chore: Bump to GoLang v1.20

[shahzadlone]

Relevant issue(s)

• Resolves Use govulncheck in CI #522
• Resolves Bump go version to v1.20 #1687

Description

• This is a routine version bump of GoLang, the previous bump was done in (chore: Bump to GoLang v1.19 #818)
• This PR also introduces a new workflow action (not-mandatory to pass in order to merge) that was showing some vulnerabilities pre-version-bump, all of the vulnerabilities were resolved once the golang version was bumped. In future this trigger will be used to bump golang versions.
• Also updates the golang version for AWS AMI generation.

Note:

• Before the bump we had 13 vulnerabilities: https://github.com/sourcenetwork/defradb/actions/runs/5629964770/job/15255493129?pr=1688
• After the bump: passing with no vulnerabilities.

How has this been tested?

• Added action that failed with vulnerabilities.
• Bumped version.
• Vulnerabilities were resolved and action passed.

Specify the platform(s) on which this was tested:

• Arch Linux

[source-devs]

Terraform Format and Style success

Terraform Initialization success

Terraform Validation success

Terraform Plan success

Show Plan

Terraform Plan Output:
data.aws_ami.ami: Reading...
aws_security_group.sg: Refreshing state... [id=sg-03ba6f1f9cd118f43]
data.aws_ami.ami: Read complete after 0s [id=ami-090df366ae87f905c]
aws_instance.instance: Refreshing state... [id=i-0861cf88407e45be4]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

# aws_instance.instance must be replaced
-/+ resource "aws_instance" "instance" {
    ~ ami                                  = "ami-0aec60e193aa9f7f0" -> "ami-090df366ae87f905c" # forces replacement
    ~ arn                                  = "arn:aws:ec2:us-east-1:575155546886:instance/i-0861cf88407e45be4" -> (known after apply)
    ~ associate_public_ip_address          = true -> (known after apply)
    ~ availability_zone                    = "us-east-1c" -> (known after apply)
    ~ cpu_core_count                       = 1 -> (known after apply)
    ~ cpu_threads_per_core                 = 1 -> (known after apply)
    ~ disable_api_stop                     = false -> (known after apply)
    ~ disable_api_termination              = false -> (known after apply)
    ~ ebs_optimized                        = false -> (known after apply)
    - hibernation                          = false -> null
    + host_id                              = (known after apply)
    + host_resource_group_arn              = (known after apply)
    + iam_instance_profile                 = (known after apply)
    ~ id                                   = "i-0861cf88407e45be4" -> (known after apply)
    ~ instance_initiated_shutdown_behavior = "stop" -> (known after apply)
    ~ instance_state                       = "running" -> (known after apply)
    ~ ipv6_address_count                   = 0 -> (known after apply)
    ~ ipv6_addresses                       = [] -> (known after apply)
    ~ monitoring                           = false -> (known after apply)
    + outpost_arn                          = (known after apply)
    + password_data                        = (known after apply)
    + placement_group                      = (known after apply)
    ~ placement_partition_number           = 0 -> (known after apply)
    ~ primary_network_interface_id         = "eni-08a3ca5679d535293" -> (known after apply)
    ~ private_dns                          = "ip-172-31-80-89.ec2.internal" -> (known after apply)
    ~ private_ip                           = "172.31.80.89" -> (known after apply)
    ~ public_dns                           = "ec2-18-212-67-74.compute-1.amazonaws.com" -> (known after apply)
    ~ public_ip                            = "18.212.67.74" -> (known after apply)
    ~ secondary_private_ips                = [] -> (known after apply)
    ~ subnet_id                            = "subnet-0bc2e025" -> (known after apply)
      tags                                 = {
          "environment"  = "dev"
          "organization" = "source"
      }
    ~ tenancy                              = "default" -> (known after apply)
    + user_data                            = (known after apply)
    + user_data_base64                     = (known after apply)
    ~ vpc_security_group_ids               = [
        - "sg-03ba6f1f9cd118f43",
      ] -> (known after apply)
      # (7 unchanged attributes hidden)

    ~ capacity_reservation_specification {
        ~ capacity_reservation_preference = "open" -> (known after apply)

        + capacity_reservation_target {
            + capacity_reservation_id                 = (known after apply)
            + capacity_reservation_resource_group_arn = (known after apply)
          }
      }

    - credit_specification {
        - cpu_credits = "standard" -> null
      }

    + ebs_block_device {
        + delete_on_termination = (known after apply)
        + device_name           = (known after apply)
        + encrypted             = (known after apply)
        + iops                  = (known after apply)
        + kms_key_id            = (known after apply)
        + snapshot_id           = (known after apply)
        + tags                  = (known after apply)
        + throughput            = (known after apply)
        + volume_id             = (known after apply)
        + volume_size           = (known after apply)
        + volume_type           = (known after apply)
      }

    ~ enclave_options {
        ~ enabled = false -> (known after apply)
      }

    + ephemeral_block_device {
        + device_name  = (known after apply)
        + no_device    = (known after apply)
        + virtual_name = (known after apply)
      }

    ~ maintenance_options {
        ~ auto_recovery = "default" -> (known after apply)
      }

    ~ metadata_options {
        ~ http_endpoint               = "enabled" -> (known after apply)
        ~ http_put_response_hop_limit = 1 -> (known after apply)
        ~ http_tokens                 = "optional" -> (known after apply)
        ~ instance_metadata_tags      = "disabled" -> (known after apply)
      }

    + network_interface {
        + delete_on_termination = (known after apply)
        + device_index          = (known after apply)
        + network_card_index    = (known after apply)
        + network_interface_id  = (known after apply)
      }

    ~ private_dns_name_options {
        ~ enable_resource_name_dns_a_record    = false -> (known after apply)
        ~ enable_resource_name_dns_aaaa_record = false -> (known after apply)
        ~ hostname_type                        = "ip-name" -> (known after apply)
      }

    ~ root_block_device {
        ~ delete_on_termination = true -> (known after apply)
        ~ device_name           = "/dev/sda1" -> (known after apply)
        ~ encrypted             = false -> (known after apply)
        ~ iops                  = 100 -> (known after apply)
        + kms_key_id            = (known after apply)
        ~ tags                  = {} -> (known after apply)
        ~ throughput            = 0 -> (known after apply)
        ~ volume_id             = "vol-07158d9693e5103ba" -> (known after apply)
        ~ volume_size           = 8 -> (known after apply)
        ~ volume_type           = "gp2" -> (known after apply)
      }
  }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
~ ec2instance = "i-0861cf88407e45be4" -> (known after apply)
~ ip          = "18.212.67.74" -> (known after apply)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.
Releasing state lock. This may take a few moments...

Pushed By: @shahzadlone
SHA: 28d0704ebc2ac1c98c544e5c0b32efc45e2fe892

[source-devs]

Terraform Format and Style success

Terraform Initialization success

Terraform Validation success

Terraform Plan success

Show Plan

Terraform Plan Output:
data.aws_ami.ami: Reading...
aws_security_group.sg: Refreshing state... [id=sg-03ba6f1f9cd118f43]
data.aws_ami.ami: Read complete after 0s [id=ami-090df366ae87f905c]
aws_instance.instance: Refreshing state... [id=i-0861cf88407e45be4]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
-/+ destroy and then create replacement

Terraform will perform the following actions:

# aws_instance.instance must be replaced
-/+ resource "aws_instance" "instance" {
    ~ ami                                  = "ami-0aec60e193aa9f7f0" -> "ami-090df366ae87f905c" # forces replacement
    ~ arn                                  = "arn:aws:ec2:us-east-1:575155546886:instance/i-0861cf88407e45be4" -> (known after apply)
    ~ associate_public_ip_address          = true -> (known after apply)
    ~ availability_zone                    = "us-east-1c" -> (known after apply)
    ~ cpu_core_count                       = 1 -> (known after apply)
    ~ cpu_threads_per_core                 = 1 -> (known after apply)
    ~ disable_api_stop                     = false -> (known after apply)
    ~ disable_api_termination              = false -> (known after apply)
    ~ ebs_optimized                        = false -> (known after apply)
    - hibernation                          = false -> null
    + host_id                              = (known after apply)
    + host_resource_group_arn              = (known after apply)
    + iam_instance_profile                 = (known after apply)
    ~ id                                   = "i-0861cf88407e45be4" -> (known after apply)
    ~ instance_initiated_shutdown_behavior = "stop" -> (known after apply)
    ~ instance_state                       = "running" -> (known after apply)
    ~ ipv6_address_count                   = 0 -> (known after apply)
    ~ ipv6_addresses                       = [] -> (known after apply)
    ~ monitoring                           = false -> (known after apply)
    + outpost_arn                          = (known after apply)
    + password_data                        = (known after apply)
    + placement_group                      = (known after apply)
    ~ placement_partition_number           = 0 -> (known after apply)
    ~ primary_network_interface_id         = "eni-08a3ca5679d535293" -> (known after apply)
    ~ private_dns                          = "ip-172-31-80-89.ec2.internal" -> (known after apply)
    ~ private_ip                           = "172.31.80.89" -> (known after apply)
    ~ public_dns                           = "ec2-18-212-67-74.compute-1.amazonaws.com" -> (known after apply)
    ~ public_ip                            = "18.212.67.74" -> (known after apply)
    ~ secondary_private_ips                = [] -> (known after apply)
    ~ subnet_id                            = "subnet-0bc2e025" -> (known after apply)
      tags                                 = {
          "environment"  = "dev"
          "organization" = "source"
      }
    ~ tenancy                              = "default" -> (known after apply)
    + user_data                            = (known after apply)
    + user_data_base64                     = (known after apply)
    ~ vpc_security_group_ids               = [
        - "sg-03ba6f1f9cd118f43",
      ] -> (known after apply)
      # (7 unchanged attributes hidden)

    ~ capacity_reservation_specification {
        ~ capacity_reservation_preference = "open" -> (known after apply)

        + capacity_reservation_target {
            + capacity_reservation_id                 = (known after apply)
            + capacity_reservation_resource_group_arn = (known after apply)
          }
      }

    - credit_specification {
        - cpu_credits = "standard" -> null
      }

    + ebs_block_device {
        + delete_on_termination = (known after apply)
        + device_name           = (known after apply)
        + encrypted             = (known after apply)
        + iops                  = (known after apply)
        + kms_key_id            = (known after apply)
        + snapshot_id           = (known after apply)
        + tags                  = (known after apply)
        + throughput            = (known after apply)
        + volume_id             = (known after apply)
        + volume_size           = (known after apply)
        + volume_type           = (known after apply)
      }

    ~ enclave_options {
        ~ enabled = false -> (known after apply)
      }

    + ephemeral_block_device {
        + device_name  = (known after apply)
        + no_device    = (known after apply)
        + virtual_name = (known after apply)
      }

    ~ maintenance_options {
        ~ auto_recovery = "default" -> (known after apply)
      }

    ~ metadata_options {
        ~ http_endpoint               = "enabled" -> (known after apply)
        ~ http_put_response_hop_limit = 1 -> (known after apply)
        ~ http_tokens                 = "optional" -> (known after apply)
        ~ instance_metadata_tags      = "disabled" -> (known after apply)
      }

    + network_interface {
        + delete_on_termination = (known after apply)
        + device_index          = (known after apply)
        + network_card_index    = (known after apply)
        + network_interface_id  = (known after apply)
      }

    ~ private_dns_name_options {
        ~ enable_resource_name_dns_a_record    = false -> (known after apply)
        ~ enable_resource_name_dns_aaaa_record = false -> (known after apply)
        ~ hostname_type                        = "ip-name" -> (known after apply)
      }

    ~ root_block_device {
        ~ delete_on_termination = true -> (known after apply)
        ~ device_name           = "/dev/sda1" -> (known after apply)
        ~ encrypted             = false -> (known after apply)
        ~ iops                  = 100 -> (known after apply)
        + kms_key_id            = (known after apply)
        ~ tags                  = {} -> (known after apply)
        ~ throughput            = 0 -> (known after apply)
        ~ volume_id             = "vol-07158d9693e5103ba" -> (known after apply)
        ~ volume_size           = 8 -> (known after apply)
        ~ volume_type           = "gp2" -> (known after apply)
      }
  }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
~ ec2instance = "i-0861cf88407e45be4" -> (known after apply)
~ ip          = "18.212.67.74" -> (known after apply)

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pushed By: @shahzadlone
SHA: 8b9c28de4993ee5ff273a0b3bf3f73ed18de8920

[codecov]

Codecov Report

Patch coverage has no change and project coverage change: +0.11 🎉

Comparison is base (bc8ada9) 75.29% compared to head (8b9c28d) 75.40%.

@@             Coverage Diff             @@
##           develop    #1689      +/-   ##
===========================================
+ Coverage    75.29%   75.40%   +0.11%     
===========================================
  Files          208      208              
  Lines        21694    21694              
===========================================
+ Hits         16333    16357      +24     
+ Misses        4220     4199      -21     
+ Partials      1141     1138       -3     

Flag	Coverage Δ
all-tests	75.40% <ø> (+0.11%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 6 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bc8ada9...8b9c28d. Read the comment docs.

[fredcarle]

LGTM. Thanks for doing that change. It will be good to avoid potential vulnerabilities in the future.

[shahzadlone]

@jsimnz Do you see value in having a consistent seed and passing it the place where the random generation happens (as now it's not a global thing but a local object we would have to pass around with an initiated seed).

[shahzadlone]

Made issue for tracking: #1690