chore: Image build improvements and dependency updates (#625)

* use different runners for different architectures

* upload to ghcr

* require tests

* update dependencies

* fix some build issues

* use any alias

* update golang ci lint

* fix golang ci lint config

* fix build issues

* bump lint image

* golang ci lint --fix

* fix other issues

* bump go version

* fix lint issues

* fix lint issues

* pre-allocate versions slice

* pre-allocate versions slice

* fix test

Author: maciaszczykm

.github/workflows/ci.yaml

@@ -6,48 +6,79 @@ on:
   pull_request:
     branches:
       - main
+env:
+  GOPATH: /home/runner/go/
+  GOPROXY: "https://proxy.golang.org"
+  REGISTRY_IMAGE: ghcr.io/pluralsh/plural-cli
 jobs:
-  contract-validation:
-    name: Validate PR Contracts
+
+  test:
+    name: Unit test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-        name: checkout repo
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+      - run: make test
 
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v7
+        with:
+          version: v2.1.5
+          skip-cache: true
 
+  contract-validation:
+    name: Validate PR Contracts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
       - run: make install-cli
-
       - name: Run Plural PR Contracts Validation
-        run: |
-          plural pr contracts --file test/contracts.yaml --validate || { echo "❌ Contract validation failed! Blocking merge."; exit 1; }
+        run: plural pr contracts --file test/contracts.yaml --validate
 
-  image:
+  build-image:
     name: Build image
-    runs-on: ubuntu-latest
+    needs: [test]
     permissions:
       contents: 'read'
       id-token: 'write'
       packages: 'write'
       security-events: write
       actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        platforms:
+          - platform: linux/amd64
+            runner: ubuntu-24.04
+          - platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.platforms.runner }}
+
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+      - name: Prepare
+        run: |
+          platform=${{ matrix.platforms.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
-          # list of Docker images to use as base name for tags
-          images: |
-            ghcr.io/pluralsh/plural-cli
-          # generate Docker tags based on the following events/attributes
-          tags: |
-            type=sha
-            type=ref,event=pr
-            type=ref,event=branch
+          images: ${{ env.REGISTRY_IMAGE }}
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
@@ -61,20 +92,68 @@ jobs:
       - name: Get current date
         id: date
         run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%S%z')" >> $GITHUB_OUTPUT
-      - uses: docker/build-push-action@v6
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v6
         with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          context: "."
+          file: "./Dockerfile"
+          tags: ${{ env.REGISTRY_IMAGE }}
           labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
-          # cache-from: type=gha
-          # cache-to: type=gha,mode=max
+          platforms: ${{ matrix.platforms.platform }}
+          outputs: type=image,push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
           build-args: |
             APP_VSN=dev
             APP_COMMIT=${{ github.sha }}
             APP_DATE=${{ steps.date.outputs.date }}
+      - name: Export digest
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  publish-image:
+    name: Publish image
+    needs: [build-image]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/pluralsh/plural-cli
+          tags: |
+            type=sha
+            type=ref,event=pr
+            type=ref,event=branch
+      - name: Create manifest list and push
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
       - name: Run Trivy vulnerability scanner on cli image
         uses: aquasecurity/trivy-action@master
         with:
@@ -85,24 +164,11 @@ jobs:
           output: 'trivy-results.sarif'
           scanners: 'vuln'
           ignore-unfixed: true
-           #severity: 'CRITICAL,HIGH'
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: 'trivy-results.sarif'
-      # - name: Configure AWS Credentials
-      #   uses: aws-actions/configure-aws-credentials@v4
-      #   if: always()
-      #   with:
-      #     aws-region: us-east-2
-      #     role-to-assume: arn:aws:iam::312272277431:role/github-actions/buildx-deployments
-      #     role-session-name: PluralCLI
-      # - name: Manually cleanup buildx
-      #   if: always()
-      #   run: |
-      #     docker buildx stop ${{ steps.builder.outputs.name }}
-      #     sleep 10
-      #     docker buildx rm ${{ steps.builder.outputs.name }}
+
   # cloud:
   #   name: Build cloud image
   #   runs-on: ubuntu-latest
@@ -261,28 +327,6 @@ jobs:
         uses: github/codeql-action/upload-sarif@v2
         with:
           sarif_file: 'trivy-results.sarif'
-  test:
-    name: Unit test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - run: make test
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v4
-        with:
-          version: v1.62.2
-          skip-cache: true
   build:
     name: GoReleaser build
     runs-on: ubuntu-latest

.golangci.yml

@@ -1,27 +1,45 @@
+version: "2"
 run:
-  timeout: 10m
-  issues-exit-code: 1
-  tests: true
+  modules-download-mode: readonly
+  allow-parallel-runners: true
 linters:
-  disable-all: true
+  default: none
   enable:
-  # default linters
-  - errcheck
-  - gosimple
-  - govet
-  - ineffassign
-  - staticcheck
-  - typecheck
-  - unused
-
-  # additional linters
-  - errorlint
-  - errname
-  - gocyclo
-  - goimports
-  - misspell
-  - gofmt
-  - importas
-  - goconst
-  - gocritic
-  - misspell
+    - copyloopvar
+    - errcheck
+    - errname
+    - errorlint
+    - goconst
+    - gocritic
+    - gocyclo
+    - govet
+    - importas
+    - ineffassign
+    - misspell
+    - prealloc
+    - staticcheck
+    - unused
+    - usestdlibvars
+    - wastedassign
+    - whitespace
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gofmt
+    - goimports
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Dockerfile

@@ -3,7 +3,7 @@ FROM ubuntu:22.10 AS user
 # Create a nonroot user for final image
 RUN useradd -u 10001 nonroot
 
-FROM golang:1.23-alpine3.19 AS builder
+FROM golang:1.24-alpine3.21 AS builder
 
 WORKDIR /workspace
 
@@ -31,7 +31,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} \
     -X "github.com/pluralsh/plural-cli/pkg/common.Date=${APP_DATE}"' \
     -o plural ./cmd/plural
 
-FROM golang:1.23.4-alpine3.20 AS final
+FROM golang:1.24.2-alpine3.21 AS final
 
 WORKDIR /
 

Makefile

@@ -178,17 +178,17 @@ e2e: --ensure-venom
 	TF_VAR_deletion_protection=false \
  		venom run -vv --html-report --format=json --output-dir testout test/plural
 
-.PHONY: format
-format: ## formats all go code to prep for linting
-	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v1.62.2 golangci-lint run --fix
-
 .PHONY: genmock
 genmock: ## generates mocks before running tests
 	hack/gen-client-mocks.sh
 
 .PHONY: lint
 lint:
-	docker run --rm -v $(PWD):/app -w /app golangci/golangci-lint:v1.62.2 golangci-lint run
+	golangci-lint run ./...
+
+.PHONY: format
+format: ## formats all go code to prep for linting
+	golangci-lint run --fix ./...
 
 .PHONY: delete-tag
 delete-tag:

cmd/command/ai/ai.go

@@ -50,7 +50,7 @@ func (p *Plural) aiHelp(c *cli.Context) error {
 		s.Prefix = "Thinking "
 		s.Start()
 
-		msg, err := p.Client.Chat(chat)
+		msg, err := p.Chat(chat)
 		if err != nil {
 			return err
 		}

cmd/command/auth/auth.go

@@ -85,7 +85,7 @@ func (p *Plural) trustCommands() []cli.Command {
 
 func (p *Plural) handleListTrusts(c *cli.Context) error {
 	p.InitPluralClient()
-	me, err := p.Client.Me()
+	me, err := p.Me()
 	if err != nil {
 		return err
 	}
@@ -107,13 +107,13 @@ func (p *Plural) handleCreateTrust(c *cli.Context) error {
 		issuer = val
 	}
 
-	return p.Client.CreateTrust(issuer, trust)
+	return p.CreateTrust(issuer, trust)
 }
 
 func (p *Plural) handleDeleteTrust(c *cli.Context) error {
 	p.InitPluralClient()
 	id := c.Args().Get(0)
-	return p.Client.DeleteTrust(id)
+	return p.DeleteTrust(id)
 }
 
 func (p *Plural) handleOidcToken(c *cli.Context) error {
@@ -122,10 +122,10 @@ func (p *Plural) handleOidcToken(c *cli.Context) error {
 	token, email := c.String("token"), c.String("email")
 	provider := gqlclient.ExternalOidcProvider(strings.ToUpper(prov))
 	if !provider.IsValid() {
-		return fmt.Errorf("Invalid oidc provider %s", prov)
+		return fmt.Errorf("invalid OIDC provider %s", prov)
 	}
 
-	token, err := p.Client.OidcToken(provider, token, email)
+	token, err := p.OidcToken(provider, token, email)
 	if err != nil {
 		return err
 	}