Commit Graph
429 Commits
Author SHA1 Message Date
Carlos Tadeu Panato Junior a5f223ec4e check and use the latest go available for the defined version (#690)
* check and use the latest go available for the defined version

Signed-off-by: cpanato <ctadeu@gmail.com>

* update cosign action and version

Signed-off-by: cpanato <ctadeu@gmail.com>

* update based on feedback

Signed-off-by: cpanato <ctadeu@gmail.com>
2022-04-21 09:54:20 -04:00
Jason Hall 84356b8b0b Bump ecr-login dep and update WithLogger callsite (#658) 2022-04-13 13:13:18 -04:00
dependabot[bot] d8e8aa5296 Bump actions/upload-artifact from 2 to 3 (#681)
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 2 to 3.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 10:25:29 -04:00
dependabot[bot] 2e32caa661 Bump codecov/codecov-action from 2.1.0 to 3.0.0 (#682)
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 2.1.0 to 3.0.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v2.1.0...v3.0.0)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 10:25:17 -04:00
dependabot[bot] f6a42796c8 Bump sigstore/cosign-installer from 2.1.0 to 2.2.0 (#683)
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 2.1.0 to 2.2.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v2.1.0...v2.2.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 10:25:03 -04:00
dependabot[bot] 97cba5d56a Bump actions/setup-go from 2 to 3 (#680)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 2 to 3.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-04-11 10:24:51 -04:00
Puerco 4ac50b001a Add purls to SPDX sbom (#677)
* Add purl to SPDX go dependencies

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>

* Fix pkg:oci purls in SPDX sbom

This commit modifies the top level purl in the SPDX sbom to
use an oci purl, indicating it describes an image.

Signed-off-by: Adolfo García Veytia (Puerco) <puerco@chainguard.dev>
2022-03-30 07:11:06 -07:00
dependabot[bot] 895cff9823 Bump github.com/docker/docker (#673)
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.13+incompatible to 20.10.14+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Changelog](https://github.com/moby/moby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/docker/docker/compare/v20.10.13...v20.10.14)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-28 09:55:53 -04:00
Thomas Strömberg cefd28f093 go1.18: Preserve trailing tabs while massaging go version -m output (#668)
* go1.18 compatibility: Add workaround for local replace directives

* Fix actual bug where trailing tabs were stripped
v0.11.2
2022-03-21 21:53:42 -04:00
dependabot[bot] 327a88fec0 Bump k8s.io/apimachinery from 0.23.4 to 0.23.5 (#662)
Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.23.4 to 0.23.5.
- [Release notes](https://github.com/kubernetes/apimachinery/releases)
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.23.4...v0.23.5)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-21 09:19:30 -04:00
dependabot[bot] 61b3ccdd31 Bump golang.org/x/tools from 0.1.9 to 0.1.10 (#663)
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.1.9 to 0.1.10.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.1.9...v0.1.10)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-21 09:04:38 -04:00
dependabot[bot] 9459e51df3 Bump github.com/containerd/stargz-snapshotter/estargz (#664)
Bumps [github.com/containerd/stargz-snapshotter/estargz](https://github.com/containerd/stargz-snapshotter) from 0.11.2 to 0.11.3.
- [Release notes](https://github.com/containerd/stargz-snapshotter/releases)
- [Commits](https://github.com/containerd/stargz-snapshotter/compare/v0.11.2...v0.11.3)

---
updated-dependencies:
- dependency-name: github.com/containerd/stargz-snapshotter/estargz
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-21 09:04:15 -04:00
Jason Hall 420c353674 Fix issues related to Go 1.18 (#657)
* Fix issues related to Go 1.18

Update our internal fork for 1.18's ParseBuildInfo for use by pre-1.18
build versions to exactly the code used in the Go 1.18 release branch.
This affects users who `go install` ko running Go <1.18, since that code
was old and incompatible with 1.18-produced output of `go version -m`.

Add a workflow to test all combinations of pre- and post-1.18 setups for
both how ko was built, and what version of Go is installed by the user.

Update our release workflow to build using Go 1.18, so users who
download built binaries don't depend on our forked code at all.

* Only consider supported Go versions

* Massage output of go version -m so it can be parsed

* disable SBOM in unit test

* do the massaging inside internal/

* boilerplate come on

* proceed even when go mod version doesn't give us anything

* undo unit test change
v0.11.1
2022-03-19 15:29:18 -04:00
Jason Hall bdc2d9fde9 Include builds for Go 1.18 in CI matrixes (#652) 2022-03-19 08:33:20 -04:00
Jason Hall aafd3e863b Revert "Produce OCI images by default (#623)" (#653)
This reverts commit 7e9709a63a.
v0.11.0
2022-03-18 11:30:56 -04:00
Dave Protasowski 3cf55a10c9 use automaxprocs to calculate the number of CPUs (#649)
this is  useful for container environments
2022-03-14 15:25:02 -04:00
dependabot[bot] c6e07e89e7 Bump github.com/docker/docker (#646)
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.12+incompatible to 20.10.13+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Changelog](https://github.com/moby/moby/blob/master/CHANGELOG.md)
- [Commits](https://github.com/docker/docker/compare/v20.10.12...v20.10.13)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-13 23:43:42 -04:00
dependabot[bot] d5233abb94 Bump sigs.k8s.io/kind from 0.11.1 to 0.12.0 (#645)
Bumps [sigs.k8s.io/kind](https://github.com/kubernetes-sigs/kind) from 0.11.1 to 0.12.0.
- [Release notes](https://github.com/kubernetes-sigs/kind/releases)
- [Commits](https://github.com/kubernetes-sigs/kind/compare/v0.11.1...v0.12.0)

---
updated-dependencies:
- dependency-name: sigs.k8s.io/kind
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-13 23:20:01 -04:00
dependabot[bot] 90970f816a Bump github.com/containerd/stargz-snapshotter/estargz (#647)
Bumps [github.com/containerd/stargz-snapshotter/estargz](https://github.com/containerd/stargz-snapshotter) from 0.11.1 to 0.11.2.
- [Release notes](https://github.com/containerd/stargz-snapshotter/releases)
- [Commits](https://github.com/containerd/stargz-snapshotter/compare/v0.11.1...v0.11.2)

---
updated-dependencies:
- dependency-name: github.com/containerd/stargz-snapshotter/estargz
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-13 23:19:40 -04:00
dependabot[bot] e010e7922d Bump github.com/spf13/cobra from 1.3.0 to 1.4.0 (#648)
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.3.0 to 1.4.0.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Changelog](https://github.com/spf13/cobra/blob/master/CHANGELOG.md)
- [Commits](https://github.com/spf13/cobra/compare/v1.3.0...v1.4.0)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-13 23:18:59 -04:00
Jason Hall 204fbc9724 Correctly pass through base image annotations (#636)
There were some bugs here before:

- for indexes, we'd annotate the base, but then append to empty.Index
  which didn't carry those forward.
- when producing single-platform images based on multi-platform indexes
  (the default and most common scenario), we wouldn't carry forward the
  original base index's annotations to the single matching platform base
  image.
2022-03-07 14:12:19 -05:00
dependabot[bot] 5fb6c8cf84 Bump actions/checkout from 2 to 3 (#640)
Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2...v3)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-07 09:22:23 -05:00
dependabot[bot] 42fa3ec367 Bump actions/stale from 4.1.0 to 5 (#639)
Bumps [actions/stale](https://github.com/actions/stale) from 4.1.0 to 5.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/v4.1.0...v5)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-07 09:22:10 -05:00
dependabot[bot] 9baeed2829 Bump sigstore/cosign-installer from 2.0.1 to 2.1.0 (#637)
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 2.0.1 to 2.1.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v2.0.1...v2.1.0)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-07 09:19:37 -05:00
dependabot[bot] cab626ddb4 Bump goreleaser/goreleaser-action from 2.9.0 to 2.9.1 (#638)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.9.0 to 2.9.1.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](https://github.com/goreleaser/goreleaser-action/compare/v2.9.0...v2.9.1)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-03-07 09:19:21 -05:00
Jason Hall 7e9709a63a Produce OCI images by default (#623)
* Produce OCI images by default

This changes build logic to prefer to produce OCI images and indexes,
even if original base images are Docker manifests or manifest lists.

OCI indexes support annotations, while Docker manifest lists do not, and
we'd like to inject base image information in annotations wherever possible.

Since Quay.io recently added support for OCI manifests, this is no
longer a serious breaking change -- and anyway, producing SBOMs by default
already breaks Quay.io without --sbom=none.

This behavior can be disabled with --preserve-docker-media-type=true,
which will result in Docker-type manifests being produced if and only if
the base image was a Docker-typed manifest.

This partially reverts commit 42723d75e7.

* drop e2e test

* update generated docs

* --preserve-media-type

* docs
2022-03-04 16:21:06 -05:00
Jason Hall cd41b3e714 Remove --watch mode (#585) 2022-03-03 14:58:34 -05:00
Jason Hall 967e3ebb2d rm cmd/ko/main.go (#628) 2022-03-02 16:42:54 -05:00
Jason Hall f40d2dcca1 Update Go 1.18 code to match RC 1 (#631) 2022-03-02 13:28:32 -05:00
jonjohnsonjr 66bd5fc8a5 Clear Cmd when setting Entrypoint (#624)
See https://github.com/chainguard-dev/apko/issues/22
2022-02-28 16:55:57 -08:00
dependabot[bot] 56e14a1418 Bump goreleaser/goreleaser-action from 2.8.1 to 2.9.0 (#621)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.8.1 to 2.9.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](https://github.com/goreleaser/goreleaser-action/compare/v2.8.1...v2.9.0)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-28 10:20:13 -05:00
Carlos Tadeu Panato Junior 62800bc186 warning users when using both --base-import-paths --bare flags (#618)
* warning users when using both --base-import-paths --bare flags

Signed-off-by: Carlos Panato <ctadeu@gmail.com>

* update header

Signed-off-by: cpanato <ctadeu@gmail.com>
2022-02-28 09:34:50 -05:00
jonjohnsonjr ea93812481 Test the right directory for kocache (#616) 2022-02-24 11:54:25 -05:00
Batuhan Apaydın d48a62134c fix: create dir for KOCACHE (#607)
Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>
2022-02-23 13:34:34 -08:00
dependabot[bot] 1ae0fddddf Bump github.com/containerd/stargz-snapshotter/estargz (#615)
Bumps [github.com/containerd/stargz-snapshotter/estargz](https://github.com/containerd/stargz-snapshotter) from 0.11.0 to 0.11.1.
- [Release notes](https://github.com/containerd/stargz-snapshotter/releases)
- [Commits](https://github.com/containerd/stargz-snapshotter/compare/v0.11.0...v0.11.1)

---
updated-dependencies:
- dependency-name: github.com/containerd/stargz-snapshotter/estargz
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-23 08:23:04 -05:00
dependabot[bot] 6a110094a4 Bump goreleaser/goreleaser-action from 1 to 2.8.1 (#611)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 1 to 2.8.1.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](https://github.com/goreleaser/goreleaser-action/compare/v1...v2.8.1)

---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-23 08:22:15 -05:00
dependabot[bot] 53d896e9be Bump sigstore/cosign-installer from 2.0.0 to 2.0.1 (#612)
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 2.0.0 to 2.0.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](https://github.com/sigstore/cosign-installer/compare/v2.0.0...v2.0.1)

---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-23 08:21:57 -05:00
dependabot[bot] 88c512ee45 Bump codecov/codecov-action from 1 to 2.1.0 (#614)
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 1 to 2.1.0.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v1...v2.1.0)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-23 08:21:46 -05:00
dependabot[bot] 2a54d04360 Bump actions/stale from 3 to 4.1.0 (#613)
Bumps [actions/stale](https://github.com/actions/stale) from 3 to 4.1.0.
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/stale/compare/v3...v4.1.0)

---
updated-dependencies:
- dependency-name: actions/stale
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-23 08:21:34 -05:00
Matt Moore 31be2cb778 Take advantage of Chainguard maintained versions of various actions. (#609)
* Take advantage of Chainguard maintained versions of various actions.

* Bump cosign version
2022-02-23 07:23:48 -05:00
dependabot[bot] a36ea50a9e Bump k8s.io/apimachinery from 0.23.3 to 0.23.4 (#606)
Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.23.3 to 0.23.4.
- [Release notes](https://github.com/kubernetes/apimachinery/releases)
- [Commits](https://github.com/kubernetes/apimachinery/compare/v0.23.3...v0.23.4)

---
updated-dependencies:
- dependency-name: k8s.io/apimachinery
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2022-02-21 12:32:35 -05:00
Engin Diri 921a580cba feat: not enforce KO_DOCKER_REPO with push=false (#604) 2022-02-20 04:15:08 -05:00
Jason Hall eb2597f975 Update 'ko publish' -> 'ko build' in README (#601) 2022-02-17 17:05:35 -05:00
Jason Hall 70f0273018 Introduce --verbose flag that enables logs.Warn logs (#600)
* Introduce --verbose flag that enables logs.Warn logs

* regenerate docs
v0.10.0
2022-02-17 08:34:43 -08:00
Jason Hall 3fc720f912 Update ecr-login dependency to allow us to avoid logspam (#586) 2022-02-16 15:33:47 -05:00
Jason Hall a41529ebf4 Fix Windows e2e test (#599)
Use nanoserver:ltsc2022 and correct osversion
2022-02-16 14:48:14 -05:00
Jason Hall 0187841b16 Sign image using cosign (#595)
Annotate signature with run information
2022-02-13 15:58:38 -08:00
Jason Hall 98ff104f1a Generate CycloneDX SBOMs using our own JSON generation (#587)
* Generate CycloneDX SBOMs using our own JSON generation

* fix some errors

* Add support to ko deps

* Add e2e SBOM validation

* ignore empty hashes (why are hashes empty?)
2022-02-11 16:49:53 -05:00
Jason Hall f8d0aca1ab Log base image@digest when building (#592)
* Log base image@digest when building

* Only log full digest if the original base wasn't already specified by digest

* Remove redundant image ref
2022-02-11 10:39:19 -05:00
Jason Hall 89ede9110a Include cred helpers in keychain (#581)
This adds implicit support for Google, Amazon, Azure and GitHub
container registries if the environment provides credentials.

Binary size increases from 22 MB -> 26 MB
2022-02-08 15:20:31 -05:00