BUILD/MINOR: ci: align community checks and pin tooling

.github/workflows/actions.yml

@@ -1,26 +1,27 @@
 name: CI
 on: [push, pull_request]
+permissions:
+  contents: read
+  pull-requests: read
 jobs:
   check:
     if: ${{ github.event_name == 'pull_request' }}
     name: HAProxy check commit message
     runs-on: ubuntu-latest
     steps:
       - name: commit-check
-        uses: docker://ghcr.io/haproxytech/commit-check:5.2.0
+        uses: docker://ghcr.io/haproxytech/commit-check:5.7.1
         env:
           API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   generate-specification:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v7.0.0
       with:
         go-version-file: "go.mod"
-        check-latest: true
-      id: go
     - name: Compare
       run: |
         go run cmd/specification/*.go -file specification/haproxy-spec.yaml > specification/build/haproxy_spec_to_compare.yaml
@@ -33,77 +34,59 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7.0.0
         with:
           go-version-file: "go.mod"
-          check-latest: true
       - name: clearing models
         run: find models -maxdepth 1 -type f -name "*.go" -exec rm -f {} \;
       - name: generating models
         run: make models
       - name: changes
-        run: test -z "$(git diff 2> /dev/null)" || exit "Models are not generated, issue \`make models equal\` and commit the result"
+        run: git diff --exit-code || { echo "::error::Models are not generated, run \`make models\` and commit the result"; exit 1; }
       - name: untracked files
-        run: test -z "$(git ls-files --others --exclude-standard 2> /dev/null)" || exit "Models generation created untracked files, cannot proceed"
+        run: |
+          files="$(git ls-files --others --exclude-standard)"
+          if [ -n "$files" ]; then
+            echo "$files"
+            echo "::error::Models generation created untracked files, cannot proceed"
+            exit 1
+          fi
   lint:
     name: golangci-lint
-    needs: ["generate-specification","generate-models"]
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7.0.0
         with:
           go-version-file: "go.mod"
-          check-latest: true
-      - uses: actions/cache@v4
-        id: go-cache
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
       - name: Lint
         run: |
           make lint
   lint-spec:
-    needs: ["generate-specification","generate-models"]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v7.0.1
       - name: yaml-lint
-        uses: ibiqlik/action-yamllint@master
+        uses: ibiqlik/action-yamllint@v3.1.1
         with:
           file_or_dir: .
           config_file: .yamllint.yml
   license:
     name: license-check
-    needs: ["generate-specification","generate-models"]
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7.0.0
         with:
           go-version-file: "go.mod"
-          check-latest: true
-      - uses: actions/cache@v4
-        id: go-cache
-        with:
-          path: |
-            ~/.cache/go-build
-            ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-
       - name: go-licenses install
-        run: go install github.com/google/go-licenses@latest
+        run: make go-licenses
       - name: Check Licenses
         run: |
           PROJECT="$(go list -m)"
@@ -112,77 +95,66 @@ jobs:
           go-licenses check --allowed_licenses="$ALLOWED_LICENSES" --ignore "$PROJECT" .
   tidy:
     name: go mod tidy
-    needs: ["generate-specification","generate-models"]
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7.0.0
         with:
           go-version-file: "go.mod"
-          check-latest: true
       - name: tidy
         run: go mod tidy
       - name: changes
-        run: test -z "$(git diff 2> /dev/null)" || exit "Go modules not tidied, issue \`go mod tidy\` and commit the result"
+        run: git diff --exit-code || { echo "::error::Go modules not tidied, run \`go mod tidy\` and commit the result"; exit 1; }
   build:
     name: Build
-    needs: ["generate-specification","generate-models"]
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v7.0.0
       with:
         go-version-file: "go.mod"
-        check-latest: true
-      id: go
     - name: Build
       run: |
         go build -v .
   go-test:
     name: Tests
-    needs: ["tidy","build"]
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v7.0.0
       with:
         go-version-file: "go.mod"
-        check-latest: true
-      id: go
     - name: Test
       run: |
         go test -v ./...
   go-test-equal:
     name: Test equal
-    needs: ["tidy","build"]
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v7.0.1
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@v7.0.0
       with:
         go-version-file: "go.mod"
-        check-latest: true
-      id: go
     - name: Test
       run: |
         go test -tags equal -v ./...
   e2e:
     name: e2e on HAProxy
-    needs: ["go-test"]
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        haproxyVersion: [2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8]
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7.0.1
+      - name: Set up Go
+        uses: actions/setup-go@v7.0.0
+        with:
+          go-version-file: "go.mod"
       - name: e2e Test
-        run: DOCKER_HAPROXY_VERSION=${{ matrix.haproxyVersion }} make e2e-docker
+        run: make e2e-docker

.gitlab-ci.yml

@@ -2,6 +2,7 @@
 variables:
   DOCKER_HOST: tcp://docker:2375
   GO_VERSION: "1.26"
+  GOTOOLCHAIN: "go1.26.0"
   DOCKER_VERSION: "29.1"
 stages:
   - bots
@@ -15,7 +16,7 @@ pipelines-check:
   stage: bots
   needs: []
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   rules:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
@@ -27,7 +28,7 @@ mr-backport-question:
   stage: bots
   needs: []
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   rules:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event' && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH
@@ -39,7 +40,7 @@ build-specification:
   stage: build
   needs: []
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
@@ -97,7 +98,7 @@ generate:
 build:
   stage: build
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   needs: []
   tags:
@@ -143,11 +144,12 @@ license-check:
   stage: lint
   needs: ["build"]
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
   script:
+    - make go-licenses
     - PROJECT="$(go list -m)"
     - ALLOWED_LICENSES="$(<.allowed_license_types)"
     - go-licenses report --ignore "$PROJECT" .
@@ -160,7 +162,7 @@ lint-commit-msg:
   stage: lint
   needs: ["build"]
   image:
-    name: $CI_REGISTRY_GO/commit-check:latest
+    name: $CI_REGISTRY_GO/commit-check:5.7.1
     entrypoint: [""]
   tags:
     - go
@@ -173,7 +175,7 @@ test:
   stage: test
   needs: ["build"]
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
@@ -187,12 +189,12 @@ test-equal:
   stage: test
   needs: ["build"]
   image:
-    name: $CI_REGISTRY_GO/golang:latest-alpine
+    name: $CI_REGISTRY_GO/golang:$GO_VERSION-alpine
     entrypoint: [""]
   tags:
     - go
   script:
-    - gotest -v -t equal
+    - go test -tags equal -v ./...
   rules:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
     - if: $CI_PIPELINE_SOURCE == 'push'

Makefile

@@ -5,6 +5,8 @@ GO_VERSION:=${shell go mod edit -json | jq -r .Go}
 GOLANGCI_LINT_VERSION=2.12.2
 CHECK_COMMIT=5.7.1
 GO_METHOD_GEN_VERSION:=${shell go mod edit -json | jq -r '.Require[] | select(.Path == "github.com/haproxytech/go-method-gen") | .Version'}
+GOFUMPT_VERSION:=${shell go mod edit -json | jq -r '.Require[] | select(.Path == "mvdan.cc/gofumpt") | .Version'}
+GOTEST_VERSION=v1.0.4
 
 .PHONY: test
 test:
@@ -16,12 +18,12 @@ test-equal:
 
 .PHONY: e2e
 e2e:
-	go install github.com/oktalz/gotest@latest
+	go install github.com/oktalz/gotest@${GOTEST_VERSION}
 	gotest -t integration
 
 .PHONY: e2e-docker
 e2e-docker:
-	docker build -f e2e/Dockerfile --build-arg GO_VERSION=${GO_VERSION} --build-arg HAPROXY_VERSION=${DOCKER_HAPROXY_VERSION} -t client-native-test:${DOCKER_HAPROXY_VERSION} .
+	docker build -f e2e/Dockerfile --build-arg GO_VERSION=${GO_VERSION} --build-arg HAPROXY_VERSION=${DOCKER_HAPROXY_VERSION} --build-arg GOTEST_VERSION=${GOTEST_VERSION} -t client-native-test:${DOCKER_HAPROXY_VERSION} .
 	docker run --rm -t client-native-test:${DOCKER_HAPROXY_VERSION}
 
 # config-parser auto-generated types
@@ -71,9 +73,13 @@ lint-yaml:
 
 .PHONY: gofumpt
 gofumpt:
-	go install mvdan.cc/gofumpt@latest
+	go install mvdan.cc/gofumpt@${GOFUMPT_VERSION}
 	gofumpt -l -w .
 
+.PHONY: go-licenses
+go-licenses:
+	go install github.com/google/go-licenses@v1.6.0
+
 .PHONY: check-commit
 check-commit:
 	cd bin;CHECK_COMMIT=${CHECK_COMMIT} sh check-commit.sh

e2e/Dockerfile

@@ -16,10 +16,13 @@ ARG HAPROXY_VERSION=2.7
 ARG DOCKER_URL=haproxytech
 ARG GO_VERSION=1.22
 
-FROM golang:${GO_VERSION}-alpine as go_image
+FROM golang:${GO_VERSION}-alpine AS go_image
 
 FROM ${DOCKER_URL}/haproxy-alpine:${HAPROXY_VERSION}
 
+ARG HAPROXY_VERSION
+ARG GOTEST_VERSION=v1.0.4
+
 RUN apk add --no-cache -U socat openssl util-linux htop tzdata bash gcc openssl wget git curl make bash jq git && \
     rm -f /usr/local/bin/dataplaneapi /usr/bin/dataplaneapi && \
     rm -f /usr/local/etc/haproxy/haproxy.cfg && \
@@ -31,7 +34,7 @@ COPY --from=go_image /usr/local/go/ /usr/local/go/
 ENV PATH=$PATH:/usr/local/go/bin \
     CGO_ENABLED=0 \
     HAPROXY_VERSION=$HAPROXY_VERSION
-RUN GOBIN=/usr/local/go/bin go install github.com/oktalz/gotest@latest
+RUN GOBIN=/usr/local/go/bin go install github.com/oktalz/gotest@${GOTEST_VERSION}
 
 WORKDIR /src