Use mise and bump deps

.github/workflows/main.yaml

@@ -1,29 +1,64 @@
 name: Build and push image
-
-on: push
-
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+permissions:
+  contents: "read"
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
 jobs:
+  go-version:
+    outputs:
+      go-version: ${{ steps.go-version.outputs.go-version }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # ratchet:jdx/mise-action@v4.0.1
+      - id: go-version
+        run: echo "go-version=$(mise current go)" >> $GITHUB_OUTPUT
+  checks:
+    strategy:
+      fail-fast: false
+      matrix:
+        mise-task:
+          - check:deadcode
+          - check:golangci-lint
+          - check:gosec
+          - check:govet
+          - check:govulncheck
+          - check:ratchet
+          - check:staticcheck
+          - ci:fmt
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # ratchet:jdx/mise-action@v4.0.1
+      - run: mise run ${{ matrix.mise-task }}
   build_and_push:
+    if: github.ref == 'refs/heads/main'
+    needs:
+      - go-version
+      - checks
     permissions:
       contents: "read"
       id-token: "write"
     runs-on: ubuntu-latest
     env:
-      RUNNER_IMG: "cgr.dev/chainguard/static"
-      BASEIMG_IDENTITY: "https://github.com/chainguard-images/images/.github/workflows/release.yaml@refs/heads/main"
-      BASEIMG_ISSUER: "https://token.actions.githubusercontent.com"
+      RUNNER_IMG: "gcr.io/distroless/static-debian12:nonroot"
+      BASEIMG_IDENTITY: "keyless@distroless.iam.gserviceaccount.com"
+      BASEIMG_ISSUER: "https://accounts.google.com"
     steps:
-      - uses: actions/checkout@v4
-      - name: Install cosign
-        uses: sigstore/cosign-installer@v3
-        with:
-          cosign-release: 'v2.2.1'
-      - name: Verify runner image
-        run: cosign verify --certificate-identity ${{ env.BASEIMG_IDENTITY }} --certificate-oidc-issuer ${{ env.BASEIMG_ISSUER }} ${{ env.RUNNER_IMG }}
-      - uses: nais/platform-build-push-sign@main
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # ratchet:sigstore/cosign-installer@v4.1.2
+      - run: cosign verify --certificate-identity ${{ env.BASEIMG_IDENTITY }} --certificate-oidc-issuer ${{ env.BASEIMG_ISSUER }} ${{ env.RUNNER_IMG }}
+      - uses: nais/platform-build-push-sign@df590279b21bc5978519685752f9eaddd546043c # ratchet:nais/platform-build-push-sign@main
         id: build_push_sign
         with:
           name: console-github-auth
           google_service_account: gh-console-github-auth
           push: ${{ github.actor != 'dependabot[bot]' }}
           workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
+

Dockerfile

@@ -1,16 +1,12 @@
-FROM golang:1.23 as builder
-
-ENV GOOS=linux
+ARG GO_VERSION=1.26
+FROM golang:${GO_VERSION} AS builder
 WORKDIR /src
-
-COPY go.mod .
-COPY go.sum .
+COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
-RUN CGO_ENABLED=0 go build -o console-github-auth ./cmd/console-github-auth/
+RUN CGO_ENABLED=0 go build -o console-github-auth .
 
-FROM cgr.dev/chainguard/static
+FROM gcr.io/distroless/static-debian12:nonroot
 COPY --from=builder /src/console-github-auth /app/console-github-auth
 ENTRYPOINT ["/app/console-github-auth"]
 

go.mod

@@ -1,14 +1,91 @@
 module github.com/nais/console-github-auth
 
-go 1.23
+go 1.26.4
+
+tool (
+	github.com/securego/gosec/v2/cmd/gosec
+	github.com/sethvargo/ratchet
+	golang.org/x/tools/cmd/deadcode
+	golang.org/x/vuln/cmd/govulncheck
+	honnef.co/go/tools/cmd/staticcheck
+	mvdan.cc/gofumpt
+)
 
 require (
-	github.com/golang-jwt/jwt/v5 v5.2.1
-	github.com/google/go-github/v66 v66.0.0
-	github.com/sirupsen/logrus v1.9.3
+	github.com/golang-jwt/jwt/v5 v5.3.1
+	github.com/google/go-github/v88 v88.0.0
 )
 
 require (
-	github.com/google/go-querystring v1.1.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
+	cloud.google.com/go v0.123.0 // indirect
+	cloud.google.com/go/auth v0.19.0 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	github.com/BurntSushi/toml v1.6.0 // indirect
+	github.com/anthropics/anthropic-sdk-go v1.46.0 // indirect
+	github.com/bahlo/generic-list-go v0.2.0 // indirect
+	github.com/braydonk/yaml v0.9.0 // indirect
+	github.com/buger/jsonparser v1.2.0 // indirect
+	github.com/ccojocar/zxcvbn-go v1.0.4 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
+	github.com/docker/cli v28.3.0+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/go-containerregistry v0.20.6 // indirect
+	github.com/google/go-github/v73 v73.0.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
+	github.com/googleapis/gax-go/v2 v2.22.0 // indirect
+	github.com/gookit/color v1.6.1 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/invopop/jsonschema v0.13.0 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/mailru/easyjson v0.9.2 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/openai/openai-go/v3 v3.37.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/securego/gosec/v2 v2.27.1 // indirect
+	github.com/sethvargo/ratchet v0.11.4 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/standard-webhooks/standard-webhooks/libraries v0.0.1 // indirect
+	github.com/tidwall/gjson v1.19.0 // indirect
+	github.com/tidwall/match v1.2.0 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
+	github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect
+	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 // indirect
+	golang.org/x/mod v0.36.0 // indirect
+	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
+	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/vuln v1.3.0 // indirect
+	google.golang.org/api v0.274.0 // indirect
+	google.golang.org/genai v1.58.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/grpc v1.81.1 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	honnef.co/go/tools v0.7.0 // indirect
+	mvdan.cc/gofumpt v0.10.0 // indirect
 )