chore: bump down x/sync to v0.16 (#18)

go.expect.digital/cache supports the last three versions of golang -
from 1.23. Unfortunately, x/sync v0.17 requires go1.24.

Author: janishorsts

.env

@@ -0,0 +1 @@
+EARTHLY_INSTALLATION_NAME=go-cache

.github/workflows/check.yaml

@@ -15,7 +15,7 @@ jobs:
         go: [1.23, 1.24, 1.25]
     continue-on-error: true
     steps:
-      - uses: earthly/actions-setup@v1
+      - uses: EarthBuild/actions-setup@main
         with:
           version: ${{ env.EARTHLY_VERSION }}
           use-cache: false
@@ -25,3 +25,5 @@ jobs:
         run: earthly --ci +lint
       - name: Test
         run: earthly --ci +test
+      - name: Go Vulnerability Check
+        run: earthly --ci +govulncheck

Earthfile

@@ -1,6 +1,7 @@
 VERSION 0.8
-ARG go_version=1.25.1-alpine@sha256:b6ed3fd0452c0e9bcdef5597f29cc1418f61672e9d3a2f55bf02e7222c014abd
-FROM golang:$go_version
+ARG go_version=1.25.1
+FROM golang:$go_version-alpine
+WORKDIR /src
 
 src:
   ENV CGO_ENABLED=0
@@ -12,9 +13,10 @@ src:
     go mod download
   SAVE ARTIFACT /src
 
+# lint runs all linters for golang
 lint:
-  ARG golangci_lint_version=2.4.0-alpine
-  FROM golangci/golangci-lint:v$golangci_lint_version
+  ARG golangci_lint_version=2.4.0
+  FROM golangci/golangci-lint:v$golangci_lint_version-alpine
   WORKDIR /src
   COPY .golangci.yml .
   COPY --dir +src/src /
@@ -24,13 +26,25 @@ lint:
     --mount type=cache,id=golangci,target=/root/.cache/golangci_lint \
     golangci-lint run --timeout 3m
 
+# test runs unit tests
 test:
   FROM +src
   RUN \
     --mount=type=cache,id=go-mod,target=/go/pkg/mod \
     --mount=type=cache,id=go-build,target=/root/.cache/go-build \
     go test ./... -count 10
 
+# govulncheck checks golang vulnerabilities
+govulncheck:
+  RUN apk add git
+  # renovate: datasource=go depName=golang.org/x/vuln/cmd/govulncheck
+  ARG govulncheck_version=v1.1.4
+  RUN go install golang.org/x/vuln/cmd/govulncheck@$govulncheck_version
+  COPY --dir +src/src /
+  RUN govulncheck ./...
+
+# check verifies code quality by running linters and tests
 check:
   BUILD +lint
   BUILD +test
+  BUILD +govulncheck

go.mod

@@ -1,7 +1,7 @@
 module go.expect.digital/cache
 
-go 1.24.0
+go 1.23.0
 
 toolchain go1.25.1
 
-require golang.org/x/sync v0.17.0
+require golang.org/x/sync v0.16.0

go.sum

@@ -1,4 +1,2 @@
 golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
 golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
-golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
-golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=