chore: bump dependencies, bump Go to v1.23

.github/workflows/publish/action.yml

@@ -75,9 +75,9 @@ runs:
         ./scripts/sign.sh ./dist/spacelift-vcs-agent_linux_amd64_v1 spacelift-vcs-agent
         ./scripts/verify.sh ./dist/spacelift-vcs-agent_linux_amd64_v1 spacelift-vcs-agent
 
-        chmod 755 ./dist/spacelift-vcs-agent_linux_arm64/spacelift-vcs-agent
-        ./scripts/sign.sh ./dist/spacelift-vcs-agent_linux_arm64 spacelift-vcs-agent
-        ./scripts/verify.sh ./dist/spacelift-vcs-agent_linux_arm64 spacelift-vcs-agent
+        chmod 755 ./dist/spacelift-vcs-agent_linux_arm64_v8.0/spacelift-vcs-agent
+        ./scripts/sign.sh ./dist/spacelift-vcs-agent_linux_arm64_v8.0 spacelift-vcs-agent
+        ./scripts/verify.sh ./dist/spacelift-vcs-agent_linux_arm64_v8.0 spacelift-vcs-agent
       env:
         GPG_KEY_ID: ${{ inputs.gpg_key_id }}
         GPG_PASSPHRASE: ${{ inputs.gpg_passphrase }}
@@ -94,9 +94,9 @@ runs:
         cp dist/spacelift-vcs-agent_linux_amd64_v1/spacelift-vcs-agent_SHA256SUMS build/spacelift-vcs-agent-x86_64_SHA256SUMS
         cp dist/spacelift-vcs-agent_linux_amd64_v1/spacelift-vcs-agent_SHA256SUMS.sig build/spacelift-vcs-agent-x86_64_SHA256SUMS.sig
 
-        cp dist/spacelift-vcs-agent_linux_arm64/spacelift-vcs-agent build/spacelift-vcs-agent-aarch64
-        cp dist/spacelift-vcs-agent_linux_arm64/spacelift-vcs-agent_SHA256SUMS build/spacelift-vcs-agent-aarch64_SHA256SUMS
-        cp dist/spacelift-vcs-agent_linux_arm64/spacelift-vcs-agent_SHA256SUMS.sig build/spacelift-vcs-agent-aarch64_SHA256SUMS.sig
+        cp dist/spacelift-vcs-agent_linux_arm64_v8.0/spacelift-vcs-agent build/spacelift-vcs-agent-aarch64
+        cp dist/spacelift-vcs-agent_linux_arm64_v8.0/spacelift-vcs-agent_SHA256SUMS build/spacelift-vcs-agent-aarch64_SHA256SUMS
+        cp dist/spacelift-vcs-agent_linux_arm64_v8.0/spacelift-vcs-agent_SHA256SUMS.sig build/spacelift-vcs-agent-aarch64_SHA256SUMS.sig
 
         # For visibility, here's the list of files we're uploading:
         ls -l build

.github/workflows/trivy.yml

@@ -28,7 +28,7 @@ jobs:
           repository_url: "ghcr.io/spacelift-io/vcs-agent"
 
       - name: Run Trivy vulnerability scanner (amd64)
-        uses: aquasecurity/trivy-action@0.27.0
+        uses: aquasecurity/trivy-action@0.29.0
         with:
           image-ref: "ghcr.io/spacelift-io/vcs-agent:${{ fromJson(steps.goreleaser.outputs.metadata).version }}-amd64"
           format: "sarif"
@@ -38,7 +38,7 @@ jobs:
           TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
 
       - name: Run Trivy vulnerability scanner (arm64)
-        uses: aquasecurity/trivy-action@0.27.0
+        uses: aquasecurity/trivy-action@0.29.0
         with:
           image-ref: "ghcr.io/spacelift-io/vcs-agent:${{ fromJson(steps.goreleaser.outputs.metadata).version }}-arm64"
           format: "sarif"

cmd/spacelift-vcs-agent/main.go

@@ -16,7 +16,7 @@ import (
 	"github.com/bugsnag/bugsnag-go/v2"
 	"github.com/go-kit/log"
 	"github.com/spacelift-io/spcontext"
-	"github.com/urfave/cli"
+	"github.com/urfave/cli/v2"
 
 	"github.com/spacelift-io/vcs-agent/agent"
 	"github.com/spacelift-io/vcs-agent/logging"
@@ -47,76 +47,76 @@ var (
 		vendorGitlab,
 	}
 
-	flagAllowedProjects = cli.StringFlag{
-		Name:   "allowed-projects",
-		EnvVar: "SPACELIFT_VCS_AGENT_ALLOWED_PROJECTS",
-		Usage:  "Regexp matching allowed projects for API calls. Projects are in the form: 'group/repository'.",
-		Value:  ".*",
+	flagAllowedProjects = &cli.StringFlag{
+		Name:    "allowed-projects",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_ALLOWED_PROJECTS"},
+		Usage:   "Regexp matching allowed projects for API calls. Projects are in the form: 'group/repository'.",
+		Value:   ".*",
 	}
 
-	flagBugsnagAPIKey = cli.StringFlag{
-		Name:   "bugsnag-api-key",
-		EnvVar: "SPACELIFT_VCS_AGENT_BUGSNAG_API_KEY",
-		Usage:  "Override the Bugsnag API key used for error reporting.",
-		Value:  "",
+	flagBugsnagAPIKey = &cli.StringFlag{
+		Name:    "bugsnag-api-key",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_BUGSNAG_API_KEY"},
+		Usage:   "Override the Bugsnag API key used for error reporting.",
+		Value:   "",
 	}
 
-	flagBugsnagDisable = cli.BoolFlag{
-		Name:   "disable-bugsnag",
-		EnvVar: "SPACELIFT_VCS_AGENT_BUGSNAG_DISABLE",
-		Usage:  "Disable Bugsnag reporting entirely.",
+	flagBugsnagDisable = &cli.BoolFlag{
+		Name:    "disable-bugsnag",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_BUGSNAG_DISABLE"},
+		Usage:   "Disable Bugsnag reporting entirely.",
 	}
 
-	flagParallelism = cli.IntFlag{
-		Name:   "parallelism",
-		EnvVar: "SPACELIFT_VCS_AGENT_PARALLELISM",
-		Usage:  "Number of streams to create. Each stream can handle one request simultaneously.",
-		Value:  4,
+	flagParallelism = &cli.IntFlag{
+		Name:    "parallelism",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_PARALLELISM"},
+		Usage:   "Number of streams to create. Each stream can handle one request simultaneously.",
+		Value:   4,
 	}
 
-	flagPoolToken = cli.StringFlag{
+	flagPoolToken = &cli.StringFlag{
 		Name:     "token",
-		EnvVar:   "SPACELIFT_VCS_AGENT_POOL_TOKEN",
+		EnvVars:  []string{"SPACELIFT_VCS_AGENT_POOL_TOKEN"},
 		Usage:    "Token received on VCS Agent Pool creation",
 		Required: true,
 	}
 
-	flagTargetBaseEndpoint = cli.StringFlag{
+	flagTargetBaseEndpoint = &cli.StringFlag{
 		Name:     "target-base-endpoint",
-		EnvVar:   "SPACELIFT_VCS_AGENT_TARGET_BASE_ENDPOINT",
+		EnvVars:  []string{"SPACELIFT_VCS_AGENT_TARGET_BASE_ENDPOINT"},
 		Usage:    "Target endpoint this agent proxies to. Should include protocol (http/https).",
 		Required: true,
 	}
 
-	flagVCSVendor = cli.StringFlag{
+	flagVCSVendor = &cli.StringFlag{
 		Name:     "vendor",
-		EnvVar:   "SPACELIFT_VCS_AGENT_VENDOR",
+		EnvVars:  []string{"SPACELIFT_VCS_AGENT_VENDOR"},
 		Usage:    fmt.Sprintf("VCS vendor proxied by this agent. Available vendors: %s", strings.Join(availableVendors, ", ")),
 		Required: true,
 	}
 
-	flagUseAllowlist = cli.BoolFlag{
-		Name:   "use-allowlist",
-		EnvVar: "SPACELIFT_VCS_AGENT_USE_ALLOWLIST",
-		Usage:  "Whether to use the allowlist to validate API calls. Incompatible with --blocklist-path.",
+	flagUseAllowlist = &cli.BoolFlag{
+		Name:    "use-allowlist",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_USE_ALLOWLIST"},
+		Usage:   "Whether to use the allowlist to validate API calls. Incompatible with --blocklist-path.",
 	}
 
-	flagBlocklistPath = cli.StringFlag{
-		Name:   "blocklist-path",
-		EnvVar: "SPACELIFT_VCS_AGENT_BLOCKLIST_PATH",
-		Usage:  "Path to the YAML blocklist file. Incompatible with --use-allowlist.",
+	flagBlocklistPath = &cli.StringFlag{
+		Name:    "blocklist-path",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_BLOCKLIST_PATH"},
+		Usage:   "Path to the YAML blocklist file. Incompatible with --use-allowlist.",
 	}
 
-	flagDebugPrintAll = cli.BoolFlag{
-		Name:   "debug-print-all",
-		EnvVar: "SPACELIFT_VCS_AGENT_DEBUG_PRINT_ALL",
-		Usage:  "Whether to print all requests and responses to stdout.",
+	flagDebugPrintAll = &cli.BoolFlag{
+		Name:    "debug-print-all",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_DEBUG_PRINT_ALL"},
+		Usage:   "Whether to print all requests and responses to stdout.",
 	}
 
-	flagHTTPDisableResponseCompression = cli.BoolFlag{
-		Name:   "http-disable-response-compression",
-		EnvVar: "SPACELIFT_VCS_AGENT_HTTP_DISABLE_RESPONSE_COMPRESSION",
-		Usage:  "Whether to disable HTTP response compression.",
+	flagHTTPDisableResponseCompression = &cli.BoolFlag{
+		Name:    "http-disable-response-compression",
+		EnvVars: []string{"SPACELIFT_VCS_AGENT_HTTP_DISABLE_RESPONSE_COMPRESSION"},
+		Usage:   "Whether to disable HTTP response compression.",
 	}
 )
 

go.mod

@@ -1,35 +1,36 @@
 module github.com/spacelift-io/vcs-agent
 
-go 1.22
+go 1.23
 
 require (
-	github.com/bugsnag/bugsnag-go/v2 v2.5.0
+	github.com/bugsnag/bugsnag-go/v2 v2.5.1
 	github.com/franela/goblin v0.0.0-20211003143422-0a4f594942bf
 	github.com/go-kit/log v0.2.1
 	github.com/kr/text v0.2.0
-	github.com/onsi/gomega v1.33.1
+	github.com/onsi/gomega v1.36.0
 	github.com/pkg/errors v0.9.1
-	github.com/spacelift-io/spcontext v0.0.4
-	github.com/stretchr/testify v1.9.0
-	github.com/urfave/cli v1.22.15
-	google.golang.org/grpc v1.65.0
-	google.golang.org/protobuf v1.34.2
+	github.com/spacelift-io/spcontext v0.0.6
+	github.com/stretchr/testify v1.10.0
+	github.com/urfave/cli/v2 v2.27.5
+	google.golang.org/grpc v1.68.1
+	google.golang.org/protobuf v1.35.2
 	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
 	github.com/bugsnag/panicwrap v1.3.4 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-logfmt/logfmt v0.5.1 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/go-grpc-middleware v1.3.0 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	golang.org/x/net v0.30.0 // indirect
+	golang.org/x/sys v0.27.0 // indirect
+	golang.org/x/text v0.19.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240903143218-8af14fe29dc1 // indirect
 )