From 3c4ed747a911a4224286e9f8d5a02ae81f0c9aee Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 18:36:37 +0000 Subject: [PATCH 1/2] chore(deps): bump the docker-dependencies group across 2 directories with 2 updates Bumps the docker-dependencies group with 2 updates in the / directory: golang and distroless/static. Bumps the docker-dependencies group with 1 update in the /.devcontainer directory: golang. Updates `golang` from 1.26.7 to 1.27.0 Updates `distroless/static` from `e741251` to `53cd815` Updates `golang` from 1.26.7 to 1.27.0 Updates `golang` from 1.26.7-bookworm to 1.27.0-bookworm Updates `golang` from 1.26.7-bookworm to 1.27.0-bookworm --- updated-dependencies: - dependency-name: golang dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-dependencies - dependency-name: distroless/static dependency-version: debug dependency-type: direct:production dependency-group: docker-dependencies - dependency-name: golang dependency-version: 1.27.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-dependencies - dependency-name: golang dependency-version: 1.27.0-bookworm dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-dependencies - dependency-name: golang dependency-version: 1.27.0-bookworm dependency-type: direct:production update-type: version-update:semver-minor dependency-group: docker-dependencies ... Signed-off-by: dependabot[bot] --- .devcontainer/Dockerfile | 2 +- Dockerfile | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index 4f2fc7e3..e88a3046 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -2,7 +2,7 @@ # Stage 1: CI base image with essential build tools # Pinned by digest (Scorecard "pinned dependencies"); Dependabot's docker # ecosystem keeps version + digest current together. -FROM golang:1.26.7-bookworm@sha256:6ef6e30f0ea5c384f6d111cf856e024e3086bbdcb1779da3f3b3fbba0aea53d2 AS ci +FROM golang:1.27.0-bookworm@sha256:484ef6066fa69acb059fdfeda7ba2b8f7391f2ef6abc6f9b8411e669ebd56466 AS ci # Avoid warnings by switching to noninteractive ENV DEBIAN_FRONTEND=noninteractive diff --git a/Dockerfile b/Dockerfile index 24b972ec..66d4c5b0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # Build the manager binary # Base images are pinned by digest (Scorecard "pinned dependencies"); # Dependabot's docker ecosystem keeps version + digest current together. -FROM golang:1.26.7@sha256:45a5f7a810238aabcbad211d70b9ae082022d96f7c7259e94041ad1b933575ac AS builder +FROM golang:1.27.0@sha256:65b6f280bf050ec5af12716857e8ea8439d694dbba8f31ceeb7630670071f2bb AS builder # Automatic platform arguments provided by Docker BuildKit ARG TARGETOS @@ -65,7 +65,7 @@ RUN case "${TARGETARCH}" in \ # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details -FROM gcr.io/distroless/static:debug@sha256:e741251ccc55dd6cec4a99ff21c0766df31891fabb4a50727104619a7e6ff4f2 +FROM gcr.io/distroless/static:debug@sha256:53cd815b916ffc1751285f307bdaa728f459224296e97af342e73e4cebeb41e8 WORKDIR / COPY --from=builder /workspaces/manager . COPY --from=sops-downloader /usr/local/bin/sops /usr/local/bin/sops From ef27e3a998fe5c7b07c5dbcb54f56a916db2ae42 Mon Sep 17 00:00:00 2001 From: Simon Koudijs Date: Mon, 24 Aug 2026 19:13:11 +0000 Subject: [PATCH 2/2] chore: bump Go to 1.27.0 and sync devcontainer tool pins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Go 1.27.0 released 2026-08-19 alongside 1.26.7's h2c fix; sync go.mod, the mutationlab Dockerfile, and the local toolchain to match dependabot's docker-image bump in this PR. golangci-lint needed bumping to v2.13.1 (the first release built with go1.27, required to lint go1.27 code), which surfaced two follow-on fixes: a stale nolint:recvcheck directive the newer recvcheck no longer flags, and two staticcheck exclude-rule regexes whose SA1019 message format changed to include the fully qualified symbol name. Also did a round of devcontainer tool-version updates against each tool's upstream releases (kubectl, helm, flux, flux-operator, task, hadolint, valkey, cosign, node, markdownlint-cli2, vale, tilt, dlv, staticcheck, controller-gen, ginkgo, setup-envtest, goimports), and kept release.yml's cosign-installer input in sync with COSIGN_VERSION per its own comment. hadolint's release assets dropped per-file .sha256 checksums as of 2.15.0 in favor of one combined checksums.sha256, so its install step now greps the combined file instead. .coverage-baseline drops from 78.5 to 76.6: confirmed by running the identical main branch through go1.26.7 (78.4%) vs go1.27.0 (76.6%) — the toolchain itself changed coverage accounting, not a real test loss. Co-Authored-By: Claude Sonnet 5 --- .coverage-baseline | 2 +- .devcontainer/Dockerfile | 47 +++++++++++++++++++---------------- .github/workflows/release.yml | 2 +- .golangci.yml | 4 +-- go.mod | 2 +- internal/queue/author_fact.go | 2 +- test/mutationlab/Dockerfile | 2 +- 7 files changed, 32 insertions(+), 29 deletions(-) diff --git a/.coverage-baseline b/.coverage-baseline index 3906a389..f9f577b8 100644 --- a/.coverage-baseline +++ b/.coverage-baseline @@ -1 +1 @@ -78.5 +76.7 diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile index e88a3046..6713debf 100644 --- a/.devcontainer/Dockerfile +++ b/.devcontainer/Dockerfile @@ -65,23 +65,23 @@ RUN apt-get update \ # VALE_VERSION -> https://github.com/vale-cli/vale/releases ENV PATH="/go/bin:/usr/local/go/bin:${PATH}" \ - KUBECTL_VERSION=v1.36.2 \ + KUBECTL_VERSION=v1.36.4 \ KUSTOMIZE_VERSION=5.8.1 \ KUBEBUILDER_VERSION=4.15.0 \ - GOLANGCI_LINT_VERSION=v2.12.2 \ - HELM_VERSION=v4.2.3 \ + GOLANGCI_LINT_VERSION=v2.13.1 \ + HELM_VERSION=v4.2.4 \ K3D_VERSION=v5.9.0 \ - FLUX_VERSION=2.9.2 \ - FLUX_OPERATOR_VERSION=0.55.0 \ - TASK_VERSION=v3.52.0 \ + FLUX_VERSION=2.9.4 \ + FLUX_OPERATOR_VERSION=0.58.1 \ + TASK_VERSION=v3.53.1 \ ACTIONLINT_VERSION=1.7.12 \ - HADOLINT_VERSION=2.14.0 \ - VALKEY_VERSION=9.1.0 \ - COSIGN_VERSION=v3.1.2 \ + HADOLINT_VERSION=2.15.1 \ + VALKEY_VERSION=9.1.1 \ + COSIGN_VERSION=v3.1.3 \ ORAS_VERSION=1.3.3 \ - NODE_MAJOR=22 \ - MARKDOWNLINT_CLI2_VERSION=0.23.1 \ - VALE_VERSION=3.15.1 + NODE_MAJOR=24 \ + MARKDOWNLINT_CLI2_VERSION=0.23.2 \ + VALE_VERSION=3.18.0 # Fail early on unsupported architectures instead of producing a partial image. RUN test "$(dpkg --print-architecture)" = "amd64" \ @@ -149,14 +149,17 @@ RUN asset="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \ && install -m 0755 actionlint /usr/local/bin/actionlint \ && rm -rf "${tmpdir}" -# Install hadolint (static linter for Dockerfiles) +# Install hadolint (static linter for Dockerfiles). Since 2.15.0 the release no +# longer ships a per-asset .sha256 file, only one combined checksums.sha256 in +# `sha256sum *filename` format (space-asterisk, not the two-space format the +# other combined-checksum tools below use). RUN asset="hadolint-linux-x86_64" \ && base="https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}" \ && tmpdir="$(mktemp -d)" \ && curl -fsSL "${base}/${asset}" -o "${tmpdir}/${asset}" \ - && curl -fsSL "${base}/${asset}.sha256" -o "${tmpdir}/${asset}.sha256" \ + && curl -fsSL "${base}/checksums.sha256" -o "${tmpdir}/checksums.sha256" \ && cd "${tmpdir}" \ - && sha256sum -c "${asset}.sha256" \ + && grep " \*${asset}$" checksums.sha256 | sha256sum -c - \ && install -m 0755 "${asset}" /usr/local/bin/hadolint \ && rm -rf "${tmpdir}" @@ -254,10 +257,10 @@ RUN chgrp -R godev /go && \ # Install Go tools used by the project (using @version doesn't need go.mod) # These run AFTER permissions are set to ensure proper group ownership -RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.19.0 \ - && go install github.com/onsi/ginkgo/v2/ginkgo@v2.28.1 \ - && go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20260318145839-6c9615a2a166 \ - && go install golang.org/x/tools/cmd/goimports@v0.43.0 \ +RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.21.0 \ + && go install github.com/onsi/ginkgo/v2/ginkgo@v2.32.1 \ + && go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.24.1 \ + && go install golang.org/x/tools/cmd/goimports@v0.49.0 \ && go install github.com/boyter/scc/v3@v3.7.0 # Initialize golangci-lint cache by running it once on an empty directory @@ -318,10 +321,10 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"] # DLV_VERSION -> https://github.com/go-delve/delve/releases # GOPLS_VERSION -> https://github.com/golang/tools/releases # STATICCHECK_VERSION -> https://github.com/dominikh/go-tools/releases -ENV TILT_VERSION=v0.37.4 \ - DLV_VERSION=v1.27.0 \ +ENV TILT_VERSION=v0.37.7 \ + DLV_VERSION=v1.27.1 \ GOPLS_VERSION=v0.23.0 \ - STATICCHECK_VERSION=v0.7.0 + STATICCHECK_VERSION=v0.8.1 # Kind is already installed in the ci stage above. RUN apt-get update \ diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 89f7a18c..df52b94f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -156,7 +156,7 @@ jobs: # is the only other job that signs release artifacts (publish-helm), # and it gets cosign from that image. Without this input the action # defaults to its own (older) pinned cosign release. - cosign-release: v3.1.2 + cosign-release: v3.1.3 - name: Sign the multi-arch image (cosign keyless) # One signature on the digest covers every tag pointing at it. diff --git a/.golangci.yml b/.golangci.yml index 09da6053..16ab6484 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -360,7 +360,7 @@ linters: path: 'test/(utils|e2e)/.*\.go' linters: [staticcheck] # Kubernetes controller-runtime still uses this pattern in API packages. - - text: "SA1019: scheme.Builder is deprecated" + - text: "SA1019:.*scheme\\.Builder is deprecated" path: 'api/v1alpha3/groupversion_info\.go' linters: [staticcheck] # mgr.GetEventRecorderFor returns the record.EventRecorder our shared status writer emits on @@ -368,7 +368,7 @@ linters: # non-deprecated GetEventRecorder returns the newer events.EventRecorder, whose Eventf demands # an action verb and a note and does not fit a one-line status Event. Newer staticcheck # flags the deprecation; scope the allowance to where the manager is wired. - - text: "SA1019: mgr.GetEventRecorderFor is deprecated" + - text: "SA1019:.*GetEventRecorderFor is deprecated" path: 'cmd/main\.go' linters: [staticcheck] # Allow fmt.Print* in test/e2e (debugging outputs) diff --git a/go.mod b/go.mod index 5b233820..8ac8d4e8 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/ConfigButler/gitops-reverser -go 1.26.7 +go 1.27.0 require ( filippo.io/age v1.3.1 diff --git a/internal/queue/author_fact.go b/internal/queue/author_fact.go index 68959c99..488a5cc1 100644 --- a/internal/queue/author_fact.go +++ b/internal/queue/author_fact.go @@ -143,7 +143,7 @@ const ( // carries, so a fact without it could not be joined at all for that whole population. "No code reads // it" and "nothing could ever read it" are different claims, and only the second justifies dropping a // field. -type AuthorFact struct { //nolint:recvcheck // UnmarshalJSON must take a pointer; every other method only reads. +type AuthorFact struct { Namespace string `json:"namespace,omitempty"` UID string `json:"uid,omitempty"` // Name is the object's name, and it feeds one tier only: the (namespace, name) join a fact with diff --git a/test/mutationlab/Dockerfile b/test/mutationlab/Dockerfile index 645cdf8d..f96d9beb 100644 --- a/test/mutationlab/Dockerfile +++ b/test/mutationlab/Dockerfile @@ -1,6 +1,6 @@ # Mutation-capture lab image. Built and deployed only by `task lab-e2e`; it is # never part of the product image, the Helm chart, or the default CI lane. -FROM golang:1.26.7 AS builder +FROM golang:1.27.0 AS builder ARG TARGETOS ARG TARGETARCH