From f82df062bed465fd6a81476260eff28741e61dc4 Mon Sep 17 00:00:00 2001
From: Michael Valdron <mvaldron@redhat.com>
Date: Fri, 30 May 2025 12:03:38 -0400
Subject: [PATCH 1/6] bump go.mod to go 1.22

Signed-off-by: Michael Valdron <mvaldron@redhat.com>
---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 1931c75..d9008b0 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/devfile/registry-operator
 
-go 1.21
+go 1.22
 
 require (
 	github.com/devfile/registry-support/index/generator v0.0.0-20240816133831-cf509ccd1a6b

From c0570378537832a28cfc1fbd04d425284aed7c1f Mon Sep 17 00:00:00 2001
From: Michael Valdron <mvaldron@redhat.com>
Date: Fri, 30 May 2025 12:07:10 -0400
Subject: [PATCH 2/6] use ubi9 base images with go-toolset 1.22.9 builder

Signed-off-by: Michael Valdron <mvaldron@redhat.com>
---
 Dockerfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 9585598..3778fde 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,8 +14,9 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM golang:1.21@sha256:b405b620c7b53ef64695c7da7c8396f411f381c1eb7da6713c585dd7eca1559b as builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.22.9 as builder
 ARG TARGETARCH=amd64
+USER root
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -41,9 +42,8 @@ ENV ENABLE_WEBHOOKS=${ENABLE_WEBHOOKS}
 ARG ENABLE_WEBHOOK_HTTP2=false
 ENV ENABLE_WEBHOOK_HTTP2=${ENABLE_WEBHOOK_HTTP2}
 
-# Use distroless as minimal base image to package the manager binary
-# Refer to https://github.com/GoogleContainerTools/distroless for more details
-FROM gcr.io/distroless/static:nonroot-${TARGETARCH}
+# Use ubi-micro as minimal base image to package the manager binary
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.6
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 1001

From 63a7e1d2d3e38d04c773109017ca360d94a03e01 Mon Sep 17 00:00:00 2001
From: Michael Valdron <mvaldron@redhat.com>
Date: Fri, 30 May 2025 12:12:54 -0400
Subject: [PATCH 3/6] update go version requirement to 1.22 under README

Signed-off-by: Michael Valdron <mvaldron@redhat.com>
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index d234636..b1b21d2 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ security setups.
 
 ### Development
 
-- Go 1.21.x
+- Go 1.22.x
 - Docker / Podman
 - Operator SDK 1.28.x
 

From a337245c0d01a49abdffce04bcfcd03a7610af84 Mon Sep 17 00:00:00 2001
From: Michael Valdron <mvaldron@redhat.com>
Date: Fri, 30 May 2025 12:14:23 -0400
Subject: [PATCH 4/6] add Go badge to README

Signed-off-by: Michael Valdron <mvaldron@redhat.com>
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index b1b21d2..bc8e3e9 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,7 @@
 
 <div id="header">
 
+[![Go 1.22](https://img.shields.io/badge/1.22-blue?logo=go&labelColor=gray)](https://go.dev/doc/go1.22)
 [![Apache2.0 License](https://img.shields.io/badge/license-Apache2.0-brightgreen.svg)](LICENSE)
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/8256/badge)](https://www.bestpractices.dev/projects/8256)
 [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/devfile/registry-operator/badge)](https://securityscorecards.dev/viewer/?uri=github.com/devfile/registry-operator)

From 7966a5b91426ab9c3e984b0a231e93c0a9fcb540 Mon Sep 17 00:00:00 2001
From: Michael Valdron <mvaldron@redhat.com>
Date: Fri, 30 May 2025 12:30:23 -0400
Subject: [PATCH 5/6] update gosec to v2.22.0

Signed-off-by: Michael Valdron <mvaldron@redhat.com>
---
 .github/workflows/ci.yaml | 2 +-
 Makefile                  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 602f9ae..f76b736 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -80,7 +80,7 @@ jobs:
 
       - name: Run Gosec Security Scanner
         run: |
-          go install github.com/securego/gosec/v2/cmd/gosec@1af1d5bb49259b62e45c505db397dd2ada5d74f8
+          go install github.com/securego/gosec/v2/cmd/gosec@e0cca6fe95306b7e7790d6f1bf6a7bec6d622459 # v2.22.0
           make gosec
           if [[ $? != 0 ]]
           then
diff --git a/Makefile b/Makefile
index dd1ac06..5ae8480 100644
--- a/Makefile
+++ b/Makefile
@@ -340,5 +340,5 @@ bundle-push:
 .PHONY: gosec
 gosec:
 	# Run this command to install gosec, if not installed:
-	# go install github.com/securego/gosec/v2/cmd/gosec@v2.14.0
+	# go install github.com/securego/gosec/v2/cmd/gosec@v2.22.0
 	gosec -no-fail -fmt=sarif -out=gosec.sarif -exclude-dir pkg/test -exclude-dir tests ./...

From 6391530ed14e8b0aeb638a4d91ea70770941bf5b Mon Sep 17 00:00:00 2001
From: Michael Valdron <mvaldron@redhat.com>
Date: Fri, 30 May 2025 15:27:15 -0400
Subject: [PATCH 6/6] pin base images using list digests

Signed-off-by: Michael Valdron <mvaldron@redhat.com>
---
 Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 3778fde..3614e26 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,7 +14,7 @@
 # limitations under the License.
 
 # Build the manager binary
-FROM registry.access.redhat.com/ubi9/go-toolset:1.22.9 as builder
+FROM registry.access.redhat.com/ubi9/go-toolset:1.22.9@sha256:e4193e71ea9f2e2504f6b4ee93cadef0fe5d7b37bba57484f4d4229801a7c063 as builder
 ARG TARGETARCH=amd64
 USER root
 
@@ -43,7 +43,7 @@ ARG ENABLE_WEBHOOK_HTTP2=false
 ENV ENABLE_WEBHOOK_HTTP2=${ENABLE_WEBHOOK_HTTP2}
 
 # Use ubi-micro as minimal base image to package the manager binary
-FROM registry.access.redhat.com/ubi9/ubi-micro:9.6
+FROM registry.access.redhat.com/ubi9/ubi-micro:9.6@sha256:955512628a9104d74f7b3b0a91db27a6bbecdd6a1975ce0f1b2658d3cd060b98
 WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 1001