When running govulncheck, if we use go.mod's version, that is the oldest
Go version that we expect to build chasquid.
However, that specific version is often 1.x.0 and can include
vulnerabilities that are fixed in later patch releases. This can cause
govulncheck to complain, which introduces noise in the CI.
Instead, we should run govulncheck on the latest Go version, to make
sure that any reports are about our code or the dependencies, and not
the toolchain.
That behaviour is in place today, but it's not obvious from the config.
This patch updates the config to note this more explicitly, to prevent
future confusion.
This patch updates the version of the github actions we use in our CI
workflows.
While they still run correctly, they're showing some warnings about
being too out of date in the UI.
Today, we only require that Docker integration tests use a Go version
>= 1.20. In practice, it almost always picks the latest version.
For consistency, this patch requests it to run the latest Go version.
Today, the step to build the Docker public image depends on the coverage
run. This dependency isn't necessary, as the coverage could be failing
for a variety of reasons (e.g. codecov being down) and doesn't signal
any problem with chasquid itself.
So this patch fixes that: if the integration tests pass, then that is
good enough for building the public image.
The `latest` tag is meant to track the `main` branch, but I just noticed
it hasn't been pushed out in a while. This is because the conditional
gating the push on the branch being `main` is incorrect.
This patch fixes the problem by using the correct conditional on the
branch name.
Nearly all the github actions we rely on have increased their major
version, at least to update the Node.js version they run on, since the
previous one is being deprecated and will eventually become unsupported.
So this patch updates all the versions of the github actions we use.
Since we moved the Docker workflows to Github (after v1.10), they have
not been running on tags, so there are no tagged docker images for
v1.11, v1.12 and v1.13.
This is (hopefully) because we're not explicitly asking for the workflow
to be run on tag pushes.
This patch (hopefully) fixes that by adding an explicit section in the
config to make it run on tag pushes.
Thanks to Christoph Mewes (xrstf@github) for reporting this in
https://github.com/albertito/chasquid/issues/51.
We're running against the usage limits in Gitlab CI (500), and Github
Actions should have more (2000).
So this patch replaces Gitlab CI with Github actions for running
integration tests, and build and push Docker images (to Dockerhub and
Gitlab registry).
We'll see how the usage levels are in a few months.
govulncheck will complain when run on older Go versions that are known
to have security issues. Github setup-go action has a cache for the
"latest" go version and sometimes the latest isn't really used.
So sometimes, this generates false positives because govulncheck is run
on an older Go version, which is not a problem in chasquid itself.
To prevent those false positives, this patch asks the Github CI to
always check for the latest Go version when running govulncheck.
Alberto Bertogli