chore(ci): bootstrap oras for use in ci (#469)

* chore(ci): bootstrap oras for use in ci Signed-off-by: Weston Steimel <[email protected]> * chore: update dependabot config Signed-off-by: Weston Steimel <[email protected]> * port tool management to binny Signed-off-by: Alex Goodman <[email protected]> --------- Signed-off-by: Weston Steimel <[email protected]> Signed-off-by: Alex Goodman <[email protected]> Co-authored-by: Alex Goodman <[email protected]>
anchore · Jan 17, 2025 · 6fd8427 · 6fd8427
1 parent 681692e
commit 6fd8427
Show file tree

Hide file tree

Showing 13 changed files with 168 additions and 457 deletions.
diff --git a/.binny.yaml b/.binny.yaml
@@ -0,0 +1,72 @@
+tools:
+  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
+  - name: binny
+    version:
+      want: v0.8.0
+    method: github-release
+    with:
+      repo: anchore/binny
+
+  # used for linting
+  - name: golangci-lint
+    version:
+      want: v1.63.4
+    method: github-release
+    with:
+      repo: golangci/golangci-lint
+
+  # used for showing the changelog at release
+  - name: glow
+    version:
+      want: v2.0.0
+    method: github-release
+    with:
+      repo: charmbracelet/glow
+
+  # used to release all artifacts
+  - name: goreleaser
+    version:
+      want: v1.26.2
+    method: github-release
+    with:
+      repo: goreleaser/goreleaser
+
+  # used for organizing imports during static analysis
+  - name: gosimports
+    version:
+      want: v0.3.8
+    method: github-release
+    with:
+      repo: rinchsan/gosimports
+
+  # used at release to generate the changelog
+  - name: chronicle
+    version:
+      want: v0.8.0
+    method: github-release
+    with:
+      repo: anchore/chronicle
+
+  # used during static analysis for license compliance
+  - name: bouncer
+    version:
+      want: v0.4.0
+    method: github-release
+    with:
+      repo: wagoodman/go-bouncer
+
+  # used for triggering a release
+  - name: gh
+    version:
+      want: v2.65.0
+    method: github-release
+    with:
+      repo: cli/cli
+
+  # used to upload test fixture cache
+  - name: oras
+    version:
+      want: v1.2.2
+    method: github-release
+    with:
+      repo: oras-project/oras
diff --git a/.github/actions/bootstrap/action.yaml b/.github/actions/bootstrap/action.yaml
@@ -86,12 +86,12 @@ runs:
       run: make bootstrap-python
 
     - name: Restore tool cache
-      id: tool-cache
-      uses: actions/cache@v3
       if: inputs.tools == 'true'
+      id: tool-cache
+      uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
       with:
-        path: ${{ github.workspace }}/.tmp
-        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
+        path: ${{ github.workspace }}/.tool
+        key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}
 
     # note: we need to keep restoring the go mod cache before bootstrapping tools since `go install` is used in
     # some installations of project tools.

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,10 +1,25 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
+  - package-ecosystem: gomod
     directory: "/"
     schedule:
-      interval: daily
-  - package-ecosystem: "gomod"
+      interval: "daily"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: daily
+      interval: "daily"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/.github/actions/boostrap"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"