build(go): shift Go support window to [1.22, 1.23] (#820)

1. Upgrading `go.mod` to `1.22`
2. Using new `for` syntax like `for i := range N`
3. Migrating random generator from package
[`math/rand`](https://pkg.go.dev/math/rand) to package
[`math/rand/v2`](https://pkg.go.dev/math/rand/v2@go1.22.0)

References:
- [Go 1.22 release notes](https://tip.golang.org/doc/go1.22)
- [Secure Randomness in Go
1.22](https://tip.golang.org/blog/chacha8rand)

Resolves: #812
Signed-off-by: Lixia (Sylvia) Lei <lixlei@microsoft.com>

.github/workflows/build.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go-version: ['1.21', '1.22']
+        go-version: ['1.22', '1.23']
       fail-fast: true
     steps:
       - name: Checkout

.github/workflows/codeql-analysis.yml

@@ -35,7 +35,7 @@ jobs:
       security-events: write
     strategy:
       matrix:
-        go-version: ['1.21', '1.22']
+        go-version: ['1.22', '1.23']
       fail-fast: false
     steps:
       - name: Checkout repository

README.md

@@ -20,7 +20,7 @@ The ORAS Go library follows [Semantic Versioning](https://semver.org/), where br
 The version `2` is actively developed in the [`main`](https://github.com/oras-project/oras-go/tree/main) branch with all new features.
 
 > [!Note]
-> The `main` branch follows [Go's Security Policy](https://github.com/golang/go/security/policy) and supports the two latest versions of Go (currently `1.21` and `1.22`).
+> The `main` branch follows [Go's Security Policy](https://github.com/golang/go/security/policy) and supports the two latest versions of Go (currently `1.22` and `1.23`).
 
 Examples for common use cases can be found below:
 

go.mod

@@ -1,6 +1,6 @@
 module oras.land/oras-go/v2
 
-go 1.21
+go 1.22
 
 require (
 	github.com/opencontainers/go-digest v1.0.0

registry/remote/auth/scope.go

@@ -303,7 +303,7 @@ func cleanActions(actions []string) []string {
 	// slow path
 	slices.Sort(actions)
 	n := 0
-	for i := 0; i < len(actions); i++ {
+	for i := range len(actions) {
 		if actions[i] == "*" {
 			return []string{"*"}
 		}

registry/remote/retry/policy.go

@@ -18,7 +18,7 @@ package retry
 import (
 	"hash/maphash"
 	"math"
-	"math/rand"
+	"math/rand/v2"
 	"net"
 	"net/http"
 	"strconv"
@@ -88,15 +88,15 @@ type Backoff func(attempt int, resp *http.Response) time.Duration
 // jitter. The backoff is calculated as:
 //
 //	temp = backoff * factor ^ attempt
-//	interval = temp * (1 - jitter) + rand.Int63n(2 * jitter * temp)
+//	interval = temp * (1 - jitter) + rand.Int64N(2 * jitter * temp)
 //
 // The HTTP response is checked for a Retry-After header. If it is present, the
 // value is used as the backoff duration.
 func ExponentialBackoff(backoff time.Duration, factor, jitter float64) Backoff {
 	return func(attempt int, resp *http.Response) time.Duration {
 		var h maphash.Hash
 		h.SetSeed(maphash.MakeSeed())
-		rand := rand.New(rand.NewSource(int64(h.Sum64())))
+		rand := rand.New(rand.NewPCG(h.Sum64(), 0))
 
 		// check Retry-After
 		if resp != nil && resp.StatusCode == http.StatusTooManyRequests {
@@ -109,7 +109,7 @@ func ExponentialBackoff(backoff time.Duration, factor, jitter float64) Backoff {
 
 		// do exponential backoff with jitter
 		temp := float64(backoff) * math.Pow(factor, float64(attempt))
-		return time.Duration(temp*(1-jitter)) + time.Duration(rand.Int63n(int64(2*jitter*temp)))
+		return time.Duration(temp*(1-jitter)) + time.Duration(rand.Int64N(int64(2*jitter*temp)))
 	}
 }