add release workflow and port common patterns

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

Author: wagoodman

.binny.yaml

@@ -1,64 +1,30 @@
+# only pull in version updates that were released more than a week ago (low-pass filter for quickly-retracted releases)
+cooldown: 7d
+
+# other binary versions inherited from .binny.yaml file in the anchore/go-make repo (version pinned in .make).
+# If you need to override a tool version, please do so by adding an entry here and go-make will
+# account for the local definition over the go-make shared definitions.
 tools:
   # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
   - name: binny
     version:
-      want: v0.10.0
+      want: v0.13.0
     method: github-release
     with:
       repo: anchore/binny
 
   # used to produce SBOMs during release
   - name: syft
     version:
-      want: latest
+      want: v1.42.3
     method: github-release
     with:
       repo: anchore/syft
 
-  # used for linting
-  - name: golangci-lint
-    version:
-      want: v2.5.0
-    method: github-release
-    with:
-      repo: golangci/golangci-lint
-
-  # used for showing the changelog at release
-  - name: glow
-    version:
-      want: v2.1.1
-    method: github-release
-    with:
-      repo: charmbracelet/glow
-
-  # used for organizing imports during static analysis
-  - name: gosimports
-    version:
-      want: v0.3.8
-    method: github-release
-    with:
-      repo: rinchsan/gosimports
-
   # used at release to generate the changelog
   - name: chronicle
     version:
-      want: v0.8.0
+      want: v0.8.3
     method: github-release
     with:
       repo: anchore/chronicle
-
-  # used during static analysis for license compliance
-  - name: bouncer
-    version:
-      want: v0.4.0
-    method: github-release
-    with:
-      repo: wagoodman/go-bouncer
-
-  # used for triggering a release
-  - name: gh
-    version:
-      want: v2.82.0
-    method: github-release
-    with:
-      repo: cli/cli

.chronicle.yaml

@@ -0,0 +1,5 @@
+# no matter the change, stay v0 for now
+enforce-v0: true
+
+# since github release pages already have titles that are the tag, we don't need to repeat that in the changelog
+title: ""

.github/dependabot.yml

@@ -1,33 +1,55 @@
+# Dependabot configuration
+#
+# Grouping behavior (see inline comments for details):
+#   - Minor + patch updates: grouped into a single PR per ecosystem
+#   - Major version bumps: individual PR per dependency
+#   - Security updates: individual PR per dependency
+#
+# Note: "patch" refers to semver version bumps (1.2.3 -> 1.2.4), not security fixes.
+# Security updates are identified separately via GitHub's Advisory Database and
+# can be any version bump (patch, minor, or major) that fixes a known CVE.
+
 version: 2
 
 updates:
 
   - package-ecosystem: gomod
-    directory: "/"
-    schedule:
-      interval: "daily"
+    directories:
+      - "/"
+      - "/.make"
     cooldown:
       default-days: 7
-    open-pull-requests-limit: 10
-    labels:
-      - "dependencies"
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
     schedule:
-      interval: "daily"
-    cooldown:
-      default-days: 7
+      interval: "weekly"
+      day: "friday"
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    groups:
+      go-minor-patch:
+        applies-to: version-updates  # security updates get individual PRs
+        patterns:
+          - "*"
+        update-types:  # major omitted, gets individual PRs
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "github-actions"
-    directory: "/.github/actions/boostrap"
-    schedule:
-      interval: "daily"
+    directories:
+      - "/"
     cooldown:
       default-days: 7
+    schedule:
+      interval: "weekly"
+      day: "friday"
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
+    groups:
+      actions-minor-patch:
+        applies-to: version-updates  # security updates get individual PRs
+        patterns:
+          - "*"
+        update-types:  # major omitted, gets individual PRs
+          - "minor"
+          - "patch"

.github/workflows/codeql.yaml

@@ -0,0 +1,57 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '38 11 * * 3'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+
+          - language: go
+            build-mode: manual
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      - name: Build (Go)
+        if: matrix.build-mode == 'manual'
+        shell: bash
+        run: go build ./...
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/release.yaml

@@ -0,0 +1,55 @@
+name: "Release"
+
+permissions:
+  contents: read
+
+# there should never be two releases in progress at the same time
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: tag the latest commit on main with the given version (prefixed with v)
+        required: true
+
+jobs:
+
+  version-available:
+    uses: anchore/workflows/.github/workflows/check-version-available.yaml@4f25313f96311410cad4173f74617654a3e46d48 # v0.3.0
+    with:
+      version: ${{ github.event.inputs.version }}
+
+  check-gate:
+    permissions:
+      checks: read   # required for getting the status of specific check names
+    uses: anchore/workflows/.github/workflows/check-gate.yaml@4f25313f96311410cad4173f74617654a3e46d48 # v0.3.0
+    with:
+      # these are checks that should be run on pull-request and merges to main.
+      # we do NOT want to kick off a release if these have not been verified on main.
+      # Please see the validations.yaml workflow for the names that should be used here.
+      checks: '["Static analysis", "Unit tests"]'
+
+  release:
+    needs: [check-gate, version-available]
+    environment: release  # contains secrets needed for release
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write   # needed for creating github release objects
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
+        with:
+          fetch-depth: 0  # we need the full history to reason about changelogs and tags
+          persist-credentials: true  # needed for pushing a tag
+
+      # setup checkout, go, go-make, binny, and cache go modules
+      - uses: anchore/go-make/.github/actions/setup@383ef7852b8ae43a30f424896b52479186d2ea4d # v0.1.0
+
+      - name: Create release
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+          RELEASE_VERSION: ${{ github.event.inputs.version }}
+        run: make ci-release

.github/workflows/validations.yaml

@@ -1,5 +1,6 @@
 name: "Validations"
 on:
+  workflow_dispatch:
   push:
     branches:
       - main
@@ -11,21 +12,23 @@ permissions:
 jobs:
 
   Static-Analysis:
+    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Static analysis"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-    - name: Bootstrap environment
-      uses: anchore/go-make/.github/actions/bootstrap@latest
+      # setup checkout, go, go-make, binny, and cache go modules
+      - uses: anchore/go-make/.github/actions/setup@383ef7852b8ae43a30f424896b52479186d2ea4d # v0.1.0
 
-    - name: Run static analysis
-      run: make static-analysis
+      - name: Run static analysis
+        run: make static-analysis
 
   Unit-Test:
+    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Unit tests"
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - name: Bootstrap environment
-        uses: anchore/go-make/.github/actions/bootstrap@latest
+      # setup checkout, go, go-make, binny, and cache go modules
+      - uses: anchore/go-make/.github/actions/setup@383ef7852b8ae43a30f424896b52479186d2ea4d # v0.1.0
 
       - name: Run unit tests
         run: make unit

.github/zizmor.yml

@@ -1,6 +1,6 @@
 rules:
   unpinned-uses:
-    config:
-      policies:
-        # anchore actions are internal; using @main is acceptable
-        anchore/*: any
+    ignore:
+      # Allow unpinned uses of trusted internal anchore/workflows actions
+      - oss-project-board-add.yaml
+      - remove-awaiting-response-label.yaml

.gitignore

@@ -1,15 +1,41 @@
-/test/results/
+# local development
+go.work
+go.work.sum
+mise.toml
+/specs/
+
+# IDEs
+.idea/
 .vscode/
+.history/
+
+# tools and aux data
+.tool
+.tmp
+.task
+
+# release info
+/CHANGELOG.md
+/VERSION
+
+# archives and fixtures
+/test/results
+/dist
+/snapshot
+.server/
+*.fingerprint
 *.tar
-.idea/
+*.jar
+*.war
+*.ear
+*.jpi
+*.hpi
+*.zip
 *.log
 .images
 .tmp/
-*.DS_Store
 coverage.txt
-**/test-fixtures/cache/
-**/*.fingerprint
-snapshot/
+bin/
 
 # Binaries for programs and plugins
 *.exe
@@ -23,6 +49,8 @@ snapshot/
 
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
-/.tool/.binny.state.json
-/.tool/binny
-/.tool/golangci-lint
+
+# macOS Finder metadata
+.DS_STORE
+
+*.profile