Skip to content

Commit 5370ec2

Browse files
bobcallawaybobcallaway
authoredMar 28, 2025··
use go tool to manage versions of tools (#149)
* use go tool to manage versions of tools * move golangci-lint to a Docker-based strategy * bump exp back up to latest * remove extra ) * preserve caches between runs of golangci-lint * test if a diff .mod file passes dep-review * dependabot won't keep that up to date Signed-off-by: Bob Callaway <bcallaway@google.com>
1 parent 8a42c2d commit 5370ec2

File tree

6 files changed

+42
-19
lines changed

6 files changed

+42
-19
lines changed
 

‎.github/workflows/license_check.yml

+1-3
Original file line numberDiff line numberDiff line change
@@ -31,12 +31,10 @@ jobs:
3131
with:
3232
go-version-file: './go.mod'
3333
check-latest: true
34-
- name: Install addlicense
35-
run: go install github.com/google/addlicense@dc31ac9ffcca99c9457226366135701794b128c0 # v1.1.1
3634
- name: Check license headers
3735
run: |
3836
set -e
39-
addlicense -check -l apache -c 'The Sigstore Authors' -ignore "third_party/**" -v *
37+
go tool addlicense -check -l apache -c 'The Sigstore Authors' -ignore "third_party/**" -v *
4038
4139
dependency-license-review:
4240
name: License and Vulnerability Scan

‎.github/workflows/lint.yml

+6-1
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,14 @@ jobs:
3232
go-version-file: './go.mod'
3333
check-latest: true
3434

35+
- name: "Extract golangci-lint version from Dockerfile.golangci-lint"
36+
id: "golangci-lint-version"
37+
run: |
38+
awk -F '[@:]' '/FROM golangci\/golangci-lint/{print "version="$2; exit}' Dockerfile.golangci-lint >> "$GITHUB_OUTPUT"
39+
3540
- name: golangci-lint
3641
uses: golangci/golangci-lint-action@1481404843c368bc19ca9406f87d6e0fc97bdcfd # v7.0.0
3742
with:
38-
version: v2.0.1
43+
version: ${{ steps.golangci-lint-version.outputs.version }}
3944
args: --timeout=5m --verbose
4045

‎Dockerfile.golangci-lint

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
FROM golangci/golangci-lint:v2.0.2@sha256:d55581f7797e7a0877a7c3aaa399b01bdc57d2874d6412601a046cc4062cb62e AS golangci-lint
2+
3+
ENV FOO=BAR

‎Makefile

+9-9
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,15 @@ SERVER_LDFLAGS=$(REKOR_LDFLAGS)
4444

4545
GOBIN = $(abspath ./tools/bin)
4646

47-
lint: tools
48-
$(GOBIN)/addlicense -l apache -c "The Sigstore Authors" -ignore "third_party/**" -v *
49-
$(GOBIN)/goimports -w $(SRC)
50-
$(GOBIN)/golangci-lint run -v ./...
47+
lint:
48+
go tool addlicense -l apache -c "The Sigstore Authors" -ignore "third_party/**" -v *
49+
go tool goimports -w $(SRC)
50+
docker run -t --rm -v $(PWD):/app -w /app \
51+
--user $(shell id -u):$(shell id -g) \
52+
-v $(shell go env GOCACHE):/.cache/go-build -e GOCACHE=/.cache/go-build \
53+
-v $(shell go env GOMODCACHE):/.cache/mod -e GOMODCACHE=/.cache/mod \
54+
-v ~/.cache/golangci-lint:/.cache/golangci-lint -e GOLANGCI_LINT_CACHE=/.cache/golangci-lint \
55+
$(shell awk -F '[ @]' '/FROM golangci\/golangci-lint/{print $$2; exit}' Dockerfile.golangci-lint) golangci-lint run -v ./...
5156

5257
gosec: ## Run gosec security scanner
5358
$(GOBIN)/gosec ./...
@@ -67,11 +72,6 @@ ko-local: ## Build container images locally using ko
6772
protos: $(PROTO_SRC)
6873
$(MAKE) -C protoc-builder protos
6974

70-
tools:
71-
GOBIN=$(GOBIN) go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.0.1
72-
GOBIN=$(GOBIN) go install golang.org/x/tools/cmd/goimports@v0.30.0
73-
GOBIN=$(GOBIN) go install github.com/google/addlicense@v1.1.1
74-
7575
clean: ## Remove built binaries and artifacts
7676
rm -rf dist
7777
rm -rf hack/tools/bin

‎go.mod

+11
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,15 @@ require (
7171
github.com/aws/aws-sdk-go-v2/service/sts v1.33.17 // indirect
7272
github.com/aws/smithy-go v1.22.3 // indirect
7373
github.com/beorn7/perks v1.0.1 // indirect
74+
github.com/bmatcuk/doublestar/v4 v4.0.2 // indirect
7475
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
7576
github.com/cespare/xxhash/v2 v2.3.0 // indirect
7677
github.com/cncf/xds/go v0.0.0-20241223141626-cff3c89139a3 // indirect
7778
github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
7879
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
7980
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
8081
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
82+
github.com/fatih/color v1.18.0 // indirect
8183
github.com/felixge/httpsnoop v1.0.4 // indirect
8284
github.com/fsnotify/fsnotify v1.8.0 // indirect
8385
github.com/globocom/go-buffer v1.2.2 // indirect
@@ -87,6 +89,7 @@ require (
8789
github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
8890
github.com/golang-jwt/jwt/v5 v5.2.2 // indirect
8991
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
92+
github.com/google/addlicense v1.1.1 // indirect
9093
github.com/google/go-cmp v0.7.0 // indirect
9194
github.com/google/go-containerregistry v0.20.3 // indirect
9295
github.com/google/s2a-go v0.1.9 // indirect
@@ -111,9 +114,11 @@ require (
111114
github.com/klauspost/compress v1.17.11 // indirect
112115
github.com/kylelemons/godebug v1.1.0 // indirect
113116
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
117+
github.com/mattn/go-colorable v0.1.14 // indirect
114118
github.com/mitchellh/go-homedir v1.1.0 // indirect
115119
github.com/mitchellh/mapstructure v1.5.0 // indirect
116120
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
121+
github.com/onsi/gomega v1.36.2 // indirect
117122
github.com/opencontainers/go-digest v1.0.0 // indirect
118123
github.com/pelletier/go-toml/v2 v2.2.3 // indirect
119124
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
@@ -153,9 +158,15 @@ require (
153158
golang.org/x/term v0.30.0 // indirect
154159
golang.org/x/text v0.23.0 // indirect
155160
golang.org/x/time v0.10.0 // indirect
161+
golang.org/x/tools v0.31.0 // indirect
156162
google.golang.org/api v0.224.0 // indirect
157163
google.golang.org/genproto v0.0.0-20250122153221-138b5a5a4fd4 // indirect
158164
google.golang.org/genproto/googleapis/rpc v0.0.0-20250303144028-a0af3efb3deb // indirect
159165
gopkg.in/yaml.v3 v3.0.1 // indirect
160166
k8s.io/klog/v2 v2.130.1 // indirect
161167
)
168+
169+
tool (
170+
github.com/google/addlicense
171+
golang.org/x/tools/cmd/goimports
172+
)

‎go.sum

+12-6
Original file line numberDiff line numberDiff line change
@@ -698,6 +698,8 @@ github.com/aws/smithy-go v1.22.3/go.mod h1:t1ufH5HMublsJYulve2RKmHDC15xu1f26kHCp
698698
github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
699699
github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
700700
github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
701+
github.com/bmatcuk/doublestar/v4 v4.0.2 h1:X0krlUVAVmtr2cRoTqR8aDMrDqnB36ht8wpWTiQ3jsA=
702+
github.com/bmatcuk/doublestar/v4 v4.0.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
701703
github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
702704
github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
703705
github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
@@ -767,8 +769,8 @@ github.com/envoyproxy/protoc-gen-validate v0.10.1/go.mod h1:DRjgyB0I43LtJapqN6Ni
767769
github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
768770
github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
769771
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
770-
github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
771-
github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
772+
github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
773+
github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
772774
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
773775
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
774776
github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
@@ -850,6 +852,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
850852
github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
851853
github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
852854
github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
855+
github.com/google/addlicense v1.1.1 h1:jpVf9qPbU8rz5MxKo7d+RMcNHkqxi4YJi/laauX4aAE=
856+
github.com/google/addlicense v1.1.1/go.mod h1:Sm/DHu7Jk+T5miFHHehdIjbi4M5+dJDRS3Cq0rncIxA=
853857
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
854858
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
855859
github.com/google/flatbuffers v2.0.8+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
@@ -1007,8 +1011,8 @@ github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuz
10071011
github.com/lyft/protoc-gen-star v0.6.1/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
10081012
github.com/lyft/protoc-gen-star/v2 v2.0.1/go.mod h1:RcCdONR2ScXaYnQC5tUzxzlpA3WVYF7/opLeUgcQs/o=
10091013
github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
1010-
github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
1011-
github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
1014+
github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
1015+
github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
10121016
github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
10131017
github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
10141018
github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
@@ -1036,8 +1040,8 @@ github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
10361040
github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
10371041
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
10381042
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
1039-
github.com/onsi/gomega v1.29.0 h1:KIA/t2t5UBzoirT4H9tsML45GEbo3ouUnBHsCfD2tVg=
1040-
github.com/onsi/gomega v1.29.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
1043+
github.com/onsi/gomega v1.36.2 h1:koNYke6TVk6ZmnyHrCXba/T/MoLBXFjeC1PtvYgw0A8=
1044+
github.com/onsi/gomega v1.36.2/go.mod h1:DdwyADRjrc825LhMEkD76cHR5+pUnjhUN8GlHlRPHzY=
10411045
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
10421046
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
10431047
github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
@@ -1564,6 +1568,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
15641568
golang.org/x/tools v0.3.0/go.mod h1:/rWhSS2+zyEVwoJf8YAX6L2f0ntZ7Kn/mGgAWcipA5k=
15651569
golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
15661570
golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
1571+
golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
1572+
golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
15671573
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
15681574
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
15691575
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

0 commit comments

Comments
 (0)
Please sign in to comment.