More docker and some updates

.github/workflows/lint.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: .tool-versions
 

.github/workflows/release.yml

@@ -14,6 +14,7 @@ permissions:
   id-token: write # needed for keyless signing
   packages: write # needed for ghcr access
   attestations: write # needed for provenance
+  artifact-metadata: write
 
 jobs:
   release:
@@ -23,30 +24,36 @@ jobs:
         with:
           fetch-depth: 0
 
-      # - name: Configure AWS Credentials
-      #   uses: aws-actions/configure-aws-credentials@ff717079ee2060e4bcee96c4779b553acc87447c # v4
-      #   id: awscreds
-      #   with:
-      #     role-to-assume: ${{ secrets.PRODUCTION_AWS_ROLE }}
-      #     aws-region: us-east-1
-      #     managed-session-policies: arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6
+        id: awscreds
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-east-1
 
-      # - name: Login to Amazon ECR
-      #   uses: aws-actions/amazon-ecr-login@006813a119ae0fdeb70ae00f16cda21ee6f2ff3d # v2
-      #   id: ecrauth
-      #   with:
-      #     registries: ${{ steps.awscreds.outputs.aws-account-id }}
-      #     mask-password: "true"
+      - name: Login to Amazon ECR Private
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
+        id: ecrauth
+        with:
+          registries: ${{ steps.awscreds.outputs.aws-account-id }}
+          mask-password: "true"
+
+      - name: Login to Amazon ECR Public
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
+        id: ecrpublicauth
+        with:
+          registry-type: public
+          mask-password: "true"
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version-file: .tool-versions
 
-      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
 
-      - uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
+      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
 
       - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
@@ -59,16 +66,17 @@ jobs:
         run: echo "version=v$(grep '^goreleaser ' .tool-versions | awk '{print $2}')" >> "$GITHUB_OUTPUT"
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@9a127d869fb706213d29cdf8eef3a4ea2b869415 # v7
+        uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 # v7
         with:
           distribution: goreleaser
           args: release --clean
           version: ${{ steps.goreleaser-version.outputs.version }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           HOMEBREW_SCOOP_GITHUB_TOKEN: ${{ secrets.HOMEBREW_SCOOP_GITHUB_TOKEN }}
-          # ECR_REGISTRY: ${{ steps.ecrauth.outputs.registry }}
+          ECR_PRIVATE_REGISTRY: ${{ steps.ecrauth.outputs.registry }}
+          ECR_PUBLIC_REGISTRY: ${{ steps.ecrpublicauth.outputs.registry }}
 
-      - uses: actions/attest-build-provenance@43d14bc2b83dec42d39ecae14e916627a18bb661 # v3
+      - uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4
         with:
           subject-checksums: ./dist/checksums.txt

.goreleaser.yml

@@ -105,8 +105,10 @@ homebrew_casks:
 dockers_v2:
   - images:
       - "ghcr.io/webdestroya/groundskeeper"
+      - "{{ .Env.ECR_PUBLIC_REGISTRY }}/groundskeeper"
+      - "{{ .Env.ECR_PRIVATE_REGISTRY }}/groundskeeper"
     tags:
-      - "{{ .Tag }}"
+      - "v{{ .Version }}"
       - latest
     labels:
       "org.opencontainers.image.created": "{{.Date}}"
@@ -120,5 +122,5 @@ docker_signs:
     output: true
     args:
       - "sign"
-      - "${artifact}"
+      - "${artifact}@${digest}"
       - "--yes"

Dockerfile

@@ -3,7 +3,7 @@ RUN apk add --no-cache ca-certificates
 RUN update-ca-certificates
 
 # use busybox instead of scratch because we need some utilities for remote console
-FROM busybox:latest
+FROM busybox:stable
 ARG TARGETPLATFORM
 
 # Copy CA Certificates

Taskfile.yml

@@ -34,6 +34,8 @@ tasks:
 
   test:coverage:
     desc: Generate test coverage report
+    aliases:
+      - coverage
     cmds:
       - mkdir -p coverage
       - go test -v ./... -coverpkg=./... -coverprofile=coverage/c.out -covermode=count -short

go.mod

@@ -21,7 +21,7 @@ require (
 	github.com/webdestroya/x/logger v0.2.0
 	github.com/webdestroya/x/util v0.2.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/sync v0.19.0
+	golang.org/x/sync v0.20.0
 	modernc.org/sqlite v1.48.0
 )
 

go.sum

@@ -148,6 +148,8 @@ golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8=
 golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w=
 golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
 golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
 golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=

internal/cmd/pullcmd/pull_cmd.go

@@ -34,7 +34,7 @@ func New() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:     "pull",
 		Short:   "Pull migration files. Used within a remote console session",
-		GroupID: "debug",
+		GroupID: "debugging",
 		PreRunE: r.PreRunE,
 		RunE:    r.RunE,
 		Args:    cobra.NoArgs,

internal/cmd/rootcmd/root_cmd.go

@@ -47,7 +47,7 @@ func New() *cobra.Command {
 	})
 
 	cmd.AddGroup(&cobra.Group{
-		ID:    "debug",
+		ID:    "debugging",
 		Title: "Debugging Commands:",
 	})