Updating workflows

Author: defstream

.github/workflows/depot.yml

@@ -52,10 +52,10 @@ jobs:
       - name: setup depot
         uses: depot/setup-action@eb2efd6287c794d456be5e1a7963fa8772c39ce5 # v1.5.0
 
-      - name: docker login
-        run: docker login --username kickable --password "${{ secrets.DOCKER_HUB }}"
-
-      # Package the cross-built binary into the scratch app image (validation).
-      - run: depot build --platform linux/amd64 -f docker/Dockerfile -t kickable/kickable -q --load .
+      # Validate that the cross-built binary packages into the scratch app image.
+      # No --load/-t: depot's ephemeral registry ref uses the project ID, which
+      # contains uppercase characters that Docker rejects as a repository name.
+      - name: build
+        run: depot build --platform linux/amd64 -f docker/Dockerfile .
         env:
           DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}

.github/workflows/devskim.yml

@@ -38,7 +38,7 @@ jobs:
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: run devskim scanner
-        uses: microsoft/DevSkim-Action@b41921d947434b27f90b8949f8bfbe056e706bf6 # v1.0.11
+        uses: microsoft/DevSkim-Action@4b5047945a44163b94642a1cecc0d93a3f428cc6 # v1.0.16
 
       - name: upload
         uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7

.github/workflows/earthly.yml

@@ -51,11 +51,11 @@ jobs:
         id: hash
         shell: bash
         run: |
-          echo ::set-output name=cargo_lock::${{ hashFiles('Cargo.lock') }}
-          echo ::set-output name=workflow_yml::${{ hashFiles('.github/workflows/earthly.yml') }}
+          echo "cargo_lock=${{ hashFiles('Cargo.lock') }}" >> "$GITHUB_OUTPUT"
+          echo "workflow_yml=${{ hashFiles('.github/workflows/earthly.yml') }}" >> "$GITHUB_OUTPUT"
 
       - name: cache earthly
-        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         continue-on-error: false
         with:
           path: /var/lib/docker/volumes/earthly-cache/

.github/workflows/main.yml

@@ -151,7 +151,6 @@ jobs:
     continue-on-error: true
     permissions:
       contents: read
-      security-events: write
       issues: write
     steps:
       - name: Harden Runner
@@ -166,15 +165,3 @@ jobs:
         uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: OSSF scorecard action
-        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      - name: upload to code-scanning
-        uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
-        with:
-          sarif_file: results.sarif

.github/workflows/scorecard.yml

@@ -58,11 +58,10 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
-          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
-          # - you want to enable the Branch-Protection check on a *public* repository, or
-          # - you are installing Scorecard on a *private* repository
-          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
-          repo_token: ${{ secrets.SCORECARD_TOKEN }}
+          # On a public repo, the default GITHUB_TOKEN is sufficient for all
+          # checks except Branch-Protection. To re-enable that check, set a PAT
+          # secret named SCORECARD_TOKEN and add `repo_token: ${{ secrets.SCORECARD_TOKEN }}`
+          # here — see https://github.com/ossf/scorecard-action#authentication-with-pat.
 
           # Public repositories:
           #   - Publish results to OpenSSF REST API for easy access by consumers

.github/workflows/snyk-container.yml

@@ -68,14 +68,12 @@ jobs:
       - name: cross build static binary
         run: cross build --release --bin kickable --all-features --locked --target x86_64-unknown-linux-musl
 
-      - name: setup depot
-        uses: depot/setup-action@eb2efd6287c794d456be5e1a7963fa8772c39ce5 # v1.5.0
-
       # Package the cross-built binary into the scratch app image for scanning.
+      # Built with plain docker (the runner is amd64) so the image is available
+      # locally for Snyk; depot's --load tags through its project-ID-based
+      # registry, which Docker rejects (uppercase repository name).
       - name: build docker
-        run: depot build --load --platform linux/amd64 -f docker/Dockerfile -t container .
-        env:
-          DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+        run: docker build --platform linux/amd64 -f docker/Dockerfile -t container .
 
       - name: snyk - container
         continue-on-error: true