Bump golang.org/x/sys from 0.0.0-20210601080250-7ecdf8ef093b to 0.1.0

.devcontainer/devcontainer.json

@@ -0,0 +1,24 @@
+{
+	"image": "mcr.microsoft.com/devcontainers/go:1.19",
+	"features": {
+		"ghcr.io/devcontainers/features/sshd:1": {}
+	},
+	"remoteUser": "vscode",
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"golang.go"
+			],
+			"settings": {
+				"go.toolsManagement.checkForUpdates": "local",
+				"go.useLanguageServer": true,
+				"go.gopath": "/go"
+			}
+		}
+	},
+	"runArgs": [
+		"--cap-add=SYS_PTRACE",
+		"--security-opt",
+		"seccomp=unconfined"
+	]
+}

.github/SECURITY.md

@@ -1,3 +1,14 @@
-If you discover a security issue in this repository, please submit it through the [GitHub Security Bug Bounty](https://hackerone.com/github).
+GitHub takes the security of our software products and services seriously, including the open source code repositories managed through our GitHub organizations, such as [cli](https://github.com/cli).
+
+If you believe you have found a security vulnerability in GitHub CLI, you can report it to us in one of two ways:
+
+* Report it to this repository directly using [private vulnerability reporting][]. Such reports are not eligible for a bounty reward.
+
+* Submit the report through [HackerOne][] to be eligible for a bounty reward.
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
 
 Thanks for helping make GitHub safe for everyone.
+
+  [private vulnerability reporting]: https://github.com/cli/cli/security/advisories
+  [HackerOne]: https://hackerone.com/github

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+- package-ecosystem: gomod
+  directory: "/"
+  schedule:
+    interval: "daily"
+  ignore:
+    - dependency-name: "*"
+      update-types:
+        - version-update:semver-minor
+        - version-update:semver-major
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+      interval: "daily"

.github/workflows/codeql.yml

@@ -2,23 +2,32 @@ name: Code Scanning
 
 on:
   push:
+    branches: [trunk]
   pull_request:
+    branches: [trunk]
+    paths-ignore:
+      - '**/*.md'
   schedule:
     - cron: "0 0 * * 0"
 
+permissions:
+  actions: read  # for github/codeql-action/init to get workflow details
+  contents: read  # for actions/checkout to fetch code
+  security-events: write  # for github/codeql-action/analyze to upload SARIF results
+
 jobs:
   CodeQL-Build:
     runs-on: ubuntu-latest
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v1
+        uses: github/codeql-action/init@v2
         with:
           languages: go
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v1
+        uses: github/codeql-action/analyze@v2

.github/workflows/go.yml

@@ -1,5 +1,9 @@
 name: Tests
 on: [push, pull_request]
+
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
@@ -9,13 +13,21 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - name: Set up Go 1.16
-        uses: actions/setup-go@v2
+      - name: Set up Go 1.19
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.16
+          go-version: 1.19
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
+      - name: Restore Go modules cache
+        uses: actions/cache@v3
+        with:
+          path: ~/go/pkg/mod
+          key: go-${{ runner.os }}-${{ hashFiles('go.mod') }}
+          restore-keys: |
+            go-${{ runner.os }}-
 
       - name: Download dependencies
         run: go mod download

.github/workflows/issueauto.yml

@@ -0,0 +1,24 @@
+name: Issue Automation
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  contents: none
+  issues: write
+
+jobs:
+  issue-auto:
+    runs-on: ubuntu-latest
+    steps:
+      - name: label incoming issue
+        env:
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ secrets.AUTOMATION_TOKEN }}
+          ISSUENUM: ${{ github.event.issue.number }}
+          ISSUEAUTHOR: ${{ github.event.issue.user.login }}
+        run: |
+          if ! gh api orgs/cli/public_members/$ISSUEAUTHOR --silent 2>/dev/null
+          then
+            gh issue edit $ISSUENUM --add-label "needs-triage"
+          fi

.github/workflows/lint.yml

@@ -11,25 +11,36 @@ on:
       - go.mod
       - go.sum
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Set up Go 1.16
-        uses: actions/setup-go@v2
+      - name: Set up Go 1.19
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.16
+          go-version: 1.19
 
       - name: Check out code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
+
+      - name: Restore Go modules cache
+        uses: actions/cache@v3
+        with:
+          path: ~/go/pkg/mod
+          key: go-${{ runner.os }}-${{ hashFiles('go.mod') }}
+          restore-keys: |
+            go-${{ runner.os }}-
 
       - name: Verify dependencies
         run: |
           go mod verify
           go mod download
 
-          LINT_VERSION=1.39.0
+          LINT_VERSION=1.50.1
           curl -fsSL https://github.com/golangci/golangci-lint/releases/download/v${LINT_VERSION}/golangci-lint-${LINT_VERSION}-linux-amd64.tar.gz | \
             tar xz --strip-components 1 --wildcards \*/golangci-lint
           mkdir -p bin && mv golangci-lint bin/

.github/workflows/prauto.yml

@@ -2,6 +2,12 @@ name: PR Automation
 on:
   pull_request_target:
     types: [ready_for_review, opened, reopened]
+
+permissions:
+  contents: none
+  issues: write
+  pull-requests: write
+
 jobs:
   pr-auto:
     runs-on: ubuntu-latest
@@ -15,6 +21,7 @@ jobs:
           PRNUM: ${{ github.event.pull_request.number }}
           PRHEAD: ${{ github.event.pull_request.head.label }}
           PRAUTHOR: ${{ github.event.pull_request.user.login }}
+          PR_AUTHOR_TYPE: ${{ github.event.pull_request.user.type }}
         if: "!github.event.pull_request.draft"
         run: |
           commentPR () {
@@ -42,8 +49,12 @@ jobs:
             ' -f colID="$(colID "Needs review")" -f prID="$PRID"
           }
 
-          if gh api orgs/cli/public_members/$PRAUTHOR --silent 2>/dev/null
+          if [ "$PR_AUTHOR_TYPE" = "Bot" ] || gh api orgs/cli/public_members/$PRAUTHOR --silent 2>/dev/null
           then
+            if [ "$PR_AUTHOR_TYPE" != "Bot" ]
+            then
+              gh pr edit $PRNUM --add-assignee $PRAUTHOR
+            fi
             if ! errtext="$(addToBoard 2>&1)"
             then
               cat <<<"$errtext" >&2
@@ -55,6 +66,8 @@ jobs:
             exit 0
           fi
 
+          gh pr edit $PRNUM --add-label "external"
+
           if [ "$PRHEAD" = "cli:trunk" ]
           then
             closePR