From 328c71fd48a781cafadef42857541a45365d636b Mon Sep 17 00:00:00 2001 From: Miguel Martinez Date: Thu, 4 Dec 2025 16:10:38 +0100 Subject: [PATCH 1/2] chore: upgrade Go to 1.25.5 and Atlas to v0.38.1 Upgraded Go from 1.25.3 to 1.25.5 across all Dockerfiles, GitHub Actions workflows, and documentation. Updated Atlas from v0.38.0 to v0.38.1 for both Docker image and CLI installation. Signed-off-by: Miguel Martinez --- .github/workflows/codeql.yml | 2 +- .github/workflows/lint.yml | 4 ++-- .github/workflows/release.yaml | 2 +- .github/workflows/test.yml | 2 +- CLAUDE.md | 2 +- app/artifact-cas/Dockerfile | 2 +- app/artifact-cas/Dockerfile.goreleaser | 2 +- app/cli/Dockerfile.goreleaser | 2 +- app/controlplane/Dockerfile | 2 +- app/controlplane/Dockerfile.goreleaser | 2 +- app/controlplane/Dockerfile.migrations | 6 +++--- common.mk | 2 +- docs/examples/ci-workflows/github.yaml | 2 +- go.mod | 2 +- 14 files changed, 17 insertions(+), 17 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 67d25175f..a68cf2db1 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -48,7 +48,7 @@ jobs: - name: Set up Go uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.3" + go-version: "1.25.5" # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 7046b9c7a..56476bdde 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -26,7 +26,7 @@ jobs: steps: - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.3" + go-version: "1.25.5" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 @@ -67,7 +67,7 @@ jobs: - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.3" + go-version: "1.25.5" - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 5491054c1..6f913f702 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -79,7 +79,7 @@ jobs: - name: Set up Go uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.3" + go-version: "1.25.5" # install qemu binaries for multiarch builds (needed by goreleaser/buildx) - name: Setup qemu diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index d8158d3fb..cf2ce154d 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -27,7 +27,7 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3.6.1 with: - go-version: "1.25.3" + go-version: "1.25.5" cache: true cache-dependency-path: go.sum diff --git a/CLAUDE.md b/CLAUDE.md index 5ee004a50..1464243ea 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -135,7 +135,7 @@ make migration_lint # Lint migration files ## Key Technologies -- **Language**: Go 1.25.3 +- **Language**: Go 1.25.5 - **API**: gRPC with HTTP/JSON gateway, Protocol Buffers with buf - **Database**: PostgreSQL with Ent ORM, Atlas for migrations - **Authentication**: OIDC, JWT tokens diff --git a/app/artifact-cas/Dockerfile b/app/artifact-cas/Dockerfile index 7928f00c8..e08b3315a 100644 --- a/app/artifact-cas/Dockerfile +++ b/app/artifact-cas/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder +FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder # Not linked libraries since it will be injected into a scratch container ENV CGO_ENABLED=0 diff --git a/app/artifact-cas/Dockerfile.goreleaser b/app/artifact-cas/Dockerfile.goreleaser index 1d088d1b0..50f12570a 100644 --- a/app/artifact-cas/Dockerfile.goreleaser +++ b/app/artifact-cas/Dockerfile.goreleaser @@ -1,4 +1,4 @@ -FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder +FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder FROM scratch diff --git a/app/cli/Dockerfile.goreleaser b/app/cli/Dockerfile.goreleaser index 390959be7..ca89e27d3 100644 --- a/app/cli/Dockerfile.goreleaser +++ b/app/cli/Dockerfile.goreleaser @@ -1,4 +1,4 @@ -FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder +FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder RUN mkdir -p /.config/chainloop FROM scratch diff --git a/app/controlplane/Dockerfile b/app/controlplane/Dockerfile index db7dd9ec5..210c802dc 100644 --- a/app/controlplane/Dockerfile +++ b/app/controlplane/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder +FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder # Not linked libraries since it will be injected into a scratch container ENV CGO_ENABLED=0 diff --git a/app/controlplane/Dockerfile.goreleaser b/app/controlplane/Dockerfile.goreleaser index a0fd3dbf5..182561c8a 100644 --- a/app/controlplane/Dockerfile.goreleaser +++ b/app/controlplane/Dockerfile.goreleaser @@ -1,4 +1,4 @@ -FROM golang:1.25.3@sha256:6bac879c5b77e0fc9c556a5ed8920e89dab1709bd510a854903509c828f67f96 AS builder +FROM golang:1.25.5@sha256:20b91eda7a9627c127c0225b0d4e8ec927b476fa4130c6760928b849d769c149 AS builder FROM scratch diff --git a/app/controlplane/Dockerfile.migrations b/app/controlplane/Dockerfile.migrations index ce71389ea..eb818a65c 100644 --- a/app/controlplane/Dockerfile.migrations +++ b/app/controlplane/Dockerfile.migrations @@ -2,9 +2,9 @@ # See https://atlasgo.io/guides/deploying/image # NOTE: Updated to canary since there is a vulnerability in the latest stable release # from: arigaio/atlas:latest -# docker run arigaio/atlas@sha256:3d12860d684122d74341cb99b0a31f0bf4a78fa223ebc9b32a1260ad6d0dbe95 version -# atlas version v0.38.1-6b73979-canary -FROM arigaio/atlas@sha256:3d12860d684122d74341cb99b0a31f0bf4a78fa223ebc9b32a1260ad6d0dbe95 as base +# docker run arigaio/atlas@sha256:ea3f647b96cf61010deff910c97f8c092deda1db2be3b2b8f20780668bfcf32c version +# atlas version v0.38.1-ce311d2-canary +FROM arigaio/atlas@sha256:ea3f647b96cf61010deff910c97f8c092deda1db2be3b2b8f20780668bfcf32c as base FROM scratch # Update permissions to make it readable by the user diff --git a/common.mk b/common.mk index 9eeba39ca..2deffa20f 100644 --- a/common.mk +++ b/common.mk @@ -9,7 +9,7 @@ init: init-api-tools # in the community version anymore https://github.com/ariga/atlas/issues/2388#issuecomment-1864287189 # install golangci-lint with Go 1.25 support curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$(go env GOPATH)/bin v2.4.0 - curl -sSf https://atlasgo.sh | ATLAS_VERSION=v0.38.0 sh -s -- -y + curl -sSf https://atlasgo.sh | ATLAS_VERSION=v0.38.1 sh -s -- -y # initialize API tooling .PHONY: init-api-tools diff --git a/docs/examples/ci-workflows/github.yaml b/docs/examples/ci-workflows/github.yaml index 89a03dc5d..0f8c32622 100644 --- a/docs/examples/ci-workflows/github.yaml +++ b/docs/examples/ci-workflows/github.yaml @@ -41,7 +41,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v3 with: - go-version: "1.25.3" + go-version: "1.25.5" # Generate SBOM using syft in cycloneDX format - uses: anchore/sbom-action@v0 diff --git a/go.mod b/go.mod index 0a1e20fbc..1ef055b28 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/chainloop-dev/chainloop -go 1.25.3 +go 1.25.5 require ( cloud.google.com/go/secretmanager v1.14.5 From d81418560ab42c435a86fef0c7580f41fd7a28d3 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Date: Thu, 4 Dec 2025 16:13:01 +0100 Subject: [PATCH 2/2] fix: revert Atlas CLI version to v0.38.0 in common.mk The Atlas CLI version v0.38.1 is not available via the atlasgo.sh install script. Reverted to v0.38.0 while keeping the Docker image at v0.38.1. Updated the upgrading-golang skill to include a reminder to always test the curl command before updating the CLI version. Signed-off-by: Miguel Martinez --- .claude/skills/upgrading-golang/SKILL.md | 8 ++++++++ common.mk | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.claude/skills/upgrading-golang/SKILL.md b/.claude/skills/upgrading-golang/SKILL.md index 455700233..962bd387b 100644 --- a/.claude/skills/upgrading-golang/SKILL.md +++ b/.claude/skills/upgrading-golang/SKILL.md @@ -99,6 +99,14 @@ FROM arigaio/atlas@sha256:NEW_DIGEST as base **7c. Update `./common.mk` for `make init`:** +**IMPORTANT**: Before updating the version in common.mk, ALWAYS test that the Atlas version is available via the curl command: + +```bash +curl -sSf https://atlasgo.sh | ATLAS_VERSION=vX.XX.X sh -s -- --version +``` + +If the command fails or the version is not available, do NOT update common.mk. Only the Docker image should be updated in this case. + Update the Atlas CLI installation version in the `init` target: Pattern to replace: diff --git a/common.mk b/common.mk index 2deffa20f..9eeba39ca 100644 --- a/common.mk +++ b/common.mk @@ -9,7 +9,7 @@ init: init-api-tools # in the community version anymore https://github.com/ariga/atlas/issues/2388#issuecomment-1864287189 # install golangci-lint with Go 1.25 support curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $$(go env GOPATH)/bin v2.4.0 - curl -sSf https://atlasgo.sh | ATLAS_VERSION=v0.38.1 sh -s -- -y + curl -sSf https://atlasgo.sh | ATLAS_VERSION=v0.38.0 sh -s -- -y # initialize API tooling .PHONY: init-api-tools