Merge pull request #1 from manifest-cyber/fix-review-issues

chore: fix lint and upgrade deps

.devcontainer/devcontainer.json

@@ -61,7 +61,7 @@
   "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind",
   "features": {
     "ghcr.io/devcontainers/features/go:1": {
-      "version": "1.21.5"
+      "version": "1.23.1"
     },
     "ghcr.io/devcontainers/features/docker-in-docker:2": {
       "moby": true

.github/workflows/build.yml

@@ -17,7 +17,7 @@ jobs:
 
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: ./go.mod
           check-latest: true
 
       - name: govulncheck
@@ -53,7 +53,7 @@ jobs:
 
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: ./go.mod
           check-latest: true
 
       - name: setup-ruleguard
@@ -76,7 +76,7 @@ jobs:
 
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: ./go.mod
           check-latest: true
 
       - uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0

.github/workflows/lint.yml

@@ -21,12 +21,11 @@ jobs:
       - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
-          check-latest: true
+          go-version-file: ./go.mod
           cache: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@v6
         with:
           args: --timeout=5m
-          version: v1.59
+          version: v1.61.0

.github/workflows/release.yml

@@ -49,7 +49,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: '1.22'
+          go-version-file: ./go.mod
           check-latest: true
 
       - name: Login to GitHub Container Registry

.pre-commit-config.yaml

@@ -15,7 +15,7 @@ repos:
       - id: go-test-mod
 
   - repo: https://github.com/golangci/golangci-lint
-    rev: v1.59.1
+    rev: v1.61.0
     hooks:
       - id: golangci-lint
         args: ["--timeout", "10m", "--fix"]

cmd/cli/convert.go

@@ -17,7 +17,7 @@ import (
 	"github.com/protobom/sbom-convert/pkg/format"
 )
 
-var outputDirPermissions = 0o755
+const outputDirPermissions uint32 = 0o755
 
 func ConvertCommand() *cobra.Command {
 	co := &options.ConvertOptions{}

cmd/cli/root.go

@@ -84,6 +84,8 @@ func validateRootOptions(_ *options.RootOptions) error {
 }
 
 func setupLogger(ro *options.RootOptions) error {
+	//nolint:gosec
+	// verbose is always within the range of int8
 	level := zapcore.Level(int(zap.WarnLevel) - ro.Verbose)
 	log, err := log.NewLogger(
 		log.WithLevel(level),

go.mod

@@ -1,6 +1,6 @@
 module github.com/protobom/sbom-convert
 
-go 1.22.5
+go 1.23.1
 
 require (
 	github.com/google/go-cmp v0.6.0