Prod deploy

.github/dependabot.yml

@@ -8,6 +8,10 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+  - package-ecosystem: "gomod"
+    directory: "pkg"
+    schedule:
+      interval: "daily"
   - package-ecosystem: "npm"
     directory: "/"
     schedule:

.github/workflows/api-sync.yml

@@ -0,0 +1,61 @@
+name: API Sync
+
+on:
+  repository_dispatch:
+    types: [api-sync]
+  workflow_dispatch: # allow manual triggering
+
+# Add explicit permissions
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  sync:
+    name: Sync API Types
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Run codegen
+        run: go generate
+
+      - name: Check for changes
+        id: check
+        run: |
+          if git diff --ignore-space-at-eol --exit-code --quiet pkg; then
+            echo "No changes detected"
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            echo "Changes detected"
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create Pull Request
+        if: steps.check.outputs.has_changes == 'true'
+        id: cpr
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.GH_PAT }}
+          commit-message: "chore: sync API types from infrastructure"
+          title: "chore: sync API types from infrastructure"
+          body: |
+            This PR was automatically created to sync API types from the infrastructure repository.
+
+            Changes were detected in the generated API code after syncing with the latest spec from infrastructure.
+          branch: sync/api-types
+          base: develop
+          labels: |
+            automated pr
+            api-sync
+
+      - name: Enable Pull Request Automerge
+        if: steps.check.outputs.has_changes == 'true'
+        run: gh pr merge --auto --squash "${{ steps.cpr.outputs.pull-request-number }}"
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT }}

.github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - develop
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test
@@ -21,8 +24,9 @@ jobs:
       # Required by: internal/utils/credentials/keyring_test.go
       - uses: t1m0thyj/unlock-keyring@v1
       - run: |
-          go run gotest.tools/gotestsum -- -race -v -count=1 -coverprofile=coverage.out \
-          `go list ./... | grep -Ev 'cmd|docs|examples|pkg/api|tools'`
+          pkgs=$(go list ./pkg/... | grep -Ev 'pkg/api' | paste -sd ',' -)
+          go tool gotestsum -- -race -v -count=1 ./... \
+          -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
       - uses: coverallsapp/github-action@v2
         with:
@@ -41,7 +45,7 @@ jobs:
           # Linter requires no cache
           cache: false
 
-      - uses: golangci/golangci-lint-action@v6
+      - uses: golangci/golangci-lint-action@v8
         with:
           args: --timeout 3m --verbose
 

.github/workflows/deploy-check.yml

@@ -1,7 +1,7 @@
 name: Check Deploy
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - reopened
@@ -10,6 +10,9 @@ on:
     branches:
       - main
 
+permissions: 
+  contents: read
+
 jobs:
   check:
     if: github.head_ref != 'develop'

.github/workflows/fast-forward.yml

@@ -27,6 +27,9 @@ jobs:
   publish:
     needs:
       - approved
+    permissions:
+      contents: write
+      packages: write
     # Call workflow explicitly because events from actions cannot trigger more actions
     uses: ./.github/workflows/release.yml
     secrets: inherit

.github/workflows/install.yml

@@ -14,6 +14,9 @@ on:
       - 'package.json'
       - 'scripts/**'
 
+permissions:
+  contents: write
+
 jobs:
   pack:
     runs-on: ubuntu-latest
@@ -99,7 +102,8 @@ jobs:
 
       - run: npm install -g pnpm
       - run: pnpm init
-      - run: pnpm i --save-dev ./supabase-1.28.0.tgz
+      # https://github.com/pnpm/pnpm/issues/9124#issuecomment-2663021284
+      - run: pnpm i --save-dev ./supabase-1.28.0.tgz --allow-build=supabase
       - run: pnpm supabase --version
 
   bun:

.github/workflows/mirror-image.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   mirror:
     runs-on: ubuntu-latest
@@ -26,7 +29,7 @@ jobs:
           TAG=${{ inputs.image }}
           echo "image=${TAG##*/}" >> $GITHUB_OUTPUT
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@v4.1.0
+        uses: aws-actions/configure-aws-credentials@v4.2.1
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: us-east-1

.github/workflows/mirror.yml

@@ -19,6 +19,9 @@ on:
       - submitted
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   setup:
     runs-on: ubuntu-latest
@@ -46,6 +49,10 @@ jobs:
   publish:
     needs:
       - setup
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     if: ${{ needs.setup.outputs.tags != needs.setup.outputs.curr }}
     strategy:
       matrix:

.github/workflows/pg-prove.yml

@@ -3,6 +3,9 @@ name: Publish pg_prove
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   settings:
     runs-on: ubuntu-latest

.github/workflows/publish-migra.yml

@@ -3,6 +3,9 @@ name: Publish migra
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   settings:
     runs-on: ubuntu-latest
@@ -70,9 +73,9 @@ jobs:
           password: ${{ secrets.DOCKER_PASSWORD }}
       - name: Merge multi-arch manifests
         run: |
-          docker buildx imagetools create -t ${{ needs.settings.outputs.image_tag }} \
-          ${{ needs.settings.outputs.image_tag }}_amd64 \
-          ${{ needs.settings.outputs.image_tag }}_arm64
+          docker buildx imagetools create -t "${{ needs.settings.outputs.image_tag }}" \
+          "${{ needs.settings.outputs.image_tag }}_amd64" \
+          "${{ needs.settings.outputs.image_tag }}_arm64"
 
   publish:
     needs:

.github/workflows/release-beta.yml

@@ -6,6 +6,9 @@ on:
       - develop
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: semantic-release

.github/workflows/release.yml

@@ -6,6 +6,10 @@ on:
       - main
   workflow_call:
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   settings:
     runs-on: ubuntu-latest

.github/workflows/tag-npm.yml

@@ -13,6 +13,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   tag:
     name: Move latest tag

.golangci.yml

@@ -1,23 +1,40 @@
+version: "2"
 linters:
   enable:
     - dogsled
     - dupl
-    - gofmt
-    - goimports
     - gosec
     - misspell
     - nakedret
-    - stylecheck
+    - staticcheck
     - unconvert
     - unparam
     - whitespace
-    - errcheck
-    - gosimple
-    - staticcheck
-    - ineffassign
-    - unused
-linters-settings:
-  stylecheck:
-    checks: ["all", "-ST1003"]
-  dupl:
-    threshold: 250
+  settings:
+    dupl:
+      threshold: 250
+  exclusions:
+    generated: lax
+    rules:
+      - text: 'ST1003:'
+        linters:
+          - staticcheck
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$