1.12: reliability & security pass

.codespellrc

@@ -0,0 +1,3 @@
+[codespell]
+skip = go.sum,go.mod,.git,dist,TASKS.md
+ignore-words-list = unparseable

.github/Dockerfile

@@ -1,16 +1,10 @@
-# build stage
-FROM golang:alpine AS build
-RUN apk update && apk add git
-ADD . /src
-WORKDIR /src
-ENV CGO_ENABLED=0
-RUN go build \
-    -ldflags "-X github.com/jpillora/chisel/share.BuildVersion=$(git describe --abbrev=0 --tags)" \
-    -o /tmp/bin
-# run stage
+# goreleaser builds the binary and provides it in the build context
+FROM alpine:3 AS certs
+RUN apk add --no-cache ca-certificates
+
 FROM scratch
 LABEL maintainer="dev@jpillora.com"
-COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 WORKDIR /app
-COPY --from=build /tmp/bin /app/bin
-ENTRYPOINT ["/app/bin"]
+COPY chisel /app/bin
+ENTRYPOINT ["/app/bin"]

.github/goreleaser.yml

@@ -59,3 +59,139 @@ changelog:
     exclude:
       - "^docs:"
       - "^test:"
+
+dockers:
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/amd64"
+    goarch: amd64
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm64"
+    goarch: arm64
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm/v7"
+    goarch: arm
+    goarm: "7"
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/arm/v6"
+    goarch: arm
+    goarm: "6"
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/386"
+    goarch: "386"
+
+  - image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"
+    use: buildx
+    dockerfile: .github/Dockerfile
+    build_flag_templates:
+      - "--platform=linux/ppc64le"
+    goarch: ppc64le
+
+docker_manifests:
+  - name_template: "ghcr.io/jpillora/chisel:{{ .Version }}"
+    image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "ghcr.io/jpillora/chisel:{{ .Major }}"
+    skip_push: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
+    image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "ghcr.io/jpillora/chisel:{{ .Major }}.{{ .Minor }}"
+    skip_push: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
+    image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "ghcr.io/jpillora/chisel:latest"
+    skip_push: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
+    image_templates:
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-386"
+      - "ghcr.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "docker.io/jpillora/chisel:{{ .Version }}"
+    image_templates:
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "docker.io/jpillora/chisel:{{ .Major }}"
+    skip_push: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
+    image_templates:
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "docker.io/jpillora/chisel:{{ .Major }}.{{ .Minor }}"
+    skip_push: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
+    image_templates:
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"
+
+  - name_template: "docker.io/jpillora/chisel:latest"
+    skip_push: "{{ if .Prerelease }}true{{ else }}false{{ end }}"
+    image_templates:
+      - "docker.io/jpillora/chisel:{{ .Version }}-amd64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-arm64"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv7"
+      - "docker.io/jpillora/chisel:{{ .Version }}-armv6"
+      - "docker.io/jpillora/chisel:{{ .Version }}-386"
+      - "docker.io/jpillora/chisel:{{ .Version }}-ppc64le"

.github/workflows/ci.yml

@@ -1,10 +1,24 @@
 name: CI
 on:
   pull_request: {}
-  push: {}
-permissions: write-all
+  push:
+    branches: [master]
+    tags: ["v*"]
+permissions:
+  contents: read
 jobs:
   # ================
+  # SPELLING CHECK
+  # ================
+  codespell:
+    name: Spelling
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: codespell
+        uses: codespell-project/actions-codespell@v2
+  # ================
   # BUILD AND TEST JOB
   # ================
   test:
@@ -16,7 +30,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Set up Go
@@ -29,64 +43,47 @@ jobs:
       - name: Test
         run: go test -v ./...
   # ================
-  # RELEASE BINARIES (on push "v*" tag)
+  # RELEASE (on push "v*" tag)
+  # Builds binaries, packages, and multi-arch Docker images via GoReleaser
   # ================
-  release_binaries:
-    name: Release Binaries
+  release:
+    name: Release
     needs: test
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
     steps:
-      - name: Check out code
-        uses: actions/checkout@v5
+      - name: Checkout
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - name: goreleaser
-        if: success()
-        uses: docker://goreleaser/goreleaser:latest
-        env:
-          GITHUB_USER: ${{ github.repository_owner }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GOTOOLCHAIN: auto
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          args: release --config .github/goreleaser.yml
-  # ================
-  # RELEASE DOCKER IMAGES (on push "v*" tag)
-  # ================
-  release_docker:
-    name: Release Docker Images
-    needs: test
-    if: startsWith(github.ref, 'refs/tags/v')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v5
+          go-version: stable
+          cache: true
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
+        uses: docker/setup-buildx-action@v4
+      - name: Login to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v4
         with:
           username: jpillora
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Docker meta
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: jpillora/chisel
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-            type=semver,pattern={{major}}
-      - name: Build and push
-        uses: docker/build-push-action@v6
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
         with:
-          context: .
-          file: .github/Dockerfile
-          platforms: linux/amd64,linux/arm64,linux/ppc64le,linux/386,linux/arm/v7,linux/arm/v6
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          distribution: goreleaser
+          version: v2.12.7
+          args: release --clean --config .github/goreleaser.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Makefile

@@ -8,39 +8,37 @@ LDFLAGS=-ldflags "-s -w ${XBUILD} -buildid=${BUILD} -X github.com/jpillora/chise
 GOFILES=`go list ./...`
 GOFILESNOTEST=`go list ./... | grep -v test`
 
-# Make Directory to store executables
-$(shell mkdir -p ${DIR})
-
 all:
 	@goreleaser build --skip-validate --single-target --config .github/goreleaser.yml
 
-freebsd: lint
+freebsd: lint ${DIR}
 	env CGO_ENABLED=0 GOOS=freebsd GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-freebsd_amd64 .
 
-linux: lint
-	env CGO_ENABLED=1 GOOS=linux GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-linux_amd64 .
+linux: lint ${DIR}
+	env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-linux_amd64 .
 
-windows: lint
-	env CGO_ENABLED=1 GOOS=windows GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-windows_amd64 .
+windows: lint ${DIR}
+	env CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-windows_amd64 .
 
-darwin:
+darwin: ${DIR}
 	env CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -trimpath ${LDFLAGS} ${GCFLAGS} ${ASMFLAGS} -o ${DIR}/chisel-darwin_amd64 .
 
 docker:
 	@docker build .
 
 dep: ## Get the dependencies
-	@go get -u github.com/goreleaser/goreleaser
-	@go get -u github.com/boumenot/gocover-cobertura
-	@go get -v -d ./...
-	@go get -u all
+	@go install github.com/goreleaser/goreleaser/v2@latest
+	@go install github.com/boumenot/gocover-cobertura@latest
 	@go mod tidy
 
 lint: ## Lint the files
 	@go fmt ${GOFILES}
 	@go vet ${GOFILESNOTEST}
 
-test: ## Run unit tests
+${DIR}:
+	mkdir -p ${DIR}
+
+test: ${DIR} ## Run unit tests
 	@go test -coverprofile=${DIR}/coverage.out -race -short ${GOFILESNOTEST}
 	@go tool cover -html=${DIR}/coverage.out -o ${DIR}/coverage.html
 	@gocover-cobertura < ${DIR}/coverage.out > ${DIR}/coverage.xml