Update to Go 1.22 (#105)

* bump go.mod to go 1.22

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

* use ubi9 base images with go-toolset 1.22.9 builder

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

* update go version requirement to 1.22 under README

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

* add Go badge to README

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

* update gosec to v2.22.0

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

* pin base images using list digests

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

---------

Signed-off-by: Michael Valdron <mvaldron@redhat.com>

Author: michael-valdron

.github/workflows/ci.yaml

@@ -80,7 +80,7 @@ jobs:
 
       - name: Run Gosec Security Scanner
         run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@1af1d5bb49259b62e45c505db397dd2ada5d74f8
+          go install github.com/securego/gosec/v2/cmd/gosec@e0cca6fe95306b7e7790d6f1bf6a7bec6d622459 # v2.22.0
           make gosec
           if [[ $? != 0 ]]
           then

Dockerfile

@@ -14,8 +14,9 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM golang:1.21@sha256:b405b620c7b53ef64695c7da7c8396f411f381c1eb7da6713c585dd7eca1559b as builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.22.9@sha256:e4193e71ea9f2e2504f6b4ee93cadef0fe5d7b37bba57484f4d4229801a7c063 as builder
 ARG TARGETARCH=amd64
+USER root
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -41,9 +42,8 @@ ENV ENABLE_WEBHOOKS=${ENABLE_WEBHOOKS}
 ARG ENABLE_WEBHOOK_HTTP2=false
 ENV ENABLE_WEBHOOK_HTTP2=${ENABLE_WEBHOOK_HTTP2}
 
-# Use distroless as minimal base image to package the manager binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot-${TARGETARCH}
+# Use ubi-micro as minimal base image to package the manager binary
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:955512628a9104d74f7b3b0a91db27a6bbecdd6a1975ce0f1b2658d3cd060b98
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 1001

Makefile

@@ -340,5 +340,5 @@ bundle-push:
 .PHONY: gosec
 gosec:
 	# Run this command to install gosec, if not installed:
-	# go install github.com/securego/gosec/v2/cmd/gosec@v2.14.0
+	# go install github.com/securego/gosec/v2/cmd/gosec@v2.22.0
 	gosec -no-fail -fmt=sarif -out=gosec.sarif -exclude-dir pkg/test -exclude-dir tests ./...

README.md

@@ -3,6 +3,7 @@
 
 <div id="header">
 
+[![Go 1.22](https://img.shields.io/badge/1.22-blue?logo=go&labelColor=gray)](https://go.dev/doc/go1.22)
 [![Apache2.0 License](https://img.shields.io/badge/license-Apache2.0-brightgreen.svg)](LICENSE)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8256/badge)](https://www.bestpractices.dev/projects/8256)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/devfile/registry-operator/badge)](https://securityscorecards.dev/viewer/?uri=github.com/devfile/registry-operator)
@@ -48,7 +49,7 @@ security setups.
 
 ### Development
 
-- Go 1.21.x
+- Go 1.22.x
 - Docker / Podman
 - Operator SDK 1.28.x
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/devfile/registry-operator
 
-go 1.21
+go 1.22
 
 require (
 	github.com/devfile/registry-support/index/generator v0.0.0-20240816133831-cf509ccd1a6b