chore: bump dependencies, migrate CI to Nix, and modernize build tooling

.github/workflows/release.yml

@@ -13,25 +13,27 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - name: Set up QEMU # required for multi architecture build - https://goreleaser.com/cookbooks/multi-platform-docker-images/?h=multi#other-things-to-pay-attention-to
-        uses: docker/setup-qemu-action@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
-      - uses: actions/checkout@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0 # this is important, otherwise it won't checkout the full tree (i.e. no previous tags)
 
       - name: Login to GHCR
-        uses: docker/login-action@v2
+        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/setup-go@v4
-        with:
-          go-version-file: go.mod
+      - name: Install Nix
+        uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0
 
-      - uses: goreleaser/goreleaser-action@v5
-        with:
-          version: v1.25.1
-          args: release --rm-dist
+      - name: Run GoReleaser
+        run: nix develop --command goreleaser release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/run-tests.yml

@@ -11,32 +11,29 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       checks: write
       pull-requests: write
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
       - name: Fetch target branch
+        if: github.event_name == 'pull_request'
         run: |
           git fetch origin ${{ github.event.pull_request.base.ref }}:${{ github.event.pull_request.base.ref }}
 
-      - name: Run Gosec Security Scanner
-        uses: securego/gosec@master
-        with:
-          args: ./...
-
-      - uses: actions/setup-go@v4
-        with:
-          go-version-file: go.mod
+      - name: Install Nix
+        uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0
 
-      - name: Install project dependencies
-        run: make install-deps
+      - name: Run Gosec Security Scanner
+        run: nix develop --command gosec -exclude-dir=.gomod -exclude-dir=.go ./...
 
       - name: Run tests
-        run: make test-coverage
+        run: nix develop --command task test-coverage
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.out

.goreleaser.yaml

@@ -1,9 +1,10 @@
+version: 2
+
 project_name: argo-compare
 
 before:
   hooks:
-    - make install-deps mocks
-    - go mod tidy
+    - task mocks
 
 builds:
   - env:
@@ -17,59 +18,29 @@ builds:
     mod_timestamp: '{{ .CommitTimestamp }}'
     main: ./cmd/argo-compare
 
-brews:
-  - repository:
-      owner: shini4i
-      name: homebrew-tap
-    folder: Formula
-    homepage: https://github.com/shini4i/argo-compare
-    dependencies:
-      - name: helm
-    description: "A comparison tool for displaying the differences between ArgoCD Applications in different Git branches"
-    license: "MIT"
-
-dockers:
-  - image_templates: [ "ghcr.io/shini4i/{{ .ProjectName }}:{{ .Version }}-amd64" ]
-    dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/amd64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title={{.ProjectName}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.licenses=MIT"
-    goos: linux
-    goarch: amd64
-    extra_files:
-      - patch/diff-so-fancy.patch
-  - image_templates: [ "ghcr.io/shini4i/{{ .ProjectName }}:{{ .Version }}-arm64" ]
+dockers_v2:
+  - images:
+      - "ghcr.io/shini4i/{{ .ProjectName }}"
+    tags:
+      - "{{ .Version }}"
+    platforms:
+      - linux/amd64
+      - linux/arm64
     dockerfile: Dockerfile
-    use: buildx
-    build_flag_templates:
-      - "--platform=linux/arm64"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.title={{.ProjectName}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=org.opencontainers.image.licenses=MIT"
-    goos: linux
-    goarch: arm64
     extra_files:
       - patch/diff-so-fancy.patch
-
-docker_manifests:
-  - name_template: 'ghcr.io/shini4i/{{.ProjectName}}:{{ .Version }}'
-    image_templates:
-      - 'ghcr.io/shini4i/{{.ProjectName}}:{{ .Version }}-amd64'
-      - 'ghcr.io/shini4i/{{.ProjectName}}:{{ .Version }}-arm64'
+    labels:
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.title: "{{ .ProjectName }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.licenses: "MIT"
 
 snapshot:
-  name_template: '{{ incpatch .Version }}-dev'
+  version_template: '{{ incpatch .Version }}-dev'
 
 changelog:
-  use:
-    github-native
+  use: github-native
 
 release:
   prerelease: auto
@@ -78,5 +49,3 @@ release:
   footer: |
     ## Docker Images
     - `ghcr.io/shini4i/{{ .ProjectName }}:{{ .Version }}`
-    - `ghcr.io/shini4i/{{ .ProjectName }}:{{ .Version }}-amd64`
-    - `ghcr.io/shini4i/{{ .ProjectName }}:{{ .Version }}-arm64`

Dockerfile

@@ -1,16 +1,19 @@
-FROM alpine:3.22 AS downloader
+FROM alpine:3.23.3 AS downloader
 
 ARG TARGETARCH
 
-ENV HELM_VERSION=3.15.2
+ENV HELM_VERSION=3.19.5
 ENV DIFF_SO_FANCY_VERSION=1.4.4
 
 WORKDIR /tmp
 
 RUN apk add --no-cache wget git patch \
     && wget --progress=dot:giga -O helm.tar.gz "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz" \
+    && wget -qO helm.tar.gz.sha256 "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz.sha256sum" \
+    && echo "$(awk '{print $1}' helm.tar.gz.sha256)  helm.tar.gz" | sha256sum -c - \
     && tar -xf helm.tar.gz "linux-${TARGETARCH}/helm" \
-    && mv "linux-${TARGETARCH}/helm" /usr/bin/helm
+    && mv "linux-${TARGETARCH}/helm" /usr/bin/helm \
+    && rm -f helm.tar.gz helm.tar.gz.sha256
 
 RUN git clone -b v${DIFF_SO_FANCY_VERSION} https://github.com/so-fancy/diff-so-fancy /diff-so-fancy \
  && mv /diff-so-fancy/diff-so-fancy /usr/local/bin/diff-so-fancy \
@@ -26,7 +29,7 @@ WORKDIR /usr/local/bin
 
 RUN patch < /tmp/diff-so-fancy.patch
 
-FROM alpine:3.22
+FROM alpine:3.23.3
 
 RUN apk add --no-cache perl ncurses \
  && adduser --disabled-password --gecos '' app

README.md

@@ -23,10 +23,10 @@ are merged into the target branch.
 
 ### How to install
 
-The binary can be installed using homebrew:
+Download the binary from the [Releases](https://github.com/shini4i/argo-compare/releases) page, or pull the Docker image:
 
 ```bash
-brew install shini4i/tap/argo-compare
+docker pull ghcr.io/shini4i/argo-compare:<version>
 ```
 
 ### How to use

Taskfile.yml

@@ -0,0 +1,38 @@
+version: '3'
+
+tasks:
+  mocks:
+    desc: Generate mocks
+    cmds:
+      - mockgen --source=internal/ports/ports.go --destination=cmd/argo-compare/mocks/interfaces.go --package=mocks
+
+  test:
+    desc: Run tests
+    deps: [mocks]
+    cmds:
+      - go test -v ./... -count=1
+
+  test-coverage:
+    desc: Run tests with coverage
+    deps: [mocks]
+    cmds:
+      - mkdir -p .tmp/repo.git/refs/heads .tmp/repo.git/refs/tags
+      - go test -v -coverprofile=coverage.out ./... -count=1 2>&1 | tee /dev/stderr | go-junit-report -set-exit-code > report.xml
+
+  test-coverage-html:
+    desc: Run tests with coverage and open HTML report
+    deps: [test-coverage]
+    cmds:
+      - go tool cover -html=coverage.out -o coverage.html
+
+  build:
+    desc: Build the binary
+    cmds:
+      - mkdir -p bin
+      - CGO_ENABLED=0 go build -ldflags="-s -w" -o bin/argo-compare ./cmd/argo-compare
+
+  clean:
+    desc: Remove build and test artifacts
+    cmds:
+      - rm -rf bin .tmp
+      - rm -f coverage.out coverage.html report.xml

flake.nix

@@ -12,10 +12,14 @@
         };
 
         goToolchain = with pkgs; [
-          go_1_24
+          go_1_25
           gopls
           gotools
           mockgen
+          goreleaser
+          gosec
+          go-junit-report
+          go-task
         ];
 
         preCommitTools = with pkgs; [

go.mod

@@ -1,22 +1,20 @@
 module github.com/shini4i/argo-compare
 
-go 1.24.0
-
-toolchain go1.24.1
+go 1.25
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.41.3
 	github.com/aws/aws-sdk-go-v2/config v1.32.11
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.55.4
 	github.com/codingsince1985/checksum v1.3.0
 	github.com/fatih/color v1.18.0
-	github.com/go-git/go-git/v5 v5.16.3
+	github.com/go-git/go-git/v5 v5.17.0
 	github.com/hexops/gotextdiff v1.0.3
 	github.com/mattn/go-zglob v0.0.6
 	github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
-	github.com/spf13/afero v1.14.0
-	github.com/spf13/cobra v1.10.1
-	github.com/stretchr/testify v1.10.0
+	github.com/spf13/afero v1.15.0
+	github.com/spf13/cobra v1.10.2
+	github.com/stretchr/testify v1.11.1
 	go.uber.org/mock v0.6.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -42,7 +40,7 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.2 // indirect
+	github.com/go-git/go-billy/v5 v5.8.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect