Skip to content

Fix/dependabot bumps #751

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
raharper wants to merge 10 commits into
base: main
Choose a base branch
from
Draft

Fix/dependabot bumps #751

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
15eeb87
fix: Drop stacker-bom to fix CVEs
raharper Dec 21, 2025
a8ac973
fix: Makefile download and install specific version of golangci-lint
raharper Jan 5, 2026
8186ac3
fix: drop referrer{_test}.go onlyused for uploading sbom artifacts
raharper Jan 5, 2026
8c10431
fix: bump docker/docker to v25.0.6 and c/image/v5 to v5.34.3, no crits
raharper Dec 22, 2025
8311716
Don't ever touch Layer struct, it makes Cache mad
raharper Jan 5, 2026
a63a6ab
fold: fix don't use storage v1.59.0
raharper Jan 5, 2026
8133c91
fix: bump fulcio to v1.8.3
raharper Jan 5, 2026
a6c2c54
fix: bump incus to incus/v6 v6.20.0
raharper Jan 6, 2026
9ec4c12
fix: bump go versions to 1.25.x as newer stacker go modules require
raharper Jan 6, 2026
c20d613
fix: drop mtree and compress bumps which break gzip buff size
raharper Jan 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:
type: string
description: 'Stringified JSON object listing go versions'
default: >-
["1.24.x"]
["1.25.x"]
privilege-level:
required: false
type: string
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/cloc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
- name: Install go
uses: actions/setup-go@v5
with:
go-version: 1.24.x
go-version: 1.25.x
- name: Check out source code
uses: actions/checkout@v4
- name: Install dependencies
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/codeql-analysis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
- name: Install go
uses: actions/setup-go@v5
with:
go-version: 1.24.x
go-version: 1.25.x

# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/coverage.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ on:
type: string
description: 'Stringified JSON object listing go versions'
default: >-
["1.24.x"]
["1.25.x"]
privilege-level:
required: false
type: string
Expand Down
14 changes: 8 additions & 6 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,9 @@ UMOCI_VERSION := main

export PATH := $(TOOLS_D)/bin:$(PATH)

GOLANGCI_LINT_VERSION = v1.64.8
GOLANGCI_LINT = $(TOOLS_D)/golangci-lint/$(GOLANGCI_LINT_VERSION)/golangci-lint
GOLANGCI_LINT_VERSION = 2.7.2
GOLANGCI_LINT_URL = https://github.com/golangci/golangci-lint/releases/download
GOLANGCI_LINT = $(TOOLS_D)/bin/golangci-lint

STAGE1_STACKER ?= ./stacker-dynamic
STACKER_PUBLISH_BIN := stacker-$(GOOS)-$(GOARCH)
Expand Down Expand Up @@ -138,10 +139,11 @@ go-test:
download-tools: $(GOLANGCI_LINT) $(REGCLIENT) $(ZOT) $(BATS) $(UMOCI) $(SKOPEO)

$(GOLANGCI_LINT):
@mkdir -p $(dir $@)
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b "$(dir $@)"
@mkdir -p "$(TOOLS_D)/bin"
ln -sf "$@" "$(TOOLS_D)/bin/"
@[ -x $(GOLANGCI_LINT) ] || \
echo "Installing golangci-lint $(GOLANGCI_LINT_VERSION) ..." && \
curl -sSfL $(GOLANGCI_LINT_URL)/v$(GOLANGCI_LINT_VERSION)/golangci-lint-$(GOLANGCI_LINT_VERSION)-linux-$(GOARCH).tar.gz | \
tar -C $(TOOLS_D)/bin -xzf - --strip-components=1 golangci-lint-$(GOLANGCI_LINT_VERSION)-linux-$(GOARCH)/golangci-lint
@$(GOLANGCI_LINT) version

# dlbin is used with $(call dlbin,path,url)
# it downloads a url to path and makes it executable.
Expand Down
117 changes: 0 additions & 117 deletions cmd/stacker/bom.go
View file
Open in desktop

This file was deleted.

3 changes: 1 addition & 2 deletions cmd/stacker/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ func shouldSkipInternalUserns(ctx *cli.Context) bool {
return false
}

if arg0 == "bom" || arg0 == "unpriv-setup" || arg0 == "internal-go" {
if arg0 == "unpriv-setup" || arg0 == "internal-go" {
return true
}

Expand Down Expand Up @@ -131,7 +131,6 @@ func main() {

app.Commands = []*cli.Command{
&buildCmd,
&bomCmd,
&recursiveBuildCmd,
&convertCmd,
&publishCmd,
Expand Down
Loading
Loading