Pin build and release tools and keep them updated with Dependabot

.github/dependabot.yml

@@ -11,3 +11,31 @@ updates:
       interval: "daily"
     cooldown:
       default-days: 14
+  - package-ecosystem: "gomod"
+    directory: "/tools"
+    allow:
+      - dependency-type: "all"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14
+  - package-ecosystem: "docker"
+    directories:
+      - "/"
+      - "/docker"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14
+  - package-ecosystem: "bundler"
+    directory: "/.github/license_finder"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 14

.github/license_finder/Gemfile

@@ -0,0 +1,4 @@
+source "https://rubygems.org"
+
+gem "license_finder", "7.2.1"
+gem "logger"

.github/license_finder/Gemfile.lock

@@ -0,0 +1,46 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    csv (3.3.7)
+    license_finder (7.2.1)
+      bundler
+      csv (~> 3.2)
+      rubyzip (>= 1, < 3)
+      thor (~> 1.2)
+      tomlrb (>= 1.3, < 2.1)
+      with_env (= 1.1.0)
+      xml-simple (~> 1.1.9)
+    logger (1.7.0)
+    racc (1.8.1)
+    rexml (3.4.4)
+    rubyzip (2.4.1)
+    thor (1.5.0)
+    tomlrb (2.0.5)
+      racc (~> 1.4)
+    with_env (1.1.0)
+    xml-simple (1.1.9)
+      rexml
+
+PLATFORMS
+  ruby
+  x86_64-linux
+
+DEPENDENCIES
+  license_finder (= 7.2.1)
+  logger
+
+CHECKSUMS
+  bundler (4.0.18) sha256=02d9a17429de1847b4e0c9f27a9ee4b20c0a74c0a641b4e77195d6019e3618ac
+  csv (3.3.7) sha256=15a3f16f6628da8664d455eb634e7f22031bcf53044923caf56975109e71b9f8
+  license_finder (7.2.1) sha256=179ead19b64b170638b72fd16024233813673ac9d20d5ba75ae0b4444887ef14
+  logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
+  racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
+  rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
+  rubyzip (2.4.1) sha256=8577c88edc1fde8935eb91064c5cb1aef9ad5494b940cf19c775ee833e075615
+  thor (1.5.0) sha256=e3a9e55fe857e44859ce104a84675ab6e8cd59c650a49106a05f55f136425e73
+  tomlrb (2.0.5) sha256=6e9a5e70a94a723842e770fcd14c49867703500d07cd03ebb6c343138a7b4477
+  with_env (1.1.0) sha256=50b3e4f0a6cda8f90d8a6bd87a6261f6c381429abafb161c4c69ad4a0cd0b6e4
+  xml-simple (1.1.9) sha256=d21131e519c86f1a5bc2b6d2d57d46e6998e47f18ed249b25cad86433dbd695d
+
+BUNDLED WITH
+  4.0.18

.github/workflows/ci.yml

@@ -18,12 +18,12 @@ jobs:
     name: Build, Test, & Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
@@ -32,24 +32,25 @@ jobs:
   verify-licenses:
     name: Verify Dependency Licenses
     runs-on: ubuntu-latest
+    env:
+      BUNDLE_GEMFILE: .github/license_finder/Gemfile
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@3ff19f5e2baf30647122352b96108b1fbe250c64 # v1.299.0
+        uses: ruby/setup-ruby@824c0e29fdfc7d689c191c27acc969d2d04b7dd8 # v1.331.0
         with:
-          ruby-version: "4"
-
-      - run: gem install license_finder # zizmor: ignore[adhoc-packages]
+          ruby-version: "4.0.7"
+          bundler-cache: true
 
       - run: go get -v ./...
 
       - name: Verify licenses
-        run: license_finder
+        run: bundle exec license_finder

.github/workflows/lint.yml

@@ -18,12 +18,12 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
 
@@ -39,6 +39,6 @@ jobs:
       - run: make lint
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: latest
+          version: v2.15.0

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.CLI_APP_ID }}
@@ -35,14 +35,22 @@ jobs:
             homebrew-tap
             scoop-bucket
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
+        with:
+          image: docker.io/tonistiigi/binfmt:qemu-v10.2.3@sha256:400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: tools/go.mod
+          cache: false
 
       - name: Configure Git
         run: |

.github/workflows/sync-planetscale-go.yml

@@ -35,7 +35,7 @@ jobs:
       name: release
       deployment: false
     steps:
-      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           app-id: ${{ vars.CLI_APP_ID }}
@@ -46,13 +46,13 @@ jobs:
           repositories: planetscale-go
 
       - name: Check out cli
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: cli
           persist-credentials: false
 
       - name: Check out planetscale-go # zizmor: ignore[artipacked]
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: planetscale/planetscale-go
           token: ${{ steps.app-token.outputs.token }}
@@ -62,7 +62,7 @@ jobs:
           fetch-tags: true
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: cli/go.mod
           cache: false
@@ -117,13 +117,13 @@ jobs:
         working-directory: planetscale-go
         run: |
           # gorelease requires a clean tree, hence running after the commit.
-          go install golang.org/x/exp/cmd/gorelease@latest
+          go -C ../cli/tools build -o "$RUNNER_TEMP/gorelease" golang.org/x/exp/cmd/gorelease
           base=$(git describe --tags --abbrev=0)
           echo "Comparing against $base"
           {
             echo '## gorelease report (base: '"$base"')'
             echo '```'
-            gorelease -base="$base" 2>&1 || true
+            "$RUNNER_TEMP/gorelease" -base="$base" 2>&1 || true
             echo '```'
           } > /tmp/gorelease-report.md
           cat /tmp/gorelease-report.md

.github/workflows/zizmor.yml

@@ -19,7 +19,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.0 AS build
+FROM golang:1.26.10@sha256:670bb5aa5349ae03b8516764718486f4f16399134bdc9acd0c46a23f043ab05c AS build
 WORKDIR /app
 COPY . .
 
@@ -8,7 +8,7 @@ ARG DATE
 
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w -X main.commit=$COMMIT -X main.version=$VERSION -X main.date=$DATE" github.com/planetscale/cli/cmd/pscale
 
-FROM ubuntu:noble
+FROM ubuntu:noble@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates mysql-client openssh-client \
     && rm -rf /var/lib/apt/lists/*

Dockerfile.goreleaser

@@ -1,4 +1,4 @@
-FROM ubuntu:noble
+FROM ubuntu:noble@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates mysql-client openssh-client \
     && rm -rf /var/lib/apt/lists/*

Makefile

@@ -11,8 +11,7 @@ endif
 REPO=planetscale
 NAME=pscale
 BUILD_PKG=github.com/planetscale/cli/cmd/pscale
-GORELEASE_CROSS_VERSION ?= v1.26.0
-SYFT_VERSION ?= 1.38.0
+SYFT_VERSION ?= 1.55.0
 
 .PHONY: all
 all: build test lint
@@ -27,8 +26,7 @@ build:
 
 .PHONY: lint
 lint:
-	@go install honnef.co/go/tools/cmd/staticcheck@HEAD
-	@staticcheck ./...
+	@go tool -modfile=tools/go.mod staticcheck ./...
 	@go vet ./...
 
 .PHONY: build-image
@@ -55,7 +53,7 @@ clean:
 
 .PHONY: release
 release:
-	@docker build --build-arg GORELEASE_CROSS_VERSION=$(GORELEASE_CROSS_VERSION) --build-arg SYFT_VERSION=$(SYFT_VERSION) -t releaser -f docker/Dockerfile.goreleaser .
+	@docker build --build-arg SYFT_VERSION=$(SYFT_VERSION) -t releaser -f docker/Dockerfile.goreleaser .
 	@docker run \
 		--rm \
 		-e GITHUB_TOKEN=${GITHUB_TOKEN} \

docker/Dockerfile.goreleaser

@@ -1,10 +1,10 @@
-ARG GORELEASE_CROSS_VERSION=v1.26.0
-FROM ghcr.io/goreleaser/goreleaser-cross:${GORELEASE_CROSS_VERSION}
+FROM ghcr.io/goreleaser/goreleaser-cross:v1.26.10@sha256:4ddb0de02f2eaac64d2b33e16d1d702d800db6a110154f8768f283858fb26c02
 
 RUN apt-get update --allow-releaseinfo-change || apt-get update; apt-get install -y openssh-client
 
-ARG SYFT_VERSION=1.38.0
-RUN wget -O syft.deb https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.deb && dpkg -i syft.deb
+ARG SYFT_VERSION=1.55.0
+ARG SYFT_SHA256=070620d4a7ed6a2fbca67dae6cd0622c05354b351e171f325f0a3c9e7f42adab
+RUN wget -O syft.deb https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/syft_${SYFT_VERSION}_linux_amd64.deb && echo "${SYFT_SHA256}  syft.deb" | sha256sum -c - && dpkg -i syft.deb
 
 RUN mv /entrypoint.sh /base-entrypoint.sh
 COPY docker/entrypoint.sh /entrypoint.sh

go.mod

@@ -1,6 +1,6 @@
 module github.com/planetscale/cli
 
-go 1.26.0
+go 1.26.10
 
 require (
 	github.com/99designs/keyring v1.2.2

script/bump-version.sh

@@ -2,16 +2,9 @@
 
 set -eu
 
-WORKDIR=$(pwd)
-
-echo "+++ :construction:  Installing 'svu' tool"
-curl -L -o /tmp/svu_linux_x86_64.tar.gz https://github.com/caarlos0/svu/releases/download/v1.8.0/svu_1.8.0_linux_amd64.tar.gz
-cd /tmp && tar -zxvf svu_linux_x86_64.tar.gz
-cd $WORKDIR
-
 git fetch --tags
 
-RELEASE_VERSION=$(/tmp/svu minor)
+RELEASE_VERSION=$(go tool -modfile=tools/go.mod svu minor)
 
 echo "+++ :boom: Bumping to version $RELEASE_VERSION"
 

tools/go.mod

@@ -0,0 +1,25 @@
+module github.com/planetscale/cli/tools
+
+go 1.26.10
+
+tool (
+	github.com/caarlos0/svu
+	golang.org/x/exp/cmd/gorelease
+	honnef.co/go/tools/cmd/staticcheck
+)
+
+require (
+	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c // indirect
+	github.com/Masterminds/semver v1.5.0 // indirect
+	github.com/alecthomas/kingpin v2.2.6+incompatible // indirect
+	github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751 // indirect
+	github.com/alecthomas/units v0.0.0-20210208195552-ff826a37aa15 // indirect
+	github.com/caarlos0/svu v1.12.0 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
+	golang.org/x/exp v0.0.0-20261014143641-f0251eb4aa3e // indirect
+	golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 // indirect
+	golang.org/x/mod v0.42.0 // indirect
+	golang.org/x/sync v0.24.0 // indirect
+	golang.org/x/tools v0.52.0 // indirect
+	honnef.co/go/tools v0.8.2 // indirect
+)