[security] bump go deps, go version

.github/workflows/golangci-lint.yml

@@ -6,23 +6,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.16
+          go-version: 1.23.3
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Check go mod
         run: |
           go mod tidy
           git diff --exit-code go.mod
   golangci-lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: lint
-        uses: golangci/golangci-lint-action@v2.5.2
+        uses: golangci/golangci-lint-action@v6.5.0
         with:
-          version: latest
-          # skip cache because of flaky behaviors
-          skip-build-cache: true
-          skip-pkg-cache: true
+          version: 'v1.64.5'

.github/workflows/release.yml

@@ -8,13 +8,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.16
+          go-version: 1.23.3
       - name: Import GPG key
         id: import_gpg
         uses: crazy-max/ghaction-import-gpg@v3
@@ -28,4 +28,4 @@ jobs:
           args: release --rm-dist
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}
+          GPG_FINGERPRINT: ${{ steps.import_gpg.outputs.fingerprint }}

.github/workflows/test.yml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.16
+          go-version: 1.23.3
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@master
+        uses: google-github-actions/setup-gcloud@main
         with:
           project_id: ${{ secrets.GCP_PROJECT_ID }}
           service_account_key: ${{ secrets.GCP_SA_KEY }}
@@ -23,8 +23,8 @@ jobs:
         uses: azure/setup-kubectl@v3
         id: install
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - name: Test
         env:
           GOOGLE_APPLICATION_CREDENTIALS: ""
-        run: go test ./cmd/...
+        run: go test ./cmd/...

.gitignore

@@ -59,3 +59,4 @@ scripts/
 
 # Ignore nix output
 result
+/ephemeral-iam

.golangci.yml

@@ -15,7 +15,8 @@ linters-settings:
     lines: 100
     statements: 50
   gci:
-    local-prefixes: github.com/rigup/ephemeral-iam
+    sections:
+     - prefix(github.com/rigup/ephemeral-iam)
   goconst:
     min-len: 2
     min-occurrences: 2
@@ -44,29 +45,14 @@ linters-settings:
       - FIXME
       - NOTE
       - OPTIMIZE # marks code that should be optimized before merging
-      - HACK # marks hack-arounds that should be removed before merging  
+      - HACK # marks hack-arounds that should be removed before merging
   goimports:
     local-prefixes: github.com/rigup/ephemeral-iam
-  golint:
-    min-confidence: 0
-  gomnd:
-    settings:
-      mnd:
-        checks: argument,case,return
-  govet:
-    check-shadowing: true
-  ifshort:
-    max-decl-lines: 1
-    # Maximum length of variable declaration measured in number of characters, after which linter won't suggest using short syntax.
-    max-decl-chars: 30
   lll:
     line-length: 120
-  maligned:
-    suggest-new: true
   misspell:
     locale: US
   nolintlint:
-    allow-leading-space: true # don't require machine-readable nolint directives (i.e. with no leading space)
     allow-unused: false # report any unused nolint directives
     require-explanation: false # don't require an explanation for nolint directives
     require-specific: false # don't require nolint directives to be specific about which linter is being skipped
@@ -78,12 +64,10 @@ linters:
   disable-all: true
   enable:
     - bodyclose
-    - deadcode
-    - depguard
+    # - depguard
     - dogsled
     - dupl
     - errcheck
-    - exportloopref
     - exhaustive
     - funlen
     - goconst
@@ -94,7 +78,6 @@ linters:
     # - godox
     - gofmt
     - goimports
-    - golint
     #- gomnd failing with magic numbers
     - goprintffuncname
     - gosec
@@ -108,13 +91,11 @@ linters:
     - nolintlint
     - rowserrcheck
     - staticcheck
-    - structcheck
     - stylecheck
     - typecheck
     - unconvert
     - unparam
     - unused
-    - varcheck
     - whitespace
     # don't enable:
     # - asciicheck
@@ -144,7 +125,9 @@ run:
 ###############################################################################
 output:
   # colored-line-number|line-number|json|tab|checkstyle|code-climate|junit-xml|github-actions
-  format: tab
+  formats:
+    - format: tab
+      path: stdout
   sort-results: true
 
 ###############################################################################
@@ -161,7 +144,6 @@ issues:
       linters:
         - errcheck
         - dupl
-        - gomnd
         - gosec
     - path: cmd
       linters:
@@ -202,4 +184,4 @@ severity:
     - linters:
       - dupl
       - godox
-      severity: info
+      severity: info

cmd/eiam/config.go

@@ -17,7 +17,7 @@ package eiam
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"strconv"
 	"strings"
 
@@ -117,7 +117,7 @@ func newCmdConfigPrint() *cobra.Command {
 		Short: "Print the current configuration",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			configFile := viper.ConfigFileUsed()
-			data, err := ioutil.ReadFile(configFile)
+			data, err := os.ReadFile(configFile)
 			if err != nil {
 				return errorsutil.New("Failed to read configuration file", err)
 			}
@@ -162,7 +162,7 @@ func newCmdConfigView() *cobra.Command {
 	cmd := &cobra.Command{
 		Use:       "view",
 		Short:     "View the value of a provided config item",
-		Args:      cobra.ExactValidArgs(1),
+		Args:      cobra.MatchAll(cobra.ExactArgs(1), cobra.OnlyValidArgs),
 		ValidArgs: viper.AllKeys(),
 		Run: func(cmd *cobra.Command, args []string) {
 			val := viper.Get(args[0])

eiam.go

@@ -15,9 +15,9 @@
 package main
 
 import (
-	"github.com/replit/ephemeral-iam/cmd/eiam"
-	"github.com/replit/ephemeral-iam/internal/appconfig"
-	errorsutil "github.com/replit/ephemeral-iam/internal/errors"
+	"github.com/replit/ephemeral-iam/cmd/eiam"                   //nolint: depguard
+	"github.com/replit/ephemeral-iam/internal/appconfig"         //nolint: depguard
+	errorsutil "github.com/replit/ephemeral-iam/internal/errors" //nolint: depguard
 )
 
 func main() {
@@ -30,11 +30,12 @@ func main() {
 
 	rootCmd, err := eiam.NewEphemeralIamCommand()
 	errorsutil.CheckError(err)
+
 	// Kill the loaded plugin clients. This is happening here to ensure that
 	// Kill is called after the command has finished running, but also accounts
 	// for any errors that occur during execution.
 	for _, plugin := range rootCmd.Plugins {
-		defer plugin.Client.Kill()
+		defer plugin.Client.Kill() //nolint: gocritic
 	}
 	errorsutil.CheckError(rootCmd.Execute())
 }

flake.nix

@@ -2,7 +2,7 @@
   description = "Ephemeral IAM";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
     flake-utils.url = "github:numtide/flake-utils";
   };
 
@@ -13,11 +13,11 @@
      in {
         packages.default = pkgs.buildGoModule rec {
           pname = "ephemeral-iam";
-          version = "0.0.22";
+          version = "0.0.23";
 
           src = ./.;
 
-          vendorHash = "sha256-iJe97gPFTVmiFbHNEqhrA+xqFyXO8kz7K69wm8IJ+AE=";
+          vendorHash = "sha256-MA3ZDeXp+XvxMkUZ/OD4c7wSSQlPdJ1Ct3Vw+vN1ia8=";
 
           buildInputs = [ pkgs.makeWrapper ];
           postInstall = ''