From fd3f7a64e8573fc9c5a542d26cf6e122c68c08dc Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 22:08:53 +0000
Subject: [PATCH 01/11] chore: harden repository security

---
 .github/dependabot.yml         | 18 ++++++++++++++++
 .github/workflows/security.yml | 39 ++++++++++++++++++++++++++++++++++
 .github/workflows/test.yml     |  9 +++++---
 3 files changed, 63 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9e5000b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: gomod
+    directory: /docs
+    schedule:
+      interval: weekly
+  - package-ecosystem: gomod
+    directory: /examples
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..f694449
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,39 @@
+name: Security
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout full history
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: stable
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+      - name: Scan analyzable Go modules
+        shell: bash
+        run: |
+          while IFS= read -r -d '' module; do
+            module_dir="${module%/go.mod}"
+            if (cd -- "$module_dir" && go list ./... >/dev/null); then
+              (cd -- "$module_dir" && govulncheck -scan=package ./...)
+            else
+              printf 'Skipping non-analyzable Go module: %s\n' "$module_dir"
+            fi
+          done < <(find . -name go.mod -type f -print0)
+      - name: Scan Git history for secrets
+        uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2
+        with:
+          args: detect --source . --log-opts="--all"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index dc90775..abf7160 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Go ${{ matrix.go-version }}
@@ -17,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -67,7 +70,7 @@ jobs:
 
       - name: Upload results to Codecov
         if: matrix.go-version == 'stable'
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
         with:
           files: coverage.txt
         env:

From 5aaae1008800f582007cb1a6ab2caf5785418a3e Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 22:15:08 +0000
Subject: [PATCH 02/11] chore: add supply chain security gates

---
 .github/workflows/security.yml     | 25 +++++----
 .github/workflows/supply-chain.yml | 83 ++++++++++++++++++++++++++++++
 2 files changed, 99 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/supply-chain.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index f694449..820c5e6 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -1,6 +1,10 @@
 name: Security
 
 on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
   schedule:
     - cron: "0 6 * * 1"
   workflow_dispatch:
@@ -21,19 +25,22 @@ jobs:
         with:
           go-version: stable
       - name: Install govulncheck
-        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.7.0
       - name: Scan analyzable Go modules
         shell: bash
         run: |
           while IFS= read -r -d '' module; do
             module_dir="${module%/go.mod}"
-            if (cd -- "$module_dir" && go list ./... >/dev/null); then
-              (cd -- "$module_dir" && govulncheck -scan=package ./...)
-            else
-              printf 'Skipping non-analyzable Go module: %s\n' "$module_dir"
+            if ! packages="$(cd -- "$module_dir" && go list ./...)"; then
+              exit 1
             fi
-          done < <(find . -name go.mod -type f -print0)
+            if [[ -z "$packages" ]]; then
+              printf 'Skipping empty Go module: %s\n' "$module_dir"
+              continue
+            fi
+            (cd -- "$module_dir" && govulncheck -test -scan=package ./...)
+          done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
       - name: Scan Git history for secrets
-        uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2
-        with:
-          args: detect --source . --log-opts="--all"
+        run: |
+          go install github.com/gitleaks/gitleaks/v8@v8.30.1
+          gitleaks git . --redact --no-banner
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
new file mode 100644
index 0000000..be35517
--- /dev/null
+++ b/.github/workflows/supply-chain.yml
@@ -0,0 +1,83 @@
+name: Supply Chain
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+jobs:
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0
+
+  codeql:
+    permissions:
+      contents: read
+      security-events: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@fddeee1a7ece751b577e409a89057319e3172939 # v4
+        with:
+          languages: go
+          build-mode: manual
+      - name: Build every Go module
+        shell: bash
+        run: |
+          while IFS= read -r -d '' module; do
+            module_dir="${module%/go.mod}"
+            (cd -- "$module_dir" && go build ./...)
+          done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
+      - name: Analyze Go source
+        uses: github/codeql-action/analyze@fddeee1a7ece751b577e409a89057319e3172939 # v4
+        with:
+          category: /language:go
+
+  sbom:
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Set up Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        with:
+          go-version: stable
+      - name: Install CycloneDX generator
+        run: go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@v1.10.0
+      - name: Generate module SBOMs
+        shell: bash
+        run: |
+          mkdir -p sbom
+          discovered=0
+          generated=0
+          while IFS= read -r -d '' module; do
+            module_dir="${module%/go.mod}"
+            discovered=$((discovered + 1))
+            output="$GITHUB_WORKSPACE/sbom/module-$discovered.cdx.json"
+            (cd -- "$module_dir" && cyclonedx-gomod mod -output "$output")
+            generated=$((generated + 1))
+          done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
+          test "$discovered" -gt 0
+          test "$discovered" -eq "$generated"
+          printf 'discovered=%s\ngenerated=%s\n' "$discovered" "$generated" > sbom/coverage.txt
+      - name: Upload SBOMs
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: cycloneDX-sboms
+          path: sbom
+          if-no-files-found: error
+
+# This repository publishes source modules and builds no release artifact, so artifact attestation is not applicable.

From 713e16544ab0a9e6045bed0a8a66f923c0bbac43 Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 22:16:47 +0000
Subject: [PATCH 03/11] fix: install pinned gitleaks module

---
 .github/workflows/security.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 820c5e6..83abd79 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -42,5 +42,5 @@ jobs:
           done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
       - name: Scan Git history for secrets
         run: |
-          go install github.com/gitleaks/gitleaks/v8@v8.30.1
+          go install github.com/zricethezav/gitleaks/v8@v8.30.1
           gitleaks git . --redact --no-banner

From df8c345f8e0f13b97ce3d467d6fd4422717f3aa3 Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 22:39:01 +0000
Subject: [PATCH 04/11] fix: correct security workflow validation

---
 .github/workflows/security.yml     |  4 ++--
 .github/workflows/supply-chain.yml | 29 +++++++++++++++++++----------
 examples/go.mod                    |  2 +-
 3 files changed, 22 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 83abd79..14a1655 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout full history
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
       - name: Install govulncheck
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index be35517..f5ae99f 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -11,13 +11,13 @@ on:
 
 jobs:
   dependency-review:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && vars.ENABLE_GITHUB_ADVANCED_SECURITY == 'true'
     permissions:
       contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Review dependency changes
-        uses: actions/dependency-review-action@ce3cf9537a52e8119d91fd484ab5b8a807627bf8 # v4.6.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
 
   codeql:
     permissions:
@@ -26,9 +26,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@fddeee1a7ece751b577e409a89057319e3172939 # v4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: go
           build-mode: manual
@@ -37,10 +37,18 @@ jobs:
         run: |
           while IFS= read -r -d '' module; do
             module_dir="${module%/go.mod}"
-            (cd -- "$module_dir" && go build ./...)
+            if ! packages="$(cd -- "$module_dir" && GOWORK=off go list ./...)"; then
+              printf 'Unable to discover packages in Go module: %s\n' "$module_dir" >&2
+              exit 1
+            fi
+            if [[ -z "$packages" ]]; then
+              printf 'Skipping empty Go module: %s\n' "$module_dir"
+              continue
+            fi
+            (cd -- "$module_dir" && GOWORK=off go test -run '^$' ./...)
           done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
       - name: Analyze Go source
-        uses: github/codeql-action/analyze@fddeee1a7ece751b577e409a89057319e3172939 # v4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: /language:go
 
@@ -50,9 +58,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
       - name: Install CycloneDX generator
@@ -67,14 +75,15 @@ jobs:
             module_dir="${module%/go.mod}"
             discovered=$((discovered + 1))
             output="$GITHUB_WORKSPACE/sbom/module-$discovered.cdx.json"
-            (cd -- "$module_dir" && cyclonedx-gomod mod -output "$output")
+            (cd -- "$module_dir" && cyclonedx-gomod mod -json -type library -test -output "$output")
+            jq -e '.bomFormat == "CycloneDX" and .metadata.component.type == "library" and all(.components[]?; .name != "..")' "$output" >/dev/null
             generated=$((generated + 1))
           done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
           test "$discovered" -gt 0
           test "$discovered" -eq "$generated"
           printf 'discovered=%s\ngenerated=%s\n' "$discovered" "$generated" > sbom/coverage.txt
       - name: Upload SBOMs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cycloneDX-sboms
           path: sbom
diff --git a/examples/go.mod b/examples/go.mod
index 50112ca..015726f 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -10,4 +10,4 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-replace github.com/goforj/execx => ..
+replace github.com/goforj/execx => ./..

From c19dda5885ef2a81feb06bbbd410d2dd5529e343 Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 22:55:48 +0000
Subject: [PATCH 05/11] fix: align security workflow gates

---
 .github/workflows/supply-chain.yml | 2 +-
 .github/workflows/test.yml         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index f5ae99f..c48c031 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   dependency-review:
-    if: github.event_name == 'pull_request' && vars.ENABLE_GITHUB_ADVANCED_SECURITY == 'true'
+    if: github.event_name == 'pull_request' && vars.ENABLE_DEPENDENCY_REVIEW == 'true'
     permissions:
       contents: read
     runs-on: ubuntu-latest
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index abf7160..ef992f0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
 
@@ -70,7 +70,7 @@ jobs:
 
       - name: Upload results to Codecov
         if: matrix.go-version == 'stable'
-        uses: codecov/codecov-action@04b047e8bb82a0c002c8312c1c880fbc6a999d45 # v5
+        uses: codecov/codecov-action@a99c28d3f0da835de33ff2feb2e15691c7b9641f # v7
         with:
           files: coverage.txt
         env:

From de6dd3521c15e30e4809c8fb2d9ab54204c92c4d Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 23:07:29 +0000
Subject: [PATCH 06/11] ci: pin Codecov to its release commit

---
 .github/workflows/test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ef992f0..8cbe5f3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -70,7 +70,7 @@ jobs:
 
       - name: Upload results to Codecov
         if: matrix.go-version == 'stable'
-        uses: codecov/codecov-action@a99c28d3f0da835de33ff2feb2e15691c7b9641f # v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: coverage.txt
         env:

From ab0da757b97783c3e7fdc6057a4dce1a98be72aa Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Fri, 4 Sep 2026 23:29:45 +0000
Subject: [PATCH 07/11] ci: expose clean builds to CodeQL

---
 .github/workflows/supply-chain.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index c48c031..c8c5d93 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -27,11 +27,18 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Set up Go for CodeQL
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: stable
+          cache: false
       - name: Initialize CodeQL
         uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: go
           build-mode: manual
+      - name: Clear Go build cache
+        run: go clean -cache
       - name: Build every Go module
         shell: bash
         run: |

From 5b8b953eda8fd63c43e0d9d734aa66aa09a8bbb8 Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Sat, 5 Sep 2026 02:03:18 +0000
Subject: [PATCH 08/11] fix: compile packages for CodeQL tracing

---
 .github/workflows/supply-chain.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index c8c5d93..53a5ca8 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -42,6 +42,7 @@ jobs:
       - name: Build every Go module
         shell: bash
         run: |
+          built_modules=0
           while IFS= read -r -d '' module; do
             module_dir="${module%/go.mod}"
             if ! packages="$(cd -- "$module_dir" && GOWORK=off go list ./...)"; then
@@ -52,8 +53,16 @@ jobs:
               printf 'Skipping empty Go module: %s\n' "$module_dir"
               continue
             fi
-            (cd -- "$module_dir" && GOWORK=off go test -run '^$' ./...)
+            built_modules=$((built_modules + 1))
+            output_dir="$RUNNER_TEMP/codeql-build/$built_modules"
+            mkdir -p "$output_dir"
+            package_count=0
+            while IFS= read -r package; do
+              package_count=$((package_count + 1))
+              (cd -- "$module_dir" && GOWORK=off go test -c -o "$output_dir/package-$package_count.test" "$package")
+            done <<< "$packages"
           done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
+          test "$built_modules" -gt 0
       - name: Analyze Go source
         uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:

From 327283c9525257f123ac979c305fbd256fbcca70 Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Sat, 5 Sep 2026 02:59:10 +0000
Subject: [PATCH 09/11] ci: enable dependency review

---
 .github/workflows/supply-chain.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 53a5ca8..a58c331 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -11,7 +11,7 @@ on:
 
 jobs:
   dependency-review:
-    if: github.event_name == 'pull_request' && vars.ENABLE_DEPENDENCY_REVIEW == 'true'
+    if: github.event_name == 'pull_request'
     permissions:
       contents: read
     runs-on: ubuntu-latest

From 504e2c50e2b1fe3bf2384622d2fa515b2fb09c2c Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Sat, 5 Sep 2026 03:10:15 +0000
Subject: [PATCH 10/11] ci: use organization CodeQL scanning

---
 .github/workflows/supply-chain.yml | 49 ------------------------------
 1 file changed, 49 deletions(-)

diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index a58c331..7982dcd 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -19,55 +19,6 @@ jobs:
       - name: Review dependency changes
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
 
-  codeql:
-    permissions:
-      contents: read
-      security-events: write
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Set up Go for CodeQL
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: stable
-          cache: false
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          languages: go
-          build-mode: manual
-      - name: Clear Go build cache
-        run: go clean -cache
-      - name: Build every Go module
-        shell: bash
-        run: |
-          built_modules=0
-          while IFS= read -r -d '' module; do
-            module_dir="${module%/go.mod}"
-            if ! packages="$(cd -- "$module_dir" && GOWORK=off go list ./...)"; then
-              printf 'Unable to discover packages in Go module: %s\n' "$module_dir" >&2
-              exit 1
-            fi
-            if [[ -z "$packages" ]]; then
-              printf 'Skipping empty Go module: %s\n' "$module_dir"
-              continue
-            fi
-            built_modules=$((built_modules + 1))
-            output_dir="$RUNNER_TEMP/codeql-build/$built_modules"
-            mkdir -p "$output_dir"
-            package_count=0
-            while IFS= read -r package; do
-              package_count=$((package_count + 1))
-              (cd -- "$module_dir" && GOWORK=off go test -c -o "$output_dir/package-$package_count.test" "$package")
-            done <<< "$packages"
-          done < <(find . \( -path './.git' -o -path './node_modules' \) -prune -o -name go.mod -type f -print0)
-          test "$built_modules" -gt 0
-      - name: Analyze Go source
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
-        with:
-          category: /language:go
-
   sbom:
     permissions:
       contents: read

From 2897e40d8c50e0eccb1b80668a8da0eee5576de8 Mon Sep 17 00:00:00 2001
From: Chris Miles <chris.miles.e@gmail.com>
Date: Sat, 5 Sep 2026 07:57:42 +0000
Subject: [PATCH 11/11] fix: remediate transitive dependency advisories

---
 examples/go.mod | 2 +-
 examples/go.sum | 4 ++--
 go.mod          | 2 +-
 go.sum          | 4 ++--
 4 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/examples/go.mod b/examples/go.mod
index 015726f..d1f7cb9 100644
--- a/examples/go.mod
+++ b/examples/go.mod
@@ -5,7 +5,7 @@ go 1.27.0
 require github.com/goforj/execx v1.1.0
 
 require (
-	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
 	golang.org/x/term v0.40.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/examples/go.sum b/examples/go.sum
index 0cc80d5..2602f54 100644
--- a/examples/go.sum
+++ b/examples/go.sum
@@ -1,5 +1,5 @@
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
 golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
diff --git a/go.mod b/go.mod
index e6fe658..4ae88e9 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/goforj/execx
 go 1.27.0
 
 require (
-	golang.org/x/sys v0.41.0
+	golang.org/x/sys v0.44.0
 	golang.org/x/term v0.40.0
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/go.sum b/go.sum
index 0cc80d5..2602f54 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,5 @@
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
 golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=