feat: modernize CI (#415)

* fix: use 127.0.0.1 rather than localhost for OAuth2
* chore: modernize CI and upgrade dependencies

Author: alnr

.docker/Dockerfile-build

@@ -7,7 +7,6 @@ WORKDIR /go/src/github.com/ory/cli
 ADD ./go.mod go.mod
 ADD ./go.sum go.sum
 
-ENV GO111MODULE=on
 ENV CGO_ENABLED=1
 
 RUN go mod download

.github/workflows/ci.yaml

@@ -16,14 +16,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: ory/ci/checkout@master
-      - uses: actions/setup-go@v5
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
+          cache-dependency-path: go.mod
       - uses: actions/cache@v4
         with:
           path: |
             ~/.cache/ms-playwright
-          key: ${{ runner.os }}-playwright-${{ hashFiles('go.sum') }}
+          key: ${{ runner.os }}-playwright-${{ hashFiles('go.mod') }}
           restore-keys: ${{ runner.os }}-playwright-
       - run:
           go run github.com/playwright-community/playwright-go/cmd/playwright

.github/workflows/cve-scan.yaml

@@ -25,7 +25,7 @@ jobs:
           make docker
       - name: Scan image
         id: scan
-        uses: anchore/scan-action@v3
+        uses: anchore/scan-action@v7
         with:
           image: oryd/ory:latest-sqlite
           fail-build: false
@@ -34,12 +34,12 @@ jobs:
       - name: Inspect action SARIF report
         run: cat ${{ steps.scan.outputs.sarif }}
       - name: Upload SARIF report
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
       - name: Inspect scan result
         id: report
-        uses: anchore/scan-action@v3
+        uses: anchore/scan-action@v7
         with:
           image: oryd/ory:latest-sqlite
           output-format: table

.github/workflows/format.yml

@@ -9,9 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
+          cache-dependency-path: go.mod
       - run: make format
       - name: Indicate formatting issues
         run: git diff HEAD --exit-code --color

.github/workflows/test-e2e.yml

@@ -12,9 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
+          cache-dependency-path: go.mod
       - uses: actions/setup-node@v2
         with:
           node-version: "16"
@@ -51,9 +53,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
+          cache-dependency-path: go.mod
       - uses: actions/setup-node@v2
         with:
           node-version: "16"

Makefile

@@ -1,37 +1,18 @@
 SHELL=/bin/bash -o pipefail
 
-#  EXECUTABLES = docker-compose docker node npm go
-#  K := $(foreach exec,$(EXECUTABLES),\
-#          $(if $(shell which $(exec)),some string,$(error "No $(exec) in PATH")))
-
-export GO111MODULE := on
 export PATH := .bin:${PATH}
 export PWD := $(shell pwd)
 
-GOLANGCI_LINT_VERSION = 2.3.1
-
-GO_DEPENDENCIES = github.com/ory/go-acc \
-				  github.com/golang/mock/mockgen \
-				  github.com/go-swagger/go-swagger/cmd/swagger \
-				  golang.org/x/tools/cmd/goimports \
-				  github.com/mikefarah/yq \
-				  github.com/mattn/goveralls
-
-define make-go-dependency
-  # go install is responsible for not re-building when the code hasn't changed
-  .bin/$(notdir $1): go.mod go.sum Makefile
-		GOBIN=$(PWD)/.bin/ go install $1
-endef
-$(foreach dep, $(GO_DEPENDENCIES), $(eval $(call make-go-dependency, $(dep))))
+GOLANGCI_LINT_VERSION = 2.11.4
 
-.bin/clidoc: Makefile go.mod go.sum cmd
+.bin/clidoc: Makefile go.mod cmd
 	go build -tags nodev -o .bin/clidoc ./cmd/clidoc/.
 
 docs/cli: .bin/clidoc
 	curl -o docs/sidebar.json https://raw.githubusercontent.com/ory/docs/master/docs/sidebar.json
 	clidoc .
 
-.bin/cli: go.mod go.sum Makefile
+.bin/cli: go.mod Makefile
 	go build -o .bin/cli -tags sqlite github.com/ory/cli
 
 .bin/golangci-lint-$(GOLANGCI_LINT_VERSION):
@@ -47,17 +28,17 @@ lint: .bin/golangci-lint-$(GOLANGCI_LINT_VERSION)
 
 .PHONY: install
 install:
-	GO111MODULE=on go install -tags sqlite .
+	go install -tags sqlite .
 
 .PHONY: refresh
 refresh:
 	UPDATE_SNAPSHOTS=true go test -tags sqlite,json1,refresh ./...
 
 # Formats the code
 .PHONY: format
-format: .bin/cli .bin/goimports node_modules
+format: .bin/cli node_modules go.mod
 	.bin/cli dev headers copyright --type=open-source
-	goimports -w -local github.com/ory .
+	go tool goimports -w -local github.com/ory .
 	npm exec -- prettier --write "{**/,}*{.js,.md,.ts}"
 
 licenses: .bin/licenses node_modules  # checks open-source licenses

cmd/cloudx/client/auth.go

@@ -180,7 +180,7 @@ func (h *CommandHelper) oAuth2DanceWithServer(ctx context.Context, client *oauth
 		serverErr    = make(chan error)
 		serverToken  = make(chan *oauth2.Token)
 	)
-	l, err := net.Listen("tcp", "localhost:0")
+	l, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		return nil, fmt.Errorf("failed to allocate port for OAuth2 callback handler, try again later: %w", err)
 	}

cmd/cloudx/client/client.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/spf13/cobra"
 
-	hydra "github.com/ory/hydra-client-go/v2"
+	hydra "github.com/ory/hydra-client-go/v26"
 	hydracli "github.com/ory/hydra/v2/cmd/cliclient"
 	kratoscli "github.com/ory/kratos/cmd/cliclient"
 )

cmd/cloudx/client/command_helper.go

@@ -24,7 +24,6 @@ import (
 	"github.com/ory/x/cmdx"
 	"github.com/ory/x/flagx"
 	"github.com/ory/x/jsonx"
-	"github.com/ory/x/pointerx"
 )
 
 const (
@@ -100,7 +99,7 @@ func WithProjectOverride(project string) CommandHelperOption {
 
 func WithWorkspaceOverride(workspace string) CommandHelperOption {
 	return func(h *CommandHelper) {
-		h.workspaceOverride = pointerx.Ptr(workspace)
+		h.workspaceOverride = new(workspace)
 	}
 }
 
@@ -322,7 +321,7 @@ func (h *CommandHelper) WorkspaceID() *string {
 	if h.workspaceID == uuid.Nil {
 		return nil
 	}
-	return pointerx.Ptr(h.workspaceID.String())
+	return new(h.workspaceID.String())
 }
 
 func (h *CommandHelper) UserName(ctx context.Context) string {

cmd/cloudx/client/command_helper_setup_test.go

@@ -19,8 +19,6 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-
-	. "github.com/ory/x/pointerx"
 )
 
 func TestDetermineIDs(t *testing.T) {
@@ -63,7 +61,7 @@ func TestDetermineIDs(t *testing.T) {
 	setup := func(t *testing.T) (*CommandHelper, *Config) {
 		h := &CommandHelper{
 			configLocation:     t.TempDir() + "/config.json",
-			cloudConsoleAPIURL: Ptr(ts.URL),
+			cloudConsoleAPIURL: new(ts.URL),
 		}
 		cfg, err := h.getOrCreateConfig()
 		require.NoError(t, err)
@@ -107,15 +105,15 @@ func TestDetermineIDs(t *testing.T) {
 		t.Run("errors when workspace override is set", func(t *testing.T) {
 			h, cfg := setup(t)
 
-			h.workspaceAPIKey = Ptr("workspace-api-key")
-			h.workspaceOverride = Ptr("workspace-override")
+			h.workspaceAPIKey = new("workspace-api-key")
+			h.workspaceOverride = new("workspace-override")
 
 			assert.ErrorContains(t, h.determineWorkspaceID(ctx, cfg), "workspace API key is set but workspace flag is also set, please remove one")
 		})
 
 		h, cfg := setup(t)
 
-		h.workspaceAPIKey = Ptr("workspace-api-key")
+		h.workspaceAPIKey = new("workspace-api-key")
 
 		require.NoError(t, h.determineWorkspaceID(ctx, cfg))
 		assert.Equal(t, wsID, h.workspaceID)
@@ -126,23 +124,23 @@ func TestDetermineIDs(t *testing.T) {
 		t.Run("errors when project override is set", func(t *testing.T) {
 			h, cfg := setup(t)
 
-			h.projectAPIKey = Ptr("project-api-key")
-			h.projectOverride = Ptr("project-override")
+			h.projectAPIKey = new("project-api-key")
+			h.projectOverride = new("project-override")
 
 			assert.ErrorContains(t, h.determineProjectID(ctx, cfg), "project API key is set but project flag is also set, please remove one")
 		})
 		t.Run("errors when workspace is set", func(t *testing.T) {
 			h, cfg := setup(t)
 
-			h.projectAPIKey = Ptr("project-api-key")
+			h.projectAPIKey = new("project-api-key")
 			h.workspaceID = uuid.Must(uuid.NewV4())
 
 			assert.ErrorContains(t, h.determineProjectID(ctx, cfg), "project API key is set but workspace is also set, please remove one")
 		})
 
 		h, cfg := setup(t)
 
-		h.projectAPIKey = Ptr("project-api-key")
+		h.projectAPIKey = new("project-api-key")
 
 		require.NoError(t, h.determineProjectID(ctx, cfg))
 		assert.Equal(t, pjID, h.projectID)
@@ -177,7 +175,7 @@ func TestDetermineIDs(t *testing.T) {
 		} {
 			t.Run(tc.name, func(t *testing.T) {
 				for _, setValue := range []func(*CommandHelper){
-					func(h *CommandHelper) { h.workspaceOverride = Ptr(tc.value) },
+					func(h *CommandHelper) { h.workspaceOverride = new(tc.value) },
 					func(*CommandHelper) { t.Setenv(WorkspaceKey, tc.value) },
 				} {
 					h, cfg := setup(t)
@@ -224,7 +222,7 @@ func TestDetermineIDs(t *testing.T) {
 		} {
 			t.Run(tc.name, func(t *testing.T) {
 				for _, setValue := range []func(*CommandHelper){
-					func(h *CommandHelper) { h.projectOverride = Ptr(tc.value) },
+					func(h *CommandHelper) { h.projectOverride = new(tc.value) },
 					func(*CommandHelper) { t.Setenv(ProjectKey, tc.value) },
 				} {
 					h, cfg := setup(t)