Bump golang from 1.20-alpine to 1.21-alpine

.github/workflows/build.yml

@@ -1,13 +1,24 @@
 name: Build
-on: [push]
+on:
+  push:
+    branches: [ main ]
+    tags: [ 'v*' ]
+  pull_request:
+    branches: [ main ]
 
 jobs:
   test:
     runs-on: ubuntu-latest
     container:
       image: ghcr.io/hairyhenderson/gomplate-ci-build:latest
     steps:
+      - run: |
+          git config --global user.email "bogus@example.com"
+          git config --global user.name "Someone"
+          git config --global --add safe.directory /__w/go-which/go-which
       - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
       - run: make test
       - name: make test
         run: |
@@ -26,9 +37,14 @@ jobs:
     steps:
       - uses: actions/setup-go@v4
         with:
-          go-version: '1.18'
+          go-version: '1.21'
           check-latest: true
+      - run: |
+          git config --global user.email "bogus@example.com"
+          git config --global user.name "Someone"
       - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
       - run: make test
   lint:
     runs-on: ubuntu-latest

.github/workflows/image-scan.yml

@@ -1,12 +1,14 @@
 name: Docker Image Scan
 on:
-  pull_request:
   push:
-    branches:
-      - master
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
 
 jobs:
   docker-build:
+    permissions:
+      security-events: write
     runs-on: ubuntu-latest
     env:
       DOCKER_BUILDKIT: 1
@@ -16,15 +18,25 @@ jobs:
     - name: Quick build (linux/alpine only)
       run: |
         docker build --target alpine -t go-which .
-    - name: Scan with Trivy
+    - name: Run Trivy vulnerability scanner (table output)
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: go-which
+        format: table
+        exit-code: 1
+        ignore-unfixed: true
+        vuln-type: os,library
+        severity: CRITICAL,HIGH
+    - name: Run Trivy vulnerability scanner
       uses: aquasecurity/trivy-action@master
       with:
-        image-ref: 'go-which'
-        format: 'template'
-        template: '@/contrib/sarif.tpl'
-        output: 'trivy-results.sarif'
+        image-ref: go-which
+        format: sarif
+        output: trivy-results.sarif
         exit-code: 1
         ignore-unfixed: true
+        vuln-type: os,library
+        severity: CRITICAL,HIGH
     - name: Upload Trivy scan results to GitHub Security tab
       uses: github/codeql-action/upload-sarif@v2
       with:

.golangci.yml

@@ -1,5 +1,5 @@
 run:
-  go: '1.18'
+  go: '1.21'
 
 linters-settings:
   govet:
@@ -28,7 +28,6 @@ linters:
   enable:
     - asciicheck
     - bodyclose
-    - depguard
     - dogsled
     - dupl
     - errcheck

Dockerfile

@@ -1,6 +1,6 @@
 FROM hairyhenderson/upx:3.96 AS upx
 
-FROM golang:1.20-alpine AS build
+FROM golang:1.21-alpine AS build
 
 RUN apk add --no-cache \
     make \