Merge pull request #8 from wneessen/more-cleanup-cleanup

More code cleanup and security workflows

.github/workflows/dependency-review.yml

@@ -0,0 +1,31 @@
+# SPDX-FileCopyrightText: 2022-2023 The go-mail Authors
+#
+# SPDX-License-Identifier: CC0-1.0
+
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: 'Dependency Review'
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - name: 'Checkout Repository'
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@5a2ce3f5b92ee19cbb1541a4984c76d921601d7c # v4.3.4

.github/workflows/govulncheck.yml

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2022 Winni Neessen <winni@neessen.dev>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+name: Govulncheck Security Scan
+
+on: [push, pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps: 
+    - name: Harden Runner
+      uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+      with:
+        egress-policy: audit
+    - name: Run govulncheck
+      uses: golang/govulncheck-action@dd0578b371c987f96d1185abb54344b44352bd58 # v1.0.3

.github/workflows/scorecards.yml

@@ -0,0 +1,80 @@
+# SPDX-FileCopyrightText: 2022-2023 The go-mail Authors
+#
+# SPDX-License-Identifier: CC0-1.0
+
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches: ["main"]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
+        with:
+          egress-policy: audit
+
+      - name: "Checkout code"
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          # (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
+          # - you want to enable the Branch-Protection check on a *public* repository, or
+          # - you are installing Scorecards on a *private* repository
+          # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
+          # repo_token: ${{ secrets.SCORECARD_TOKEN }}
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
+        with:
+          sarif_file: results.sarif

niljson_test.go

@@ -52,10 +52,10 @@ func TestVariable_UnmarshalJSON_Boolean(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if !jt.Value.Value() {
 		t.Errorf("expected value to be true, got %t", jt.Value.Value())
@@ -63,7 +63,7 @@ func TestVariable_UnmarshalJSON_Boolean(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -98,10 +98,10 @@ func TestVariable_UnmarshalJSON_ByteSlice(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if !bytes.Equal(jt.Value.Value(), []byte("bytes")) {
 		t.Errorf("expected value to be %q, got %q", "bytes", jt.Value.Value())
@@ -109,7 +109,7 @@ func TestVariable_UnmarshalJSON_ByteSlice(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -145,10 +145,10 @@ func TestVariable_UnmarshalJSON_Float32(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf("expected value to be %f, got %f", expected, jt.Value.Value())
@@ -156,7 +156,7 @@ func TestVariable_UnmarshalJSON_Float32(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -192,10 +192,10 @@ func TestVariable_UnmarshalJSON_Float64(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf("expected value to be %f, got %f", expected, jt.Value.Value())
@@ -203,7 +203,7 @@ func TestVariable_UnmarshalJSON_Float64(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -239,10 +239,10 @@ func TestVariable_UnmarshalJSON_Int(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -250,7 +250,7 @@ func TestVariable_UnmarshalJSON_Int(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -286,10 +286,10 @@ func TestVariable_UnmarshalJSON_Int64(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -297,7 +297,7 @@ func TestVariable_UnmarshalJSON_Int64(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -333,10 +333,10 @@ func TestVariable_UnmarshalJSON_String(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf("expected value to be %s, got %s", expected, jt.Value.Value())
@@ -344,7 +344,7 @@ func TestVariable_UnmarshalJSON_String(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -380,10 +380,10 @@ func TestVariable_UnmarshalJSON_UInt(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -391,7 +391,7 @@ func TestVariable_UnmarshalJSON_UInt(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -427,10 +427,10 @@ func TestVariable_UnmarshalJSON_UInt8(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -438,7 +438,7 @@ func TestVariable_UnmarshalJSON_UInt8(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -474,10 +474,10 @@ func TestVariable_UnmarshalJSON_UInt16(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -485,7 +485,7 @@ func TestVariable_UnmarshalJSON_UInt16(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -521,10 +521,10 @@ func TestVariable_UnmarshalJSON_UInt32(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -532,7 +532,7 @@ func TestVariable_UnmarshalJSON_UInt32(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }
 
@@ -568,10 +568,10 @@ func TestVariable_UnmarshalJSON_UInt64(t *testing.T) {
 	}
 
 	if jt.Value.IsNil() {
-		t.Errorf(ErrExpectedValue)
+		t.Error(ErrExpectedValue)
 	}
 	if jt.NilValue.NotNil() {
-		t.Errorf(ErrExpectedNil)
+		t.Error(ErrExpectedNil)
 	}
 	if jt.Value.Value() != expected {
 		t.Errorf(ErrExpectedJSONInt, expected, jt.Value.Value())
@@ -579,7 +579,7 @@ func TestVariable_UnmarshalJSON_UInt64(t *testing.T) {
 
 	jt.Value.Reset()
 	if jt.Value.NotNil() {
-		t.Errorf(ErrExpectedNilReset)
+		t.Error(ErrExpectedNilReset)
 	}
 }