: "sarif"
+          output: "trivy-image-results.sarif"
+          severity: "CRITICAL,HIGH"
+          exit-code: '1'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-image-results.sarif"
+          category: "trivy-docker-image"
+
      - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -13,16 +13,17 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: "^1"
+          check-latest: true

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
@@ -9,18 +9,19 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: "^1"
+          check-latest: true
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
      - name: Setup golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@v9
        with:
-          version: v2.1
+          version: v2.12
          args: --verbose

-      - uses: hadolint/hadolint-action@v3.1.0
+      - uses: hadolint/hadolint-action@v3.3.0
        name: hadolint for Dockerfile
        with:
          dockerfile: docker/Dockerfile
@@ -29,7 +30,7 @@ jobs:
    strategy:
      matrix:
        os: [ubuntu-latest]
-        go: [1.23, 1.24]
+        go: [1.25, 1.26]
        include:
          - os: ubuntu-latest
            go-build: ~/.cache/go-build
@@ -40,16 +41,17 @@ jobs:
      GOPROXY: https://proxy.golang.org
    steps:
      - name: Set up Go ${{ matrix.go }}
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version: ${{ matrix.go }}
+          check-latest: true

      - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          ref: ${{ github.ref }}

-      - uses: actions/cache@v4
+      - uses: actions/cache@v5
        with:
          path: |
            ${{ matrix.go-build }}
@@ -65,6 +67,6 @@ jobs:
          go test -v -covermode=atomic -coverprofile=coverage.out

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
        with:
          flags: ${{ matrix.os }},go-${{ matrix.go }}
@@ -0,0 +1,84 @@
+name: Trivy Security Scan
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy-repo-scan:
+    name: Trivy Repository Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Run Trivy vulnerability scanner (repo)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: "fs"
+          scan-ref: "."
+          format: "sarif"
+          output: "trivy-repo-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-repo-results.sarif"
+
+  trivy-image-scan:
+    name: Trivy Image Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Build binary
+        run: |
+          make build_linux_amd64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build Docker image for scanning
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: drone-discord:scan
+
+      - name: Run Trivy vulnerability scanner (image)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "drone-discord:scan"
+          format: "sarif"
+          output: "trivy-image-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy image scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-image-results.sarif"
+          category: "trivy-image"
@@ -5,6 +5,7 @@
 [Drone](https://www.drone.io/) / [Woodpecker](https://woodpecker-ci.org/) plugin for sending messages to Discord channels using Webhooks.

 [![GoDoc](https://godoc.org/github.com/appleboy/drone-discord?status.svg)](https://godoc.org/github.com/appleboy/drone-discord)
+[![Trivy Security Scan](https://github.com/appleboy/drone-discord/actions/workflows/trivy.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-discord/actions/workflows/trivy.yml)
 [![codecov](https://codecov.io/gh/appleboy/drone-discord/branch/master/graph/badge.svg)](https://codecov.io/gh/appleboy/drone-discord)
 [![Go Report Card](https://goreportcard.com/badge/github.com/appleboy/drone-discord)](https://goreportcard.com/report/github.com/appleboy/drone-discord)
 [![Docker Pulls](https://img.shields.io/docker/pulls/appleboy/drone-discord.svg)](https://hub.docker.com/r/appleboy/drone-discord/)
@@ -1,4 +1,4 @@
-FROM alpine:3.21
+FROM alpine:3.23

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,6 +1,6 @@
 module github.com/appleboy/drone-discord

-go 1.23.0
+go 1.25.10

 require (
 	github.com/appleboy/drone-template-lib v1.3.0
@@ -28,7 +28,7 @@ require (
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cast v1.9.2 // indirect
 	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
-	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -57,12 +57,12 @@ github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGC
 github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yassinebenaid/godump v0.11.1 h1:SPujx/XaYqGDfmNh7JI3dOyCUVrG0bG2duhO3Eh2EhI=
 github.com/yassinebenaid/godump v0.11.1/go.mod h1:dc/0w8wmg6kVIvNGAzbKH1Oa54dXQx8SNKh4dPRyW44=
-golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
-golang.org/x/crypto v0.39.0/go.mod h1:L+Xg3Wf6HoL4Bn4238Z6ft6KfEpN0tJGo53AAPC632U=
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
@@ -116,8 +116,8 @@ func TestColorConversion(t *testing.T) {
 		expectedFall int
 	}{
 		{"valid hex", "#ffaa00", 16755200, "success", 1752220},
-		{"invalid hex", "not-a-hex", 0, "failure", 16724530},
-		{"status success", "", 0, "success", 1752220},
+		{"invalid hex", "not-a-hex", 16724530, "failure", 16724530},
+		{"status success", "", 0, "success", 1754624},
 		{"status failure", "", 0, "failure", 16724530},
 		{"status killed", "", 0, "killed", 16724530},
 		{"status default", "", 0, "running", 16767280},
Author	SHA1	Message	Date
Bo-Yi Wu	6a809efc79	ci(actions): bump codecov-action from v6 to v7 - Update codecov/codecov-action from v6 to v7	2026-06-13 15:46:29 +08:00
Bo-Yi Wu	2f461525af	chore: bump go directive to 1.25.10 - Update go.mod go directive from 1.25.9 to 1.25.10	2026-05-08 21:19:20 +08:00
Bo-Yi Wu	5f9d683257	ci: bump golangci-lint to v2.12 - Upgrade golangci-lint version from v2.11 to v2.12	2026-05-08 20:13:39 +08:00
Bo-Yi Wu	66afccb389	ci(actions): bump trivy-action to v0.36.0 and codecov-action to v6	2026-04-25 16:51:02 +08:00
Bo-Yi Wu	8c87ebd4ef	docs(readme): add Trivy security scan badge	2026-04-16 23:23:44 +08:00
Bo-Yi Wu	156f3c6cb1	fix(deps): bump golang.org/x/crypto to v0.50.0 to fix CVE-2025-58181 and CVE-2025-47914	2026-04-16 23:18:55 +08:00
Bo-Yi Wu	8c8da8b643	fix(docker): bump alpine to 3.23 to clear HIGH CVEs	2026-04-16 23:15:42 +08:00
Bo-Yi Wu	d7493e77f5	ci: add trivy workflow and gate docker push on image scan	2026-04-16 23:00:58 +08:00
Bo-Yi Wu	1917781d94	ci: enable check-latest in docker and goreleaser workflows	2026-04-16 22:42:42 +08:00
Bo-Yi Wu	c08c2995d2	ci: enable check-latest for setup-go to fetch newest patch	2026-04-16 21:15:35 +08:00
Bo-Yi Wu	55f880d64f	ci: pin golangci-lint to v2.11	2026-04-16 21:11:11 +08:00
Bo-Yi Wu	983705ffd7	ci: bump GitHub Actions and add Go 1.25/1.26 to test matrix	2026-04-16 21:03:21 +08:00
Bo-Yi Wu	523c4bb724	chore: bump go directive to 1.25.9	2026-04-16 20:57:50 +08:00
appleboy	2cbd8efffa	test: update color conversion tests for new calculation logic - Update expected output values in color conversion tests to reflect new color calculation logic Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-07-05 22:46:25 +08:00
Bo-Yi Wu	f2b9ede051	refactor: refactor messaging and file upload with improved error handling (#66 ) - Refactor message and file sending logic into separate handleMessages and handleFiles methods - Stream file uploads via io.Copy rather than loading the entire content into memory - Add centralized http.Client with timeout for all requests - Enhance error handling throughout by returning more descriptive and wrapped errors - Improve response validation for file and message uploads, checking HTTP status and parsing error details - Update tests to cover plain text messages, embed messages, file uploads, color conversion, and combined features - Add tests using assert.Error/assert.NoError and checking specific error messages - Simplify and clarify configuration validation logic Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-07-05 21:02:30 +08:00