Use Go modules system to manage Gon tool dependency

The Gon tool is used to notarize the macOS release builds.

This tool is built on the Go module framework. Support for managing Go module-based tool dependencies has been added to
Go, and that is now used for all such tool dependencies in this project.

Author: per1234

.github/workflows/publish-go-nightly-task.yml

@@ -111,6 +111,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
       - name: Download artifacts
         uses: actions/download-artifact@v6
         with:
@@ -151,16 +156,6 @@ jobs:
             -k "${{ env.KEYCHAIN_PASSWORD }}" \
             "${{ env.KEYCHAIN }}"
 
-      - name: Install gon for code signing and app notarization
-        run: |
-          wget \
-            -q \
-            https://github.com/Bearer/gon/releases/download/v0.0.27/gon_macos.zip
-
-          unzip \
-            gon_macos.zip \
-            -d /usr/local/bin
-
       - name: Write gon config to file
         # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
         run: |
@@ -187,7 +182,8 @@ jobs:
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
         run: |
-          gon "${{ env.GON_CONFIG_PATH }}"
+          go tool \
+            github.com/bearer/gon/cmd/gon "${{ env.GON_CONFIG_PATH }}"
 
       - name: Re-package binary
         working-directory: ${{ env.DIST_DIR }}

.github/workflows/release-go-task.yml

@@ -111,6 +111,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v5
 
+      - name: Install Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
       - name: Download artifacts
         uses: actions/download-artifact@v6
         with:
@@ -151,15 +156,6 @@ jobs:
             -k "${{ env.KEYCHAIN_PASSWORD }}" \
             "${{ env.KEYCHAIN }}"
 
-      - name: Install gon for code signing and app notarization
-        run: |
-          wget \
-            -q https://github.com/Bearer/gon/releases/download/v0.0.27/gon_macos.zip
-
-          unzip \
-            gon_macos.zip \
-            -d /usr/local/bin
-
       - name: Write gon config to file
         # gon does not allow env variables in config file (https://github.com/mitchellh/gon/issues/20)
         run: |
@@ -186,7 +182,8 @@ jobs:
           AC_PASSWORD: ${{ secrets.AC_PASSWORD }}
           AC_PROVIDER: ${{ secrets.AC_PROVIDER }}
         run: |
-          gon "${{ env.GON_CONFIG_PATH }}"
+          go tool \
+            github.com/bearer/gon/cmd/gon "${{ env.GON_CONFIG_PATH }}"
 
       - name: Re-package binary
         working-directory: ${{ env.DIST_DIR }}

go.mod

@@ -31,9 +31,12 @@ require (
 	github.com/OneOfOne/xxhash v1.2.8 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
 	github.com/a8m/envsubst v1.4.3 // indirect
+	github.com/agext/levenshtein v1.2.1 // indirect
 	github.com/alecthomas/chroma/v2 v2.20.0 // indirect
 	github.com/alecthomas/participle/v2 v2.1.4 // indirect
+	github.com/apparentlymart/go-textseg v1.0.0 // indirect
 	github.com/arduino/go-win32-utils v1.0.0 // indirect
+	github.com/bearer/gon v0.0.37 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/chainguard-dev/git-urls v1.0.2 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
@@ -65,9 +68,14 @@ require (
 	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/h2non/filetype v1.1.3 // indirect
+	github.com/hashicorp/errwrap v1.0.0 // indirect
+	github.com/hashicorp/go-hclog v1.5.0 // indirect
+	github.com/hashicorp/go-multierror v1.0.0 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/hcl/v2 v2.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jandelgado/gcov2lcov v1.0.4 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
@@ -86,6 +94,7 @@ require (
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mattn/go-zglob v0.0.6 // indirect
 	github.com/mikefarah/yq/v4 v4.48.1 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
@@ -119,6 +128,7 @@ require (
 	github.com/ulikunitz/xz v0.5.15 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/yuin/gopher-lua v1.1.1 // indirect
+	github.com/zclconf/go-cty v1.1.0 // indirect
 	github.com/zeebo/xxh3 v1.0.2 // indirect
 	go.bug.st/cleanup v1.0.0 // indirect
 	go.bug.st/downloader/v2 v2.1.1 // indirect
@@ -146,10 +156,12 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	howett.net/plist v0.0.0-20181124034731-591f970eefbb // indirect
 	mvdan.cc/sh/v3 v3.10.0 // indirect
 )
 
 tool (
+	github.com/bearer/gon/cmd/gon
 	github.com/go-bindata/go-bindata/go-bindata
 	github.com/go-task/task/v3/cmd/task
 	github.com/mikefarah/yq/v4