sylr · sylr · Jul 6, 2024 · Jul 6, 2024 · Jul 6, 2024 · Jul 6, 2024
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -8,32 +8,41 @@ jobs:
   # build job
   build:
     name: Build
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: read
     strategy:
       fail-fast: false
       matrix:
-        go: ["1.21"]
+        go: ["1.22"]
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        filter: tree:0
+
+    - uses: actions/cache@v4
+      with:
+        path: |
+          /tmp/.buildx-cache
+        key: ${{ runner.os }}-docker-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          ${{ runner.os }}-docker-${{ hashFiles('**/go.sum') }}
+          ${{ runner.os }}-docker-
 
     - name: Setup docker QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@v3
 
     - name: Setup docker buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v3
       with:
         driver-opts: |
           image=moby/buildkit:master
           network=host
 
     - name: Login to GitHub Container Registry
-      uses: docker/login-action@v2
+      uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}

diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
@@ -8,16 +8,20 @@ jobs:
   build:
     name: Build
     runs-on: ubuntu-22.04
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
     strategy:
       matrix:
-        go: ["1.21"]
+        go: ["1.22"]
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        filter: tree:0
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         path: |
           ~/.cache/go-build
@@ -29,16 +33,17 @@ jobs:
           ${{ runner.os }}-go-
 
     - name: Set up Go ${{ matrix.go }}
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
         go-version: ${{ matrix.go }}
+        cache: false
       id: go
 
     - name: Verify go mod
       run: make go-mod-verify
 
     - name: Lint
-      uses: golangci/golangci-lint-action@v3
+      uses: golangci/golangci-lint-action@v6
       with:
         args: --timeout=10m
         skip-cache: true
@@ -48,3 +53,20 @@ jobs:
 
     - name: Crossbuild
       run: make crossbuild
+
+    - uses: actions/attest-build-provenance@v1
+      with:
+        subject-path: |
+          dist/*
+
+    - uses: actions/upload-artifact@v4
+      with:
+        name: build
+        retention-days: 3
+        path: |
+          dist/*-darwin-amd64*
+          dist/*-darwin-arm64*
+          dist/*-linux-amd64*
+          dist/*-linux-arm64*
+          dist/*-windows-amd64*
+          dist/*-windows-arm64*
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -12,12 +12,12 @@ jobs:
       contents: write
       packages: write
     steps:
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+    - uses: actions/checkout@v4
       with:
         fetch-depth: 0
+        filter: tree:0
 
-    - uses: actions/cache@v3
+    - uses: actions/cache@v4
       with:
         path: |
           ~/.cache/go-build
@@ -29,16 +29,17 @@ jobs:
           ${{ runner.os }}-go-
 
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
-        go-version: "1.21"
+        go-version: "1.22"
+        cache: false
       id: go
 
     - name: Setup docker QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@v3
 
     - name: Setup docker buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v3
       with:
         driver-opts: |
           image=moby/buildkit:master

diff --git a/Dockerfile b/Dockerfile
@@ -1,31 +1,38 @@
 # vi: ft=Dockerfile:
 
-ARG GO_VERSION=1.20
+ARG GO_VERSION=1.22
 
 FROM --platform=$BUILDPLATFORM golang:$GO_VERSION AS builder
 
-RUN apt-get update && apt-get dist-upgrade -y && apt-get install -y build-essential git
+RUN --mount=type=cache,target=/var/cache/apt \
+    apt-get update && apt-get dist-upgrade -y && apt-get install -y build-essential git
 
 WORKDIR $GOPATH/src/sylr.dev/yage
 
-COPY go.mod go.sum ./
-
-RUN go mod download
-
-COPY . .
+RUN --mount=type=cache,target=/go/pkg/mod/ \
+    --mount=type=bind,source=go.sum,target=go.sum \
+    --mount=type=bind,source=go.mod,target=go.mod \
+    go mod download
 
 ARG TARGETPLATFORM
 ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
 
 # Switch shell to bash
-SHELL ["bash", "-c"]
-
-# Run a git command otherwise git describe in the Makefile could report a dirty git dir
-RUN git diff --exit-code || true
-
-RUN make build GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT/v/} GO_BUILD_TARGET=dist/${TARGETPLATFORM}/yage
+SHELL ["bash", "-c"] 
+
+RUN --mount=type=cache,target=/go/pkg/mod/ \
+    --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=bind,target=. \
+    git diff --exit-code || true; \
+    make build \
+        GOOS=${TARGETOS} \
+        GOARCH=${TARGETARCH} \
+        GOARM=${TARGETVARIANT/v/} \
+        GO_BUILD_TARGET=/tmp/dist/${TARGETPLATFORM}/yage \
+        GO_BUILD_DIR=/tmp/dist/${TARGETPLATFORM} \
+        GO_BUILD_FLAGS_TARGET=/tmp/.go-build-flags 
 
 # -----------------------------------------------------------------------------
 
@@ -35,6 +42,6 @@ ARG TARGETPLATFORM
 
 WORKDIR /usr/local/bin
 
-COPY --from=builder "/go/src/sylr.dev/yage/dist/$TARGETPLATFORM/yage" .
+COPY --from=builder "/tmp/dist/$TARGETPLATFORM/yage" .
 
 CMD ["/usr/local/bin/yage"]
diff --git a/Makefile b/Makefile
@@ -1,5 +1,5 @@
 GO                ?= $(shell which go)
-GIT_UPDATE_INDEX  := $(shell git update-index --refresh)
+GIT_UPDATE_INDEX  ?= $(shell git update-index --refresh)
 GIT_REVISION      ?= $(shell git rev-parse HEAD)
 GIT_VERSION       ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
 
@@ -15,17 +15,18 @@ GO_BUILD_TAGS            := static
 GO_BUILD_TARGET_DEPS     :=
 GO_BUILD_FLAGS           := -trimpath
 GO_BUILD_LDFLAGS_OPTIMS  :=
+GO_BUILD_DIR             ?= dist
 
 ifeq ($(GOOS)/$(GOARCH),$(GOENV_GOOS)/$(GOENV_GOARCH))
-GO_BUILD_TARGET          ?= dist/yage
-GO_BUILD_VERSION_TARGET  ?= dist/yage-$(GIT_VERSION)
+GO_BUILD_TARGET          ?= $(GO_BUILD_DIR)/yage
+GO_BUILD_VERSION_TARGET  ?= $(GO_BUILD_DIR)/yage-$(GIT_VERSION)
 else
 ifeq ($(GOARCH),arm)
-GO_BUILD_TARGET          ?= dist/yage-$(GOOS)-$(GOARCH)v$(GOARM)
-GO_BUILD_VERSION_TARGET  := dist/yage-$(GIT_VERSION)-$(GOOS)-$(GOARCH)v$(GOARM)
+GO_BUILD_TARGET          ?= $(GO_BUILD_DIR)/yage-$(GOOS)-$(GOARCH)v$(GOARM)
+GO_BUILD_VERSION_TARGET  := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-$(GOOS)-$(GOARCH)v$(GOARM)
 else
-GO_BUILD_TARGET          ?= dist/yage-$(GOOS)-$(GOARCH)
-GO_BUILD_VERSION_TARGET  := dist/yage-$(GIT_VERSION)-$(GOOS)-$(GOARCH)
+GO_BUILD_TARGET          ?= $(GO_BUILD_DIR)/yage-$(GOOS)-$(GOARCH)
+GO_BUILD_VERSION_TARGET  := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-$(GOOS)-$(GOARCH)
 endif # ($(GOARCH),arm)
 endif # ($(GOOS)/$(GOARCH),$(GOENV_GOOS)/$(GOENV_GOARCH))
 
@@ -35,7 +36,7 @@ else
 GO_BUILD_LDFLAGS_OPTIMS  += -s -w
 endif # $(DEBUG)
 
-GO_BUILD_FLAGS_TARGET           := .go-build-flags
+GO_BUILD_FLAGS_TARGET           ?= .go-build-flags
 GO_CROSSBUILD_WINDOWS_PLATFORMS := windows/386 windows/amd64 windows/arm windows/arm64
 GO_CROSSBUILD_PLATFORMS         ?= linux/386 linux/amd64 linux/arm linux/arm64 linux/arm/v7 linux/arm/v6 \
                                    linux/mips linux/mips/softfloat linux/mips64 linux/mips64le linux/mipsle \
@@ -62,19 +63,19 @@ GO_CROSSBUILD_RISCV64_PLATFORMS       := $(filter %/riscv64,$(GO_CROSSBUILD_PLAT
 GO_CROSSBUILD_S390X_PLATFORMS         := $(filter %/s390x,$(GO_CROSSBUILD_PLATFORMS))
 GO_CROSSBUILD_WINDOWS_PLATFORMS       := $(filter windows/%,$(GO_CROSSBUILD_WINDOWS_PLATFORMS))
 
-GO_CROSSBUILD_386_TARGET_PATTERN      := dist/yage-$(GIT_VERSION)-%-386
-GO_CROSSBUILD_AMD64_TARGET_PATTERN    := dist/yage-$(GIT_VERSION)-%-amd64
-GO_CROSSBUILD_ARM_TARGET_PATTERN      := dist/yage-$(GIT_VERSION)-%-arm
-GO_CROSSBUILD_ARM64_TARGET_PATTERN    := dist/yage-$(GIT_VERSION)-%-arm64
-GO_CROSSBUILD_ARMV6_TARGET_PATTERN    := dist/yage-$(GIT_VERSION)-%-armv6
-GO_CROSSBUILD_ARMV7_TARGET_PATTERN    := dist/yage-$(GIT_VERSION)-%-armv7
-GO_CROSSBUILD_MIPS_TARGET_PATTERN     := dist/yage-$(GIT_VERSION)-%-mips
-GO_CROSSBUILD_MIPSLE_TARGET_PATTERN   := dist/yage-$(GIT_VERSION)-%-mipsle
-GO_CROSSBUILD_MIPS64_TARGET_PATTERN   := dist/yage-$(GIT_VERSION)-%-mips64
-GO_CROSSBUILD_MIPS64LE_TARGET_PATTERN := dist/yage-$(GIT_VERSION)-%-mips64le
-GO_CROSSBUILD_RISCV64_TARGET_PATTERN  := dist/yage-$(GIT_VERSION)-%-riscv64
-GO_CROSSBUILD_S390X_TARGET_PATTERN    := dist/yage-$(GIT_VERSION)-%-s390x
-GO_CROSSBUILD_WINDOWS_TARGET_PATTERN  := dist/yage-$(GIT_VERSION)-windows-%.exe
+GO_CROSSBUILD_386_TARGET_PATTERN      := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-386
+GO_CROSSBUILD_AMD64_TARGET_PATTERN    := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-amd64
+GO_CROSSBUILD_ARM_TARGET_PATTERN      := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-arm
+GO_CROSSBUILD_ARM64_TARGET_PATTERN    := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-arm64
+GO_CROSSBUILD_ARMV6_TARGET_PATTERN    := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-armv6
+GO_CROSSBUILD_ARMV7_TARGET_PATTERN    := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-armv7
+GO_CROSSBUILD_MIPS_TARGET_PATTERN     := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-mips
+GO_CROSSBUILD_MIPSLE_TARGET_PATTERN   := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-mipsle
+GO_CROSSBUILD_MIPS64_TARGET_PATTERN   := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-mips64
+GO_CROSSBUILD_MIPS64LE_TARGET_PATTERN := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-mips64le
+GO_CROSSBUILD_RISCV64_TARGET_PATTERN  := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-riscv64
+GO_CROSSBUILD_S390X_TARGET_PATTERN    := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-%-s390x
+GO_CROSSBUILD_WINDOWS_TARGET_PATTERN  := $(GO_BUILD_DIR)/yage-$(GIT_VERSION)-windows-%.exe
 
 GO_CROSSBUILD_TARGETS := $(patsubst %/386,$(GO_CROSSBUILD_386_TARGET_PATTERN),$(GO_CROSSBUILD_386_PLATFORMS))
 GO_CROSSBUILD_TARGETS += $(patsubst %/amd64,$(GO_CROSSBUILD_AMD64_TARGET_PATTERN),$(GO_CROSSBUILD_AMD64_PLATFORMS))
@@ -102,7 +103,7 @@ GO_TOOLS_GOLANGCI_LINT ?= $(shell $(GO) env GOPATH)/bin/golangci-lint
 
 DOCKER_BUILD_IMAGE      ?= ghcr.io/sylr/yage
 DOCKER_BUILD_VERSION    ?= $(GIT_VERSION)
-DOCKER_BUILD_GO_VERSION ?= 1.20
+DOCKER_BUILD_GO_VERSION ?= 1.22
 DOCKER_BUILD_LABELS      = --label org.opencontainers.image.title=yage
 DOCKER_BUILD_LABELS     += --label org.opencontainers.image.description="age+yaml"
 DOCKER_BUILD_LABELS     += --label org.opencontainers.image.url="https://github.com/sylr/yage"
@@ -112,7 +113,17 @@ DOCKER_BUILD_LABELS     += --label org.opencontainers.image.version=$(GIT_VERSIO
 DOCKER_BUILD_LABELS     += --label org.opencontainers.image.created=$(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
 DOCKER_BUILD_BUILD_ARGS ?= --build-arg=GO_VERSION=$(DOCKER_BUILD_GO_VERSION)
 DOCKER_BUILDX_PLATFORMS ?= linux/amd64,linux/arm64,linux/arm/v7,linux/arm/v6
-DOCKER_BUILDX_CACHE     ?= /tmp/.buildx-cache
+
+ifeq ($(CI),true)
+DOCKER_BUILDX_CACHE_DIR ?= /tmp/.buildx-cache
+DOCKER_BUILD_BUILD_ARGS += --cache-to=type=local,dest=$(DOCKER_BUILDX_CACHE_DIR)
+DOCKER_BUILD_BUILD_ARGS += --cache-from=type=local,src=$(DOCKER_BUILDX_CACHE_DIR)
+DOCKER_BUILD_BUILD_ARGS += --progress=plain
+else
+DOCKER_BUILDX_CACHE_DIR ?= /tmp/.buildx-cache
+DOCKER_BUILD_BUILD_ARGS += --cache-to=type=local,dest=$(DOCKER_BUILDX_CACHE_DIR)
+DOCKER_BUILD_BUILD_ARGS += --cache-from=type=local,src=$(DOCKER_BUILDX_CACHE_DIR)
+endif
 
 # ------------------------------------------------------------------------------
 
@@ -194,9 +205,9 @@ $(GO_CROSSBUILD_RISCV64_TARGET_PATTERN): $(GO_BUILD_SRC) $(GO_BUILD_FLAGS_TARGET
 $(GO_CROSSBUILD_S390X_TARGET_PATTERN): $(GO_BUILD_SRC) $(GO_BUILD_FLAGS_TARGET)
 	CGO_ENABLED=0 GOOS=$* GOARCH=s390x $(GO) build -tags $(GO_BUILD_TAGS),crossbuild $(GO_BUILD_FLAGS) $(GO_BUILD_LDFLAGS) -o $@
 
-crossbuild-checksums: dist/checksums
+crossbuild-checksums: $(GO_BUILD_DIR)/checksums
 
-dist/checksums : $(GO_CROSSBUILD_TARGETS)
+$(GO_BUILD_DIR)/checksums : $(GO_CROSSBUILD_TARGETS)
 	cd dist && shasum -a 256 yage-*-* > checksums
 
 # -- go mod --------------------------------------------------------------------
@@ -235,15 +246,13 @@ $(GO_TOOLS_GOLANGCI_LINT):
 docker-buildx-build:
 	@docker buildx build . -f Dockerfile \
 		-t $(DOCKER_BUILD_IMAGE):$(DOCKER_BUILD_VERSION) \
-		--cache-to=type=local,dest=$(DOCKER_BUILDX_CACHE) \
 		--platform=$(DOCKER_BUILDX_PLATFORMS) \
 		$(DOCKER_BUILD_BUILD_ARGS) \
 		$(DOCKER_BUILD_LABELS)
 
 docker-buildx-push:
 	@docker buildx build . -f Dockerfile \
 		-t $(DOCKER_BUILD_IMAGE):$(DOCKER_BUILD_VERSION) \
-		--cache-from=type=local,src=$(DOCKER_BUILDX_CACHE) \
 		--platform=$(DOCKER_BUILDX_PLATFORMS) \
 		$(DOCKER_BUILD_BUILD_ARGS) \
 		$(DOCKER_BUILD_LABELS) \

diff --git a/go.mod b/go.mod
@@ -1,12 +1,12 @@
 module sylr.dev/yage/v2
 
-go 1.20
+go 1.22
 
 require (
-	filippo.io/age v1.1.1
-	github.com/spf13/cobra v1.8.0
-	golang.org/x/crypto v0.18.0
-	golang.org/x/term v0.16.0
+	filippo.io/age v1.2.0
+	github.com/spf13/cobra v1.8.1
+	golang.org/x/crypto v0.25.0
+	golang.org/x/term v0.22.0
 	sylr.dev/yaml/age/v3 v3.0.0-20221203153010-eb6b46db8d90
 	sylr.dev/yaml/v3 v3.0.0-20220527135632-500fddf2b049
 )
@@ -15,5 +15,5 @@ require (
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	golang.org/x/sys v0.16.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
 )