improve Go setup

.github/dependabot.yml

@@ -1,13 +1,26 @@
 version: 2
 updates:
-  # Check for major GitHub Actions updates
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
 
-  # Check for Go module updates
   - package-ecosystem: "gomod"
-    directory: "/"  # adjust this if your go.mod file is in a subdirectory
+    directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 7

.github/workflows/govulncheck.yml

@@ -0,0 +1,30 @@
+name: govulncheck
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: '0 6 * * 1'
+
+jobs:
+  govulncheck:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run govulncheck
+        run: make govulncheck

.github/workflows/lint.yml

@@ -0,0 +1,31 @@
+name: Lint
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  lint:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+
+      - name: Check linter configuration
+        run: make lint-config
+      - name: Run linter
+        run: make lint

.github/workflows/release.yml

@@ -0,0 +1,68 @@
+name: Release
+
+permissions: {}
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release:
+    name: Create GitHub Release
+    runs-on: ubuntu-latest
+    environment: release          # protection rules; must be created in repo settings
+    permissions:
+      contents: write             # create the GitHub Release (only permission needed)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Verify tag matches VERSION and libraryVersion
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          test "$(cat VERSION)" = "$TAG" \
+            || { echo "VERSION ($(cat VERSION)) != tag $TAG"; exit 1; }
+          grep -q "libraryVersion = \"$TAG\"" cloudscale.go \
+            || { echo "libraryVersion in cloudscale.go != tag $TAG"; exit 1; }
+
+      - name: Verify tag is signed
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          git cat-file tag "$TAG" | grep -qE 'BEGIN (PGP|SSH) SIGNATURE' \
+            || { echo "tag $TAG is not signed (use git tag -s)"; exit 1; }
+
+      - name: Run govulncheck
+        run: make govulncheck
+
+      - name: Run go vet
+        run: make vet
+
+      - name: Run unit tests
+        run: make test
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          PRERELEASE_FLAG=""
+          if [[ "$TAG" == *-* ]]; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+          gh release create "$TAG" --generate-notes $PRERELEASE_FLAG

.github/workflows/test.yaml

@@ -10,6 +10,8 @@ on:
   schedule:
     - cron: '14 14 * * *'
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
 
@@ -21,10 +23,13 @@ jobs:
 
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: 'go.mod'
 

.github/workflows/zizmor.yml

@@ -0,0 +1,27 @@
+name: Workflow Security Lint
+
+permissions: {}
+
+on:
+  push:
+    branches: [master]
+    paths: ['.github/**']
+  pull_request:
+    paths: ['.github/**']
+
+jobs:
+  zizmor:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    name: zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7

.gitignore

@@ -1,2 +1,3 @@
 .idea/
 /vendor/
+bin/

.golangci.yml

@@ -0,0 +1,97 @@
+version: "2"
+run:
+  allow-parallel-runners: true
+  build-tags:
+    - integration
+linters:
+  default: none
+  enable:
+    - asasalint # warns about passing []any to func(...any) without expanding it
+    - asciicheck # non ascii symbols
+    - copyloopvar # copying loop variables
+    - errcheck  # unchecked errors
+    - exhaustive # exhaustiveness of enum switch statements
+    - ginkgolinter # ginkgo and gomega - only if ginkgo/gomega is used
+    - gocritic # bugs, performance, style
+    - gocyclo # cyclomatic complexity of functions
+    - godoclint # go documentation linting against best practices
+    - gosec # potential security problems
+    - govet # basically 'go vet'
+    - importas # enforces consistent import aliases.
+    - ineffassign # ineffectual assignments
+    - loggercheck # check for even key/value pairs in logger calls
+    - modernize # suggest simplifications to Go code, using modern language and library features
+    - misspell # spelling checks
+    - nakedret  # naked returns (named return parameters and an empty return)
+    - noctx  # http requests without context.Context
+    - nolintlint  # badly formatted nolint directives
+    - predeclared # shadowing predeclared identifiers
+    - promlinter # only if prom is used for creating metrics
+    - revive # better version of golint
+    - spancheck # only if OpenTelemetry is used
+    - staticcheck # many static checks
+    - thelper # test helpers not starting with t.Helper()
+    - unconvert # unnecessary type conversions
+    - unparam # unused function parameters
+    - unused # unused constants, variables,functions, types
+    - usestdlibvars # using variables/constants from the standard library
+    - usetesting # reports uses of functions with replacement inside the testing package
+    - whitespace # unnecessary newlines
+  settings:
+    loggercheck:
+      kitlog: false
+      slog: false
+      zap: false
+      require-string-key: true
+      no-printf-like: true
+    modernize:
+      disable:
+        - omitzero
+    gocritic:
+      disabled-checks:
+        - ifElseChain # disabled ifElseChain because this is purely stylistic
+    revive:
+      rules:
+        # The following rules are recommended https://github.com/mgechev/revive#recommended-configuration
+        - name: blank-imports
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: error-return
+        - name: error-strings
+        - name: error-naming
+        - name: if-return
+        - name: increment-decrement
+        - name: var-naming
+        - name: var-declaration
+        - name: range
+        - name: receiver-naming
+        - name: time-naming
+        - name: unexported-return
+        - name: indent-error-flow
+        - name: errorf
+        - name: empty-block
+        - name: superfluous-else
+        - name: unreachable-code
+        - name: redefines-builtin-id
+    staticcheck:
+      dot-import-whitelist:
+        - fmt
+        - github.com/onsi/gomega
+        - github.com/onsi/ginkgo/v2
+  exclusions:
+    generated: lax
+    warn-unused: true
+formatters:
+  enable:
+    - goimports # ensures imports are organized
+    - gofmt # Check if the code is formatted according to 'gofmt' command.
+  settings:
+    goimports:
+      # A list of prefixes, which, if set, checks import paths
+      # with the given prefixes are grouped after 3rd-party packages.
+      # Default: []
+      local-prefixes:
+        - github.com/cloudscale-ch/cloudscale-go-sdk
+  exclusions:
+    generated: lax
+    warn-unused: true