Merge branch 'main' into dependabot/docker/golang-1.22

.github/workflows/docker-image.yaml

@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Log in to the Container registry
-        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -38,7 +38,7 @@ jobs:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0
         with:
           context: .
           push: true

.github/workflows/pr.yaml

@@ -11,7 +11,7 @@ jobs:
       with:
         go-version: '1.20'
         check-latest: true
-    - uses: golangci/golangci-lint-action@v3
+    - uses: golangci/golangci-lint-action@v4
       with:
         args: --timeout 3m --verbose
   build:

catalog-info.yaml

@@ -0,0 +1,20 @@
+# Backstage documentation
+# https://backstage.io/docs/features/software-catalog/descriptor-format/
+
+apiVersion: backstage.io/v1alpha1
+kind: Component 
+metadata:
+  name: allstar 
+  description: Allstar is a GitHub App that continuously monitors GitHub organizations or repositories for adherence to security best practices
+  annotations:
+    github.com/project-slug: contentful/allstar 
+    contentful.com/service-tier: "4" 
+
+  tags:
+    - update-me
+    - sast-disabled
+    - tier-4
+spec:
+  type: service 
+  lifecycle: production  
+  owner: group:team-security 

go.mod

@@ -4,24 +4,23 @@ go 1.16
 
 require (
 	github.com/Masterminds/semver/v3 v3.2.1
-	github.com/bradleyfalzon/ghinstallation/v2 v2.4.0
+	github.com/bradleyfalzon/ghinstallation/v2 v2.10.0
 	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/docker/distribution v2.8.2+incompatible // indirect
 	github.com/evanphx/json-patch v5.9.0+incompatible
 	github.com/gobwas/glob v0.2.3
-	github.com/google/go-cmp v0.5.9
+	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.15.2 // indirect
 	github.com/google/go-github/v50 v50.2.0
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79
 	github.com/matryer/is v1.4.0 // indirect
-	github.com/onsi/ginkgo v1.16.5 // indirect
 	github.com/ossf/scorecard/v4 v4.10.5
-	github.com/rhysd/actionlint v1.6.24
+	github.com/rhysd/actionlint v1.6.27
 	github.com/rs/zerolog v1.32.0
 	github.com/sergi/go-diff v1.3.1 // indirect
 	github.com/shurcooL/githubv4 v0.0.0-20210725200734-83ba7b4c9228
 	github.com/xanzy/go-gitlab v0.83.0 // indirect
-	gocloud.dev v0.34.0
-	golang.org/x/sync v0.4.0
-	gotest.tools/v3 v3.3.0 // indirect
+	gocloud.dev v0.37.0
+	golang.org/x/sync v0.6.0
 	sigs.k8s.io/yaml v1.3.0
 )