- Go to v1.24.2
- ECR Helper to latest commit
- anchore/syft to v1.22.0
- library/registry to v3.0.0
- securego/gosec to v2.22.3
- google/osv-scanner to v2.0.1
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Alpine base image to v3.21.3
- Go image to latest commit
- ECR credential helper to latest commit
- docker/build-push-action to v6.14.0
- sigstore/cosign to v2.4.3
- sigstore/cosign-installer to v3.8.1
- github.com/klauspost/compress to v1.18.0
- github.com/spf13/cobra to v1.9.1
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Support for Go 1.21 is dropped, leaving 1.22 the minimum release
- Go base image to 1.24.0
- ECR helper to latest commit
- gosec to v2.22.1
- dominikh/go-tools for staticcheck to v0.6.0
- olareg/olareg to v0.1.2
- Fixing staticcheck linter warnings
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Go to v1.23.6
- ECR helper to latest commit
- sigstore/cosign to v2.4.2
- docker/setup-buildx-action to v3.9.0
- sigstore/cosign-installer to v3.8.0
- golang.org/x/sys to v0.30.0
- golang.org/x/term to v0.29.0
Security: the Go update fixes CVE-2025-22866
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- ECR Helper to latest commit
- actions/setup-go to v5.3.0
- actions/stale to v9.1.0
- docker/build-push-action to v6.13.0
- anchore/syft to v1.19.0
- anchore/sbom-action to v0.18.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- ECR Helper to latest commit
- Go to 1.23.5
- docker/build-push-action to v6.12.0
- project-zot/zot-linux-amd64 to v2.1.2
- govulncheck to v1.1.4
- davidanson/markdownlint-cli2 to v0.17.2
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Alpine to v3.21.2
- actions/upload-artifact to v4.6.0
- docker/build-push-action to v6.11.0
- softprops/actiohn-gh-release to v2.2.1
- securego/gosec to v2.22.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Go to 1.23.3
- ECR Helper to latest commit
- GCR helper to v2.1.26
- anchore/syft to v1.16.0
- anchore/sbom-action to v0.17.7
- davidanson/markdownlint-cli2 to v0.15.0
- golang.org/x/sys to v0.27.0
- golang.org/x/term to v0.26.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- actions checkout to v4.2.1
- actions/upload-artifact to v4.4.3
- anchore/sbom-action to v17.3
- anchore/syft to v1.14.0- ECR helper to latest commit
- klauspost/compress to v1.17.11
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- ECR Helper to latest commit
- Go to 1.23.2
- sigstore/cosign to v2.4.1
- actions/upload-artifact to v4.4.1
- docker/setup-buildx-action to v3.7.1
- sigstore/cosign-installer to v3.7.0
- google/osv-scanner to v1.9.0
- klauspost/compress to v1.17.0
- golang.org/x/sys to v0.26.0
- golang.org/x/term to v0.25.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Update config to use yaml anchors and aliases
- docker/build-push-action to v6.9.0
- github/codeql-action to v3.26.10
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Update version-bump config for processors
- gomajor to v0.14.0
- gosec to v2.21.4
- syft to v1.13.0
- actions/checkout to v4.2.0
- docker/build-push-action to v6.8.0
- github/codeql-action to v3.26.9
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- ECR Helper to latest commit
- GCloud Helper to v2.1.25
- securego/gosec to v2.21.1
- Alpine to 3.20.3
- Go to 1.23.1
- davidanson/markdonlint-cli2 to v0.14.0
- golang.org/x/sys to v0.25.0
- golang.org/x/term to v0.24.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- actions/upload-artifact to v4.3.6
- anchore/sbom-action to v0.17.1
- docker/build-push-action to v6.7.0
- github/codeql-action to v3.26.3
- sigstore/cosign-installer to v3.6.0
- ECR credential helper to latest commit
- dominikh/go-tools to v0.5.1
- google/osv-scanner to v1.8.3
- sigstore/cosign to v2.4.0
- anchore/syft to v1.11.1
- Go to 1.21 - 1.23 (dropping 1.20 support)
- Zot to v2.1.1
- olareg to v0.1.1
- golang.org/x/sys to v0.24.0
- golang.org/x/term to v0.23.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- anchore/sbom-action to v0.17.0
- docker/build-push-action to v6.5.0
- docker/login-action to v3.3.0
- docker/setup-buildx-action to v3.5.0
- github/codeql-action to v3.25.15
- ossf/scorecard-action to v2.4.0
- softprops/action-gh-release to v2.0.8
- GCR credential helper to v2.1.23
- sigstore/cosign to v2.3.0
- govulncheck to v1.1.3
- alpine base image to v3.20.2
Signed-off-by: Brandon Mitchell <git@bmitch.net>
This didn't increase the cache hit rate and ultimately slowed down the build.
Most likely the GHA cache isn't large enough.
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- actions/setup-go to v5.0.2
- anchore/sbom-action to v0.16.1
- github/codeql-action to v3.25.12
- ECR Helper to latest commit
- google/osv-scanner to v1.8.2
- icholy/gomajor to v0.13.1
- anchore/syft to v1.9.0
- project-zot to v 2.1.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Go to 1.22.5
- actions/upload-artifact to v4.3.4
- docker/build-push-action to v6.3.0
- docker/setup-buildx-action to v3.4.0
- github/codeql-action to v3.25.11
- ECR Helper to latest commit
- icholy/gomajor to v0.12.0
- anchore/syft to v1.8.0
- golang.org/x/sys to v0.22.0
- golang.org/x/term to v0.22.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- actions/checkout to v4.1.7
- docker/build-push-action to v6.1.0
- github/codeql-action to v3.25.10
- softprops/action-gh-release to v2.0.6
- ECR helper to latest commit
- google-osv-scanner to v1.8.1
- anchore-syft to v1.7.0
- Alpine to 3.20.1
- klauspost/compress to v1.17.9
- spf13/cobra to v1.8.1
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- github/codeql-action to v3.25.8
- ECR credential helper to latest commit
- govulncheck to v1.1.2
- Go to 1.22.4
- golang.org/x/sys to v0.21.0
- golang.org/x/term to v0.21.0
- Fixes CVE-2024-24790
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- docker/login-action to v3.2.0
- github/codeql-action to v3.25.7
- google/osv-scanner to v1.7.4
- icholy/gomajor to v0.11.0
- Go image digest
- anchore/syft to v1.5.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- anchore/sbom-action to v0.16.0
- github/codeql-action to v3.25.6
- ECR Helper to latest commit
- govulncheck to v1.1.1
- Alpine to v3.20.0
- Go base image to latest commit
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- Fixes CVE-2024-24788
- Go to v1.22.3
- github/codeql-action to v3.25.4
- ossf/scorecard-action to v2.3.3
- ECR Helper to latest commit
- google/osv-scanner to v1.7.3
- anchore/syft to v1.4.1
Signed-off-by: Brandon Mitchell <git@bmitch.net>
- actions/checkout to v4.1.4
- actions/upload-artifact to v4.3.3
- anchore/sbom-action to v0.15.11
- github/codeql-action to v3.25.3
- ECR credential helper to latest commit
- OSV Scanner to v1.7.2
- govulncheck to v1.1.0
- regclient/actions to latest commit
- anchore/syft to v1.3.0
- Zot to v2.0.4
- anchore/syft to v1.3.0
Signed-off-by: Brandon Mitchell <git@bmitch.net>
