ci: build and test using 1.18 and 1.19 (drop 1.17) (#812)

* ci: build and test using 1.18 and 1.19 (drop 1.17)

* remove pre-1.18 compat code, update README

* go install goimports before checkout

* update chainguard-dev/actions to versions that go install

.github/workflows/build.yaml

@@ -10,7 +10,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version: ['1.17', '1.18']
+        go-version: ['1.18', '1.19']
     name: Build ${{ matrix.go-version }}
     runs-on: ubuntu-latest
 

.github/workflows/e2e.yaml

@@ -19,7 +19,7 @@ jobs:
     - uses: actions/checkout@v3
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17
+        go-version: 1.18
         check-latest: true
 
     - name: Build and run ko container

.github/workflows/image.yaml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: sigstore/cosign-installer@v2.5.1
 

.github/workflows/kind-e2e.yaml

@@ -20,7 +20,7 @@ jobs:
     steps:
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17
+        go-version: 1.18
         check-latest: true
 
     - uses: actions/checkout@v3

.github/workflows/modules-integration-test.yaml

@@ -9,7 +9,7 @@ jobs:
     name: Module Tests
     strategy:
       matrix:
-        go-version: [1.17, 1.18]
+        go-version: [1.18, 1.19]
 
     runs-on: 'ubuntu-latest'
     steps:

.github/workflows/sbom.yaml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
       - uses: actions/checkout@v3
@@ -39,7 +39,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
       - uses: actions/checkout@v3
@@ -71,7 +71,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
       - uses: actions/checkout@v3
@@ -104,7 +104,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: chainguard-dev/actions/setup-registry@main
       - uses: actions/checkout@v3

.github/workflows/style.yaml

@@ -12,10 +12,10 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: actions/checkout@v3
-      - uses: chainguard-dev/actions/gofmt@84c993eaf02da1c325854fb272a4df9184bd80fc # main
+      - uses: chainguard-dev/actions/gofmt@d886686603afb809f7ef9b734b333e20b7ce5cda
         with:
           args: -s
 
@@ -25,10 +25,10 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
       - uses: actions/checkout@v3
-      - uses: chainguard-dev/actions/goimports@84c993eaf02da1c325854fb272a4df9184bd80fc # main
+      - uses: chainguard-dev/actions/goimports@d886686603afb809f7ef9b734b333e20b7ce5cda
 
   lint:
     name: Lint
@@ -38,16 +38,16 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
 
       - name: Check out code
         uses: actions/checkout@v3
 
-      - uses: chainguard-dev/actions/trailing-space@84c993eaf02da1c325854fb272a4df9184bd80fc # main
+      - uses: chainguard-dev/actions/trailing-space@d886686603afb809f7ef9b734b333e20b7ce5cda
         if: ${{ always() }}
 
-      - uses: chainguard-dev/actions/eof-newline@84c993eaf02da1c325854fb272a4df9184bd80fc # main
+      - uses: chainguard-dev/actions/eof-newline@d886686603afb809f7ef9b734b333e20b7ce5cda
         if: ${{ always() }}
 
       - uses: reviewdog/action-misspell@v1

.github/workflows/test.yaml

@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.17
+          go-version: 1.18
           check-latest: true
 
       - run: go test -coverprofile=coverage.txt -covermode=atomic -race ./...

.github/workflows/verify.yaml

@@ -11,7 +11,7 @@ jobs:
     steps:
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17
+        go-version: 1.18
         check-latest: true
     - uses: actions/checkout@v3
     - name: Verify

README.md

@@ -67,7 +67,7 @@ apk add ko
 
 ### Build and Install from Source
 
-With Go 1.16+, build and install the latest released version:
+With Go 1.18+, build and install the latest released version:
 
 ```
 go install github.com/google/ko@latest

internal/sbom/cyclonedx.go

@@ -19,6 +19,7 @@ import (
 	"encoding/base64"
 	"encoding/hex"
 	"encoding/json"
+	"runtime/debug"
 	"strings"
 
 	"github.com/sigstore/cosign/pkg/oci"
@@ -42,7 +43,7 @@ func GenerateImageCycloneDX(mod []byte) ([]byte, error) {
 		return nil, err
 	}
 
-	bi, err := ParseBuildInfo(string(mod))
+	bi, err := debug.ParseBuildInfo(string(mod))
 	if err != nil {
 		return nil, err
 	}