Use golang for cross-platform build scripting

.binny.yaml

@@ -0,0 +1,96 @@
+tools:
+  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
+  - name: binny
+    version:
+      want: v0.8.0
+    method: github-release
+    with:
+      repo: anchore/binny
+
+  # used to produce SBOMs during release
+  - name: syft
+    version:
+      want: latest
+    method: github-release
+    with:
+      repo: anchore/syft
+
+  # used for signing the checksums file at release
+  - name: cosign
+    version:
+      want: v2.4.1
+    method: github-release
+    with:
+      repo: sigstore/cosign
+
+  # used to sign mac binaries at release
+  - name: quill
+    version:
+      want: v0.4.2
+    method: github-release
+    with:
+      repo: anchore/quill
+
+  # used for linting
+  - name: golangci-lint
+    version:
+      want: v1.61.0
+    method: github-release
+    with:
+      repo: golangci/golangci-lint
+
+  # used for showing the changelog at release
+  - name: glow
+    version:
+      want: v2.0.0
+    method: github-release
+    with:
+      repo: charmbracelet/glow
+
+  # used to release all artifacts
+  - name: goreleaser
+    version:
+      want: v2.3.2
+    method: github-release
+    with:
+      repo: goreleaser/goreleaser
+
+  # used for organizing imports during static analysis
+  - name: gosimports
+    version:
+      want: v0.3.8
+    method: github-release
+    with:
+      repo: rinchsan/gosimports
+
+  # used at release to generate the changelog
+  - name: chronicle
+    version:
+      want: v0.8.0
+    method: github-release
+    with:
+      repo: anchore/chronicle
+
+  # used during static analysis for license compliance
+  - name: bouncer
+    version:
+      want: v0.4.0
+    method: github-release
+    with:
+      repo: wagoodman/go-bouncer
+
+  # used for running all local and CI tasks
+  - name: task
+    version:
+      want: v3.39.2
+    method: github-release
+    with:
+      repo: go-task/task
+
+  # used for triggering a release
+  - name: gh
+    version:
+      want: v2.58.0
+    method: github-release
+    with:
+      repo: cli/cli

.github/actions/bootstrap/action.yaml

@@ -4,16 +4,18 @@ description: "Bootstrap all tools and dependencies"
 inputs:
   go-version:
     description: "Go version to install"
-    required: true
-    default: "1.21.x"
+    required: false
+  go-version-file:
+    description: "Go mod file to get go version to install"
+    required: false
   use-go-cache:
     description: "Restore go cache"
     required: true
     default: "true"
   cache-key-prefix:
     description: "Prefix all cache keys with this value"
     required: true
-    default: "831180ac25"
+    default: "831180ac26"
   build-cache-key-prefix:
     description: "Prefix build cache key with this value"
     required: true
@@ -25,15 +27,16 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe #v4.1.0
+    - uses: actions/setup-go@v5
       with:
         go-version: ${{ inputs.go-version }}
+        go-version-file: ${{ inputs.go-version-file }}
 
     - name: Restore tool cache
       id: tool-cache
       uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 #v3.3.2
       with:
-        path: ${{ github.workspace }}/.tmp
+        path: ${{ github.workspace }}/.tool
         key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
 
     # note: we need to keep restoring the go mod cache before bootstrapping tools since `go install` is used in
@@ -49,11 +52,6 @@ runs:
         restore-keys: |
           ${{ inputs.cache-key-prefix }}-${{ runner.os }}-go-mod-${{ inputs.go-version }}-
 
-    - name: (cache-miss) Bootstrap project tools
-      shell: bash
-      if: steps.tool-cache.outputs.cache-hit != 'true'
-      run: make bootstrap-tools
-
     - name: Restore go build cache
       id: go-cache
       if: inputs.use-go-cache == 'true'
@@ -65,11 +63,6 @@ runs:
         restore-keys: |
           ${{ inputs.cache-key-prefix }}-${{ inputs.build-cache-key-prefix }}-${{ runner.os }}-go-build-${{ inputs.go-version }}-
 
-    - name: (cache-miss) Bootstrap go dependencies
-      shell: bash
-      if: steps.go-mod-cache.outputs.cache-hit != 'true' && inputs.use-go-cache == 'true'
-      run: make bootstrap-go
-
     - name: Install apt packages
       if: inputs.bootstrap-apt-packages != ''
       shell: bash

.gitignore

@@ -1,18 +1,46 @@
-CHANGELOG.md
-VERSION
-/test/results
+# local development tailoring
+go.work
+go.work.sum
+.tool-versions
+.mise.toml
+
+# tool and bin directories
+.tmp/
+bin/
+/bin
+/.bin
+/build
 /dist
 /snapshot
-.server/
+/.tool
+/.task
+
+# changelog generation
+CHANGELOG.md
+VERSION
+
+# IDE configuration
 .vscode/
+.idea/
+.server/
 .history/
+
+# test related
 *.fingerprint
+/test/results
+coverage.txt
+*.log
+
+# probable archives
+.images
 *.tar
+*.jar
+*.war
+*.ear
+*.jpi
+*.hpi
 *.zip
-.idea/
-*.log
-.tmp/
-coverage.txt
+*.iml
 
 # Binaries for programs and plugins
 *.exe
@@ -30,4 +58,13 @@ coverage.txt
 # macOS Finder metadata
 .DS_STORE
 
-*.profile
+*.profile
+
+# attestation
+cosign.key
+cosign.pub
+
+# Byte-compiled object files for python
+__pycache__/
+*.py[cod]
+*$py.class

.golangci.yaml

@@ -1,3 +1,6 @@
+run:
+  tests: false
+
 # TODO: enable this when we have coverage on docstring comments
 #issues:
 #  # The list of ids of default excludes to include or disable.
@@ -18,7 +21,6 @@ linters:
     - dogsled
     - dupl
     - errcheck
-    - exportloopref
     - funlen
     - gocognit
     - goconst
@@ -46,6 +48,7 @@ linters:
 # do not enable...
 #    - bodyclose # 1.18 compat
 #    - depguard   # we don't have a specific configuration for this
+#    - exportloopref   # no longer relevant post go 1.22
 #    - gochecknoglobals
 #    - gochecknoinits    # this is too aggressive
 #    - godot