chore: upgrade to go 1.17.8

[crenshaw-dev]

Fixes #8853

[terrytangyuan]

Good to know. Let me know when you find out about why these CVEs aren't showing up. I am also upgrading this in Workflows.

[crenshaw-dev]

Thinking we should cherry-pick this onto any 2.3 patch releases, maybe 2.2 and 2.1 as well. I'd consider this a relatively low-risk, high-reward change.

[crenshaw-dev]

Weird, it's still showing merging blocked even though you're a reviewer now. @alexmt is that expected?

[terrytangyuan]

I think reviewer is only able to review and the actual "approve" still needs to be done by an approver.

[terrytangyuan]

@crenshaw-dev Discussing this upgrade for Workflows in argoproj/argo-workflows#8222 (comment) too. Perhaps we should just use 1.17 if we want the latest version.

[codecov]

Codecov Report

Merging #8866 (94eedf0) into master (a6c664b) will decrease coverage by 0.02%.
The diff coverage is 18.75%.

@@            Coverage Diff             @@
##           master    #8866      +/-   ##
==========================================
- Coverage   42.87%   42.85%   -0.03%     
==========================================
  Files         186      186              
  Lines       23335    23359      +24     
==========================================
+ Hits        10006    10011       +5     
- Misses      11898    11914      +16     
- Partials     1431     1434       +3     

Impacted Files	Coverage Δ
controller/cache/cache.go	20.76% <0.00%> (ø)
pkg/apis/application/v1alpha1/app_project_types.go	51.83% <0.00%> (-0.28%)	⬇️
server/application/application.go	31.37% <7.14%> (-0.19%)	⬇️
controller/appcontroller.go	51.61% <38.46%> (-0.21%)	⬇️
util/settings/settings.go	48.10% <0.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update af03b29...94eedf0. Read the comment docs.

[crenshaw-dev]

I'm split between wanting a deterministic build and wanting to avoid maintenance overhead of bumping the golang version. Open to ideas either way.

Looks like differences between golang patches are very minimal, so I'm leaning towards preferring just 1.17.

[alexmt]

I think 1.17 is a good compromise. Goland version is available via argocd version so we can always find the exact go version used for release

[rimasgo]

Hello, thanks for doing the changes!

Just a quick question. On which version argocd release this will be adopted? I just check the source code for 2.3.3 which was released 5 days ago and it's still pointing to hardcoded 1.17.6 value for builder image.

[crenshaw-dev]

@rimasgo good question. I think I'll be doing the next 2.3 release, so I'll plan to cherry pick it then.