Repository navigation

Lint

fix(deps): bump grpc to v1.83.0 and otel to v1.44.0 for CVE fixes #1188

	name: Lint
	on:
	push:
	branches:
	- main
	pull_request:
	permissions:
	contents: read # to fetch code (actions/checkout)
	jobs:
	validate:
	name: Validate license and lint
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	target:
	- validate-headers
	- lint
	permissions:
	id-token: write
	pull-requests: write
	contents: write
	env:
	# Docker Hub credentials and the Docker Build Cloud builder are only
	# available to same-repo events. Fork PRs run without secrets, so they
	# fall back to a local buildx builder (slower, no shared cache).
	IS_TRUSTED: ${{ github.event_name != 'pull_request' \|\| github.event.pull_request.head.repo.full_name == github.repository }}
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	- name: Setup Go
	uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
	with:
	go-version-file: go.work
	- name: Hub login
	if: env.IS_TRUSTED == 'true'
	uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
	with:
	username: dockerpublicbot
	password: ${{ secrets.DOCKERPUBLICBOT_WRITE_PAT }}
	- name: Set up Docker Buildx
	id: buildx
	uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
	with:
	driver: ${{ env.IS_TRUSTED == 'true' && 'cloud' \|\| 'docker-container' }}
	endpoint: ${{ env.IS_TRUSTED == 'true' && 'docker/secrets-engine' \|\| '' }}
	install: true
	- name: Lint
	run: make BUILDER=${{ steps.buildx.outputs.name }} ${{ matrix.target }}