PSR-41: modernize secrets-init and fix gRPC CVE

.github/workflows/docker-release.yaml

@@ -9,30 +9,34 @@ on:
       - 'docs/**'
       - '*.md'
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v4
 
       - name: Set up Docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v4
 
       - name: Login to Docker Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -46,23 +50,20 @@ jobs:
         env:
           DOCKER_REPOSITORY: ${{ secrets.DOCKER_REPOSITORY }}
         run: |
-          name=${DOCKER_REPOSITORY}
-          if [ -z "$name" ]; then
-          name=${{ github.repository }}
-          fi
-          echo ::set-output name=name::${name}
-          echo ::debug::docker image name ${name}
+          name="${DOCKER_REPOSITORY:-${GITHUB_REPOSITORY}}"
+          echo "name=${name}" >> "$GITHUB_OUTPUT"
+          echo "::debug::docker image name ${name}"
 
       - name: Decide on tag
         id: tagger
         run: |
-          tag=$(echo "${{ github.ref }}" | sed -e 's/^refs\/heads\///g' -e 's/^refs\/tags\///g' -e 's/^refs\/pull\///g' -e 's/\/merge$//g' | sed -e 's/master/latest/g')
-          echo "::set-output name=tag::${tag}"
+          tag=$(echo "${GITHUB_REF}" | sed -e 's/^refs\/heads\///g' -e 's/^refs\/tags\///g' -e 's/^refs\/pull\///g' -e 's/\/merge$//g' | sed -e 's/master/latest/g')
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
           echo "::debug::docker image tag ${tag}"
 
       - name: Build and push Docker image
         id: build-push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v7
         with:
           build-args: VERSION=${{ steps.tagger.outputs.tag }}
           platforms: linux/amd64,linux/arm64
@@ -74,4 +75,4 @@ jobs:
           push: true
 
       - name: Image digest
-        run: echo "${{ steps.build-push.outputs.digest }}"
+        run: echo "${{ steps.build-push.outputs.digest }}"

.github/workflows/github-release.yaml

@@ -9,32 +9,36 @@ on:
       - 'docs/**'
       - '*.md'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v7
         with:
-          go-version: '>=1.21.0'
+          go-version: '1.26.5'
+          cache: true
 
       - name: Cross-Platform build
         run: |
-          make platfrom-build
+          make platform-build
 
       - name: Build Changelog
         id: build_changelog
-        uses: mikepenz/release-changelog-builder-action@v3
+        uses: mikepenz/release-changelog-builder-action@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v3
         with:
-          body: ${{steps.github_release.outputs.changelog}}
+          body: ${{ steps.build_changelog.outputs.changelog }}
           files: |
             .bin/*

.github/workflows/test.yaml

@@ -1,36 +1,42 @@
 name: test
+
 on:
   push:
     branches:
-      - '*'
+      - '**'
     tags:
-      - '*'
+      - '**'
     paths-ignore:
       - 'docs/**'
       - '*.md'
   pull_request:
     branches:
-      - '*'
+      - '**'
 env:
   GOPROXY: https://proxy.golang.org
   CGO_ENABLED: 0
+
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v7
         with:
-          go-version: '>=1.21.0'
+          go-version: '1.26.5'
+          cache: true
 
       - name: Lint
         run: |
           make lint
 
       - name: Test
         run: |
-          make test
+          make test

.golangci.yaml

@@ -1,144 +1,130 @@
+version: "2"
 run:
-  # which dirs to skip
-  skip-dirs:
-    - mocks
-  # Timeout for analysis, e.g. 30s, 5m.
-  # Default: 1m
-  timeout: 5m
-  # Exit code when at least one issue was found.
-  # Default: 1
   issues-exit-code: 2
-  # Include test files or not.
-  # Default: true
   tests: false
-
-linters-settings:
-  govet:
-    check-shadowing: true
-  gocyclo:
-    min-complexity: 15
-  maligned:
-    suggest-new: true
-  dupl:
-    threshold: 100
-  goconst:
-    min-len: 2
-    min-occurrences: 2
-  misspell:
-    locale: US
-    ignore-words:
-      - "cancelled"
-  goimports:
-    local-prefixes: github.com/golangci/golangci-lint
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - dupImport # https://github.com/go-critic/go-critic/issues/845
-      - ifElseChain
-      - octalLiteral
-      - rangeValCopy
-      - unnamedResult
-      - whyNoLint
-      - wrapperFunc
-  funlen:
-    lines: 105
-    statements: 50
-
 linters:
-  # please, do not use `enable-all`: it's deprecated and will be removed soon.
-  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
-  disable-all: true
+  default: none
   enable:
     - asciicheck
     - bidichk
     - bodyclose
-    # - containedctx
-    # - contextcheck disabled because of generics
-    - dupword
     - decorder
-    # - depguard
     - dogsled
     - dupl
+    - dupword
     - durationcheck
+    - err113
     - errcheck
     - errchkjson
     - errname
     - errorlint
     - exhaustive
-    # - exhaustivestruct TODO: check how to fix it
-    - exportloopref
-    # - forbidigo TODO: configure forbidden code patterns
-    # - forcetypeassert
     - funlen
-    - gci
-    # - gochecknoglobals TODO: remove globals from code
-    # - gochecknoinits TODO: remove main.init
     - gocognit
     - goconst
     - gocritic
     - gocyclo
-    #    - godox
-    - goerr113
-    - gofmt
-    - goimports
-    - gomnd
-    # - gomoddirectives
+    - goprintffuncname
     - gosec
-    - gosimple
     - govet
-    - goprintffuncname
     - grouper
     - importas
-    # - ireturn TODO: not sure if it is a good linter
     - ineffassign
     - interfacebloat
     - loggercheck
     - maintidx
     - makezero
     - misspell
+    - mnd
     - nakedret
-    # - nestif
     - nilerr
     - nilnil
-    # - noctx
     - nolintlint
     - prealloc
     - predeclared
     - promlinter
     - reassign
     - revive
-    # - rowserrcheck disabled because of generics
-    # - staticcheck doesn't work with go1.19
-    # - structcheck disabled because of generics
-    - stylecheck
-    - tenv
+    - staticcheck
     - testableexamples
-    - typecheck
     - unconvert
     - unparam
     - unused
-    # - varnamelen TODO: review naming
-    # - varcheck depricated 1.49
-    # - wastedassign disabled because of generics
     - whitespace
     - wrapcheck
-    # - wsl
-
-issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - funlen
-        - bodyclose
-        - gosec
-        - dupl
-        - gocognit
-        - goconst
-        - gocyclo
-  exclude:
-    - Using the variable on range scope `tt` in function literal
+  settings:
+    dupl:
+      threshold: 100
+    funlen:
+      lines: 105
+      statements: 50
+    goconst:
+      min-len: 2
+      min-occurrences: 2
+    gocritic:
+      disabled-checks:
+        - dupImport
+        - ifElseChain
+        - octalLiteral
+        - rangeValCopy
+        - unnamedResult
+        - whyNoLint
+        - wrapperFunc
+      enabled-tags:
+        - diagnostic
+        - experimental
+        - opinionated
+        - performance
+        - style
+    gocyclo:
+      min-complexity: 15
+    misspell:
+      locale: US
+      ignore-rules:
+        - cancelled
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - bodyclose
+          - dupl
+          - funlen
+          - gocognit
+          - goconst
+          - gocyclo
+          - gosec
+        path: _test\.go
+      - path: (.+)\.go$
+        text: Using the variable on range scope `tt` in function literal
+    paths:
+      - mocks$
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - goimports
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(secrets-init)
+      custom-order: true
+    goimports:
+      local-prefixes:
+        - secrets-init
+  exclusions:
+    generated: lax
+    paths:
+      - mocks$
+      - third_party$
+      - builtin$
+      - examples$