upgrade to Go1.20 and other updates

.github/workflows/ci.yml

@@ -9,17 +9,17 @@ jobs:
     name: ci
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
-    - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
-      with:
-        go-version: 1.19
-        check-latest: true
+      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
+        with:
+          go-version: '1.20'
+          check-latest: true
 
-    - name: Tests
-      run: make test
+      - name: Tests
+        run: make test
 
-    - name: Build
-      run: go build .
+      - name: Build
+        run: go build ./...
 
   golangci:
     name: lint
@@ -28,10 +28,10 @@ jobs:
       - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
       - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
         with:
-          go-version: 1.19
+          go-version: '1.20'
           check-latest: true
       - name: golangci-lint
         uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # v3.4.0
         timeout-minutes: 5
         with:
-          version: v1.50.1
+          version: v1.51

.github/workflows/release.yml

@@ -3,10 +3,15 @@ name: Release
 on:
   push:
     tags:
-    - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
+      - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
 
 jobs:
   release:
+
+    outputs:
+      hashes: ${{ steps.hash.outputs.hashes }}
+      tag_name: ${{ steps.tag.outputs.tag_name }}
+
     runs-on: ubuntu-latest
 
     permissions:
@@ -17,42 +22,62 @@ jobs:
     env:
       GOPATH: ${{ github.workspace }}
       GO111MODULE: on
-      COSIGN_EXPERIMENTAL: "true"
+      COSIGN_YES: "true"
 
     steps:
-    - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
-      with:
-        go-version: 1.19
-        check-latest: true
-
-    - uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
-    - uses: anchore/sbom-action/download-syft@07978da4bdb4faa726e52dfc6b1bed63d4b56479 # v0.13.3
-
-    - name: Install GoReleaser
-      uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
-      with:
-        install-only: true
-
-    - name: Log into ghcr.io
-      uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-
-    - name: Check out code onto GOPATH
-      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
-      with:
-        fetch-depth: 1
-        path: ./src/github.com/${{ github.repository }}
-
-    - name: Get TAG
-      id: get_tag
-      run: echo ::set-output name=TAG::${GITHUB_REF#refs/tags/}
-
-    - name: Run goreleaser
-      working-directory: ./src/github.com/${{ github.repository }}
-      run: goreleaser release --rm-dist
-      env:
-        GIT_TAG: ${{ steps.get_tag.outputs.TAG }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
+        with:
+          go-version: '1.20'
+          check-latest: true
+
+      - uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
+      - uses: anchore/sbom-action/download-syft@07978da4bdb4faa726e52dfc6b1bed63d4b56479 # v0.13.3
+
+      - name: Log into ghcr.io
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check out code onto GOPATH
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        with:
+          fetch-depth: 1
+          path: ./src/github.com/${{ github.repository }}
+
+      - name: Set tag output
+        id: get_tag
+        run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
+
+      - name: Run GoReleaser
+        id: run-goreleaser
+        uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
+        with:
+          version: latest
+          args: release --clean --timeout 120m
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GIT_TAG: ${{ steps.get_tag.outputs.TAG }}
+
+      - name: Generate subject
+        id: hash
+        env:
+          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
+        run: |
+          set -euo pipefail
+          checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
+          echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
+
+  provenance:
+    needs:
+      - release
+    permissions:
+      actions: read # To read the workflow path.
+      id-token: write # To sign the provenance.
+      contents: write # To add assets to a release.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.5.0
+    with:
+      base64-subjects: "${{ needs.release.outputs.hashes }}"
+      upload-assets: true # upload to a new release
+      upload-tag-name: "${{ needs.release.outputs.tag_name }}"

.golangci.yml

@@ -1,31 +1,32 @@
+---
 linters:
   enable:
-  - asciicheck
-  - depguard
-  - errcheck
-  - errorlint
-  - gofmt
-  - goimports
-  - gosec
-  - gocritic
-  - importas
-  - prealloc
-  - revive
-  - misspell
-  - stylecheck
-  - tparallel
-  - unconvert
-  - unparam
-  - unused
-  - whitespace
+    - asciicheck
+    - depguard
+    - errcheck
+    - errorlint
+    - gofmt
+    - goimports
+    - gosec
+    - gocritic
+    - importas
+    - prealloc
+    - revive
+    - misspell
+    - stylecheck
+    - tparallel
+    - unconvert
+    - unparam
+    - unused
+    - whitespace
 output:
   uniq-by-line: false
 issues:
   exclude-rules:
-  - path: _test\.go
-    linters:
-    - errcheck
-    - gosec
+    - path: _test\.go
+      linters:
+        - errcheck
+        - gosec
   max-issues-per-linter: 0
   max-same-issues: 0
 run:

.goreleaser.yml

@@ -11,7 +11,8 @@ snapshot:
   name_template: '{{ .Tag }}-SNAPSHOT'
 
 builds:
-  - binary: github-actions-exporter
+  - id: binary
+    binary: github-actions-exporter
     goos:
       - linux
       - darwin
@@ -24,11 +25,11 @@ builds:
     goarm:
       - 7
     ldflags: |
-        -X github.com/prometheus/common/version.Version={{.Version}}
-        -X github.com/prometheus/common/version.Revision={{.Commit}}
-        -X github.com/prometheus/common/version.Branch={{.Branch}}
-        -X github.com/prometheus/common/version.BuildUser=cpanato
-        -X github.com/prometheus/common/version.BuildDate={{.Date}}
+      -X github.com/prometheus/common/version.Version={{.Version}}
+      -X github.com/prometheus/common/version.Revision={{.Commit}}
+      -X github.com/prometheus/common/version.Branch={{.Branch}}
+      -X github.com/prometheus/common/version.BuildUser=cpanato
+      -X github.com/prometheus/common/version.BuildDate={{.Date}}
 
 archives:
   - format: binary
@@ -44,70 +45,24 @@ signs:
     args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
     artifacts: binary
 
-dockers:
-  - image_templates:
-      - "ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-amd64"
-    use: buildx
-    dockerfile: Dockerfile
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - --label=org.opencontainers.image.version={{ .Version }}
-      - --label=org.opencontainers.image.title={{ .ProjectName }}
-      - --label=org.opencontainers.image.source=https://github.com/cpanato/{{ .ProjectName }}
-  - image_templates:
-      - "ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-arm64"
-    use: buildx
-    goarch: arm64
-    dockerfile: Dockerfile
-    build_flag_templates:
-      - "--platform=linux/arm64"
-      - --label=org.opencontainers.image.version={{ .Version }}
-      - --label=org.opencontainers.image.title={{ .ProjectName }}
-      - --label=org.opencontainers.image.source=https://github.com/cpanato/{{ .ProjectName }}
-  - image_templates:
-      - "ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-arm"
-    use: buildx
-    goarch: arm
-    goarm: 7
-    dockerfile: Dockerfile
-    build_flag_templates:
-      - "--platform=linux/arm/v7"
-      - --label=org.opencontainers.image.version={{ .Version }}
-      - --label=org.opencontainers.image.title={{ .ProjectName }}
-      - --label=org.opencontainers.image.source=https://github.com/cpanato/{{ .ProjectName }}
-  - image_templates:
-      - "ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-s390x"
-    use: buildx
-    goarch: s390x
-    dockerfile: Dockerfile
-    build_flag_templates:
-      - "--platform=linux/s390x"
-      - --label=org.opencontainers.image.version={{ .Version }}
-      - --label=org.opencontainers.image.title={{ .ProjectName }}
-      - --label=org.opencontainers.image.source=https://github.com/cpanato/{{ .ProjectName }}
-  - image_templates:
-      - "ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-ppc64le"
-    use: buildx
-    goarch: ppc64le
-    dockerfile: Dockerfile
-    build_flag_templates:
-      - "--platform=linux/ppc64le"
-      - --label=org.opencontainers.image.version={{ .Version }}
-      - --label=org.opencontainers.image.title={{ .ProjectName }}
-      - --label=org.opencontainers.image.source=https://github.com/cpanato/{{ .ProjectName }}
-
-docker_manifests:
-  - name_template: ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}
-    image_templates:
-      - ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-amd64
-      - ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-arm64
-      - ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-arm
-      - ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-s390x
-      - ghcr.io/cpanato/{{ .ProjectName }}:{{ .Version }}-ppc64le
+kos:
+  - id: ko-image
+    main: .
+    base_image: cgr.dev/chainguard/static
+    repository: ghcr.io/cpanato/{{ .ProjectName }}
+    platforms:
+      - all
+    tags:
+      - '{{ .Version }}'
+    sbom: spdx
+    build: binary
+    bare: true
+    preserve_import_paths: false
+    base_import_paths: true
 
 docker_signs:
   - artifacts: all
-    args: [ "sign", "${artifact}" ]
+    args: ["sign", "${artifact}"]
 
 release:
   github:

example/Dockerfile.dev

@@ -1,4 +1,4 @@
-FROM golang:1.17-alpine as builder
+FROM cgr.dev/chainguard/go:1.20 as builder
 
 ARG GOARCH="amd64"
 ARG GOOS="linux"
@@ -8,7 +8,7 @@ COPY . .
 
 RUN go build -o github-actions-exporter .
 
-FROM ghcr.io/distroless/busybox:latest
+FROM cgr.dev/chainguard/static:latest
 
 COPY --from=builder /code/github-actions-exporter /bin/github-actions-exporter
 

example/prometheus.yml

@@ -1,12 +1,12 @@
 global:
-  scrape_interval:     15s
+  scrape_interval: 15s
 
 scrape_configs:
   - job_name: "prometheus"
     scrape_interval: 5s
     static_configs:
-    - targets: ["localhost:9090"]
+      - targets: ["localhost:9090"]
 
   - job_name: "github-actions-exporter"
     static_configs:
-    - targets: ["github-actions-exporter:9101"]
+      - targets: ["github-actions-exporter:9101"]

go.mod

@@ -1,11 +1,11 @@
 module github.com/cpanato/github_actions_exporter
 
-go 1.19
+go 1.20
 
 require (
 	github.com/alecthomas/kingpin/v2 v2.3.1
 	github.com/go-kit/log v0.2.1
-	github.com/google/go-github/v47 v47.1.0
+	github.com/google/go-github/v50 v50.1.0
 	github.com/prometheus/client_golang v1.14.0
 	github.com/prometheus/common v0.41.0
 	github.com/stretchr/testify v1.8.2
@@ -26,7 +26,7 @@ require (
 	github.com/prometheus/client_model v0.3.0 // indirect
 	github.com/prometheus/procfs v0.9.0 // indirect
 	github.com/xhit/go-str2duration v1.2.0 // indirect
-	golang.org/x/crypto v0.5.0 // indirect
+	golang.org/x/crypto v0.7.0 // indirect
 	golang.org/x/net v0.8.0 // indirect
 	golang.org/x/sys v0.6.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect