Merge pull request #1147 from jzelinskie/codeql-threads

.github: use 8 cores for codeql

Author: jzelinskie

.github/workflows/build-test.yaml

@@ -39,12 +39,9 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
-      - name: "go mod download" # prevent CI cache poisoning by getting all deps
-        run: "go mod download"
       - uses: "authzed/actions/go-build@main"
 
   image-build:
@@ -58,10 +55,9 @@ jobs:
           tags: "authzed/spicedb:ci"
           buildx: false
           qemu: false
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/go-test@main"
         with:
           working_directory: "cmd/spicedb"
@@ -72,10 +68,9 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/go-test@main"
         with:
           tags: "ci,skipintegrationtests"
@@ -86,10 +81,9 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/go-test@main"
         with:
           tags: "ci,docker"
@@ -105,10 +99,9 @@ jobs:
         datastore: ["crdb", "mysql", "postgres", "spanner"]
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/go-test@main"
         with:
           tags: "ci,docker"
@@ -124,23 +117,22 @@ jobs:
         datastore: ["cockroachdb", "mysql", "postgres", "spanner"]
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - name: "Run Datastore Consistency Tests"
         working-directory: "internal/services/integrationtesting"
         run: "go test --failfast -count=1 -timeout '10m' --tags='ci,docker,datastoreconsistency' ./... -run TestConsistencyPerDatastore/${{ matrix.datastore }}"
 
   e2e:
     name: "E2E"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-latest-8-cores"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
+          go-version-file: "e2e/go.mod"
           cache-dependency-path: "e2e/go.sum"
       - name: "Cache Binaries"
         id: "cache-binaries"
@@ -186,10 +178,10 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
+          go-version-file: "tools/analyzers/go.mod"
           cache-dependency-path: "tools/analyzers/go.sum"
       - uses: "authzed/actions/go-test@main"
         with:
@@ -199,10 +191,9 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "false" # do not cache to prevent cache poisoning
       - name: "Install wasmbrowsertest"
         run: "go install github.com/agnivade/wasmbrowsertest@latest"
       - name: "Run WASM Tests"
@@ -213,10 +204,9 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "false" # do not cache to prevent cache poisoning
       - name: "Install Go Tools"
         run: "./hack/install-tools.sh"
       - uses: "authzed/actions/buf-generate@main"

.github/workflows/lint.yaml

@@ -15,10 +15,9 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/gofumpt@main"
       - uses: "authzed/actions/gofumpt@main"
         with:
@@ -67,7 +66,7 @@ jobs:
 
   codeql:
     name: "Analyze with CodeQL"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-latest-8-cores"
     permissions:
       actions: "read"
       contents: "read"
@@ -85,8 +84,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - name: "Run Trivy vulnerability scanner"
-        uses: "aquasecurity/trivy-action@master"
+      - uses: "aquasecurity/[email protected]"
         with:
           scan-type: "fs"
           ignore-unfixed: true

.github/workflows/nightly.yaml

@@ -16,10 +16,9 @@ jobs:
       - uses: "actions/checkout@v3"
         with:
           fetch-depth: 0
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/docker-login@main"
         with:
           quayio_token: "${{ secrets.QUAYIO_PASSWORD }}"

.github/workflows/release.yaml

@@ -16,10 +16,9 @@ jobs:
       - uses: "actions/checkout@v3"
         with:
           fetch-depth: 0
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - uses: "authzed/actions/docker-login@main"
         with:
           quayio_token: "${{ secrets.QUAYIO_PASSWORD }}"

.github/workflows/wasm.yaml

@@ -15,10 +15,9 @@ jobs:
       - uses: "actions/checkout@v3"
         with:
           ref: "${{ env.GITHUB_SHA }}"
-      - uses: "actions/setup-go@v3"
+      - uses: "authzed/actions/setup-go@main"
         with:
           go-version: "${{ env.GO_VERSION }}"
-          cache: "true"
       - run: |
           echo "Building WASM..."
           GOOS=js GOARCH=wasm go build  -o dist/development.wasm ./pkg/development/wasm/...