Upgrade to go1.22 and add goreleaser job checker

.github/workflows/check-goreleaser.yaml

@@ -0,0 +1,39 @@
+# Copyright 2024 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+name: check-goreleaser
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  check-goreleaser:
+    runs-on: ubuntu-latest
+
+    container:
+      image: ghcr.io/gythialy/golang-cross:v1.22.2-0@sha256:642fda874607057c34dfbb2d7fce93dfa37bdb9dbc0cc74835d9c3157a7a0e89
+
+    steps:
+      - uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+
+      # - name: install libyara-dev
+      #   run: |
+      #     sudo add-apt-repository -n -y "deb http://archive.ubuntu.com/ubuntu/ mantic main restricted universe multiverse"
+      #     sudo add-apt-repository -n -y "deb http://archive.ubuntu.com/ubuntu/ mantic-updates main restricted universe multiverse"
+      #     sudo add-apt-repository -n -y "deb http://archive.ubuntu.com/ubuntu/ mantic-backports main restricted universe multiverse"
+      #     sudo add-apt-repository -n -y "deb http://security.ubuntu.com/ubuntu mantic-security main restricted universe multiverse"
+
+          # sudo apt update && sudo apt install libyara-dev -y
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean --skip=sign --snapshot
+
+      - name: check binaries
+        run: |
+          ./dist/bincapz_linux_amd64_v1/bincapz -h

.github/workflows/go-tests.yaml

@@ -25,7 +25,7 @@ jobs:
 
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           check-latest: true
 
       - name: Checkout code

.github/workflows/release.yaml

@@ -7,6 +7,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   goreleaser:
@@ -16,10 +17,15 @@ jobs:
         uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
         with:
           fetch-depth: 0
+
+      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
+
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-            go-version-file: go.mod
+          go-version: '1.22'
+          check-latest: true
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:

.github/workflows/style.yaml

@@ -23,7 +23,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           check-latest: true
 
       - uses: chainguard-dev/actions/gofmt@main
@@ -40,7 +40,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           check-latest: true
 
       - uses: chainguard-dev/actions/goimports@main
@@ -55,7 +55,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           check-latest: true
 
       - name: install libyara-dev
@@ -84,7 +84,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: '1.21'
+          go-version: '1.22'
           check-latest: true
 
       - uses: reviewdog/action-misspell@5bd7be2fc7ae56a517184f5c4bbcf2fd7afe3927 # v1.17.0

.gitignore

@@ -20,3 +20,4 @@ out/
 
 # macOS
 *.DS_Store
+dist/

.goreleaser.yaml

@@ -5,18 +5,54 @@ before:
     - go mod tidy
 
 builds:
-  - id: bincapz-build
-    binary: bincapz
+  # - id: bincapz
+  #   binary: bincapz
+  #   main: ./
+  #   goos:
+  #     - darwin
+  #     # - linux
+  #     # - windows
+  #   goarch:
+  #     # - amd64
+  #     - arm64
+  #     # - arm
+  #   flags:
+  #     - -trimpath
+  #   mod_timestamp: '{{ .CommitTimestamp }}'
+  #   ldflags:
+  #     - -X main.BuildVersion={{.Version}}
+  #   env:
+  #     - CGO_ENABLED=1
+
+  - id: darwin-amd64
+    binary: bincapz-darwin-amd64
+    no_unique_dist_dir: true
+    env:
+      - CC=o64-clang
+      - CXX=o64-clang++
+      - CGO_ENABLED=1
     main: ./
-    goos:
-      - darwin
-      - linux
-      - windows
     flags:
       - -trimpath
     mod_timestamp: '{{ .CommitTimestamp }}'
-    ldflags:
-      - -X main.BuildVersion={{.Version}}
+    goos:
+      - darwin
+    goarch:
+      - amd64
+
+signs:
+  - id: bincapz
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
+    cmd: cosign
+    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
+    artifacts: binary
+  - id: checksum
+    signature: "${artifact}.sig"
+    certificate: "${artifact}.pem"
+    cmd: cosign
+    args: ["sign-blob", "--output-signature", "${artifact}.sig", "--output-certificate", "${artifact}.pem", "${artifact}"]
+    artifacts: checksum
 
 checksum:
   name_template: 'checksums.txt'

go.mod

@@ -1,10 +1,11 @@
 module github.com/chainguard-dev/bincapz
 
-go 1.21.6
+go 1.22
 
 require (
 	github.com/agext/levenshtein v1.2.3
 	github.com/chainguard-dev/clog v1.3.1
+	github.com/fatih/color v1.16.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/go-containerregistry v0.19.1
 	github.com/hillu/go-yara/v4 v4.3.2
@@ -21,7 +22,6 @@ require (
 	github.com/docker/distribution v2.8.2+incompatible // indirect
 	github.com/docker/docker v24.0.9+incompatible // indirect
 	github.com/docker/docker-credential-helpers v0.7.0 // indirect
-	github.com/fatih/color v1.16.0 // indirect
 	github.com/klauspost/compress v1.16.5 // indirect
 	github.com/kr/pretty v0.2.1 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect