Dependency updates (#3)

* chore(dotnet): Update dotnet docker image to chiseled version

* ci(gha): ⬆️ Add dependabot for gha & bump actions

* build(connect): ⬆️ Upgrade to go 1.22 & bump dependencies

Including fixes for breaking changes introduced in newer connect opentelemetry versions

* ci: Add test pipeline for pr's

* build(dotnet): Bump dotnet server dependencies

* ci: fix pr checks

* ci(connect): Add cache path for go setup

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5

.github/workflows/build-connect-container.yml

@@ -16,13 +16,13 @@ jobs:
     permissions:
       contents: read
       packages: write
-      # 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: '1.21.x'
-      - uses: ko-build/setup-ko@2788447382c56bf12a5122143c63f3a70c591634
+          go-version: '1.22.x'
+          cache-dependency-path: ./connect/go.mod
+      - uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa #v0.6
       - run: ko build ./cmd/connect --base-import-paths
         working-directory: ./connect

.github/workflows/build-dotnet-container.yml

@@ -28,15 +28,15 @@ jobs:
         uses: actions/checkout@v4
       # Uses the `docker/login-action` action to log in to the Container registry registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
       - name: Log in to the Container registry
-        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 #v3.1.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image. The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 #v5.5.1
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -46,7 +46,7 @@ jobs:
       # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
       # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
       - name: Build and push Docker image
-        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 #v5.3.0
         with:
           context: .
           target: release

.github/workflows/pr-checks.yml

@@ -0,0 +1,37 @@
+name: PR Checks
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  verify-connect:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.x
+          cache-dependency-path: ./connect/go.mod
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 #v4.0.0
+        with:
+          version: v1.57.2
+          working-directory: ./connect/
+
+
+  verify-dotnet:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: 8.0.x
+      - name: .NET Build
+        working-directory: ./dotnet/server
+        run: dotnet build --configuration Release

Dockerfile

@@ -24,14 +24,14 @@ FROM build AS publish
 ARG BUILD_CONFIGURATION=Release
 RUN dotnet publish "./server.csproj" -c $BUILD_CONFIGURATION -o /app/publish /p:UseAppHost=true
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:8.0 AS final
+FROM mcr.microsoft.com/dotnet/runtime-deps:8.0-jammy-chiseled AS final
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8081
 COPY --from=publish /app/publish .
 ENTRYPOINT ["./server"]
 
-FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS release
+FROM mcr.microsoft.com/dotnet/aspnet:8.0-jammy-chiseled AS release
 WORKDIR /app
 EXPOSE 8080
 EXPOSE 8081

connect/cmd/connect/main.go

@@ -33,11 +33,17 @@ func main() {
 		err = errors.Join(err, otelShutdown(context.Background()))
 	}()
 
+	// Create the connect OpenTelemetry interceptor.
+	otelInterceptor, err := otelconnect.NewInterceptor()
+	if err != nil {
+		slog.Error("Failed to create OpenTelemetry interceptor", "error", err)
+	}
+
 	// Setup the generic service and the handler for the generic API.
 	genericService := generic.NewGenericService()
 	mux := http.NewServeMux()
 	path, handler := genericv1connect.NewGenericServiceHandler(genericService, connect.WithInterceptors(
-		otelconnect.NewInterceptor(),
+		otelInterceptor,
 	))
 	mux.Handle(path, handler)
 
@@ -79,5 +85,4 @@ func main() {
 	// When Shutdown is called, ListenAndServe immediately returns ErrServerClosed.
 	err = srv.Shutdown(context.Background())
 	slog.Info("Server stopped")
-	return
 }

connect/go.mod

@@ -1,45 +1,43 @@
 module github.com/themerski/dotnet-vs-go/connect
 
-go 1.21.4
+go 1.22.2
 
 require (
-	connectrpc.com/connect v1.12.0
-	github.com/prometheus/client_golang v1.17.0
-	go.opentelemetry.io/otel v1.21.0
-	go.opentelemetry.io/otel/exporters/prometheus v0.44.0
-	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.21.0
-	go.opentelemetry.io/otel/sdk v1.21.0
-	go.opentelemetry.io/otel/sdk/metric v1.21.0
-	golang.org/x/net v0.19.0
+	connectrpc.com/connect v1.16.0
+	github.com/prometheus/client_golang v1.19.0
+	go.opentelemetry.io/otel v1.25.0
+	go.opentelemetry.io/otel/exporters/prometheus v0.47.0
+	go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.25.0
+	go.opentelemetry.io/otel/sdk v1.25.0
+	go.opentelemetry.io/otel/sdk/metric v1.25.0
+	golang.org/x/net v0.24.0
 	google.golang.org/protobuf v1.33.0
 )
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/go-logr/logr v1.3.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.16.0 // indirect
-	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.44.0 // indirect
-	github.com/prometheus/procfs v0.11.1 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.21.0 // indirect
-	go.opentelemetry.io/otel/metric v1.21.0 // indirect
-	go.opentelemetry.io/otel/trace v1.21.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.0.0 // indirect
-	golang.org/x/sys v0.15.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20230822172742-b8732ec3820d // indirect
-	google.golang.org/grpc v1.59.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.52.3 // indirect
+	github.com/prometheus/procfs v0.13.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.25.0 // indirect
+	go.opentelemetry.io/otel/metric v1.25.0 // indirect
+	go.opentelemetry.io/otel/trace v1.25.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.2.0 // indirect
+	golang.org/x/sys v0.19.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240412170617-26222e5d3d56 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240412170617-26222e5d3d56 // indirect
+	google.golang.org/grpc v1.63.2 // indirect
 )
 
 require (
 	connectrpc.com/grpcreflect v1.2.0
-	connectrpc.com/otelconnect v0.6.0
-	github.com/google/uuid v1.4.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.21.0
+	connectrpc.com/otelconnect v0.7.0
+	github.com/google/uuid v1.6.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.25.0
 	golang.org/x/text v0.14.0 // indirect
 )