auth: publish passkey foundations preview

third_party/go-webauthn/.github/workflows/codeql.yml

@@ -0,0 +1,45 @@
+name: 'CodeQL'
+on:
+  push:
+    branches:
+      - 'master'
+  pull_request:
+    branches:
+      - 'master'
+  merge_group:
+    branches:
+      - 'master'
+  schedule:
+    - cron: '0 0 * * 1'
+permissions:
+  contents: 'read'
+jobs:
+  analyze:
+    name: 'Analyze'
+    runs-on: 'ubuntu-latest'
+    permissions:
+      actions: 'read'
+      contents: 'read'
+      security-events: 'write'
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - 'go'
+    steps:
+      - name: 'Harden Runner'
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: 'audit'
+      - name: 'Checkout'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: 'Initialize CodeQL'
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          languages: ${{ matrix.language }}
+      - name: 'Build'
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+      - name: 'Perform CodeQL Analysis'
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          category: '/language:${{matrix.language}}'

third_party/go-webauthn/.github/workflows/dependency-review.yml

@@ -0,0 +1,23 @@
+name: 'Dependency Review'
+on:
+  pull_request:
+    branches:
+      - 'master'
+  merge_group:
+    branches:
+      - 'master'
+permissions:
+  contents: 'read'
+jobs:
+  dependency-review:
+    name: 'Dependency Review'
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Harden Runner'
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: 'audit'
+      - name: 'Checkout Repository'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0

third_party/go-webauthn/.github/workflows/go.yml

@@ -0,0 +1,67 @@
+name: 'Go'
+on:
+  pull_request:
+    branches:
+      - 'master'
+  push:
+    branches:
+      - 'master'
+  merge_group:
+    branches:
+      - 'master'
+permissions:
+  contents: 'read'
+jobs:
+  cover:
+    name: 'Coverage'
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Harden Runner'
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: 'audit'
+      - name: 'Set up Go'
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: '1.26'
+      - name: 'Checkout'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: 'Get Dependencies'
+        run: |
+          go get -v -t ./...
+      - name: 'Test'
+        run: |
+          go test -coverprofile=coverage.txt -v ./...
+      - name: 'Coverage'
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+  build:
+    name: 'Build and Test'
+    runs-on: 'ubuntu-latest'
+    strategy:
+      matrix:
+        go:
+          - '1.25'
+          - '1.26'
+      fail-fast: false
+    steps:
+      - name: 'Harden Runner'
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: 'audit'
+      - name: 'Set up Go ${{ matrix.go }}'
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: ${{ matrix.go }}
+      - name: 'Checkout'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: 'Get Dependencies'
+        run: |
+          go get -v -t ./...
+      - name: 'Build'
+        run: |
+          go build -v ./...
+      - name: 'Test'
+        run: |
+          go test -race -v ./...

third_party/go-webauthn/.github/workflows/scorecards.yml

@@ -0,0 +1,43 @@
+name: 'Scorecard'
+on:
+  branch_protection_rule: {}
+  schedule:
+    - cron: '20 7 * * 2'
+  push:
+    branches:
+      - 'master'
+permissions: 'read-all'
+jobs:
+  analysis:
+    name: 'Analysis'
+    runs-on: 'ubuntu-latest'
+    permissions:
+      security-events: 'write'
+      id-token: 'write'
+      contents: 'read'
+      actions: 'read'
+    steps:
+      - name: 'Harden Runner'
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: 'audit'
+      - name: 'Checkout'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: 'Run'
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: 'results.sarif'
+          results_format: 'sarif'
+          publish_results: true
+      - name: 'Upload'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: 'SARIF file'
+          path: 'results.sarif'
+          retention-days: 5
+      - name: 'Upload to Code Scanning Dashboard'
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          sarif_file: 'results.sarif'