chore: bump Go to 1.27.1 and update dependencies

.github/workflows/codeql.yml

@@ -49,7 +49,7 @@ jobs:
     - if: matrix.build-mode == 'manual'
       env:
         # fix "go: download go1.22 for linux/amd64: toolchain not available" error
-        GOTOOLCHAIN: "go1.26.5"
+        GOTOOLCHAIN: "go1.27.1"
       run: |
         make go-build
 

.github/workflows/golangci-lint.yml

@@ -27,4 +27,4 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.11.4
+          version: v2.13.2

.github/workflows/gosec.yml

@@ -24,7 +24,7 @@ jobs:
         persist-credentials: false
     - name: Run Gosec Security Scanner
       env:
-        GOTOOLCHAIN: "go1.26.5"
+        GOTOOLCHAIN: "go1.27.1"
       uses: securego/gosec@deb54465fea23d19a77f037e11e6589021f8501d # v2.29.0
       with:
         args: ./...

.ko.yaml

@@ -1,4 +1,4 @@
-defaultBaseImage: cgr.dev/chainguard/static
+defaultBaseImage: cgr.dev/chainguard/static:latest@sha256:f51c2493951313c3ad4069080b2814ffb6ed6fe3909dabeb84a9482f42d5600b
 defaultPlatforms:
 # possible values: all, linux/s390x, linux/arm64, linux/arm/v7, linux/ppc64le, linux/amd64
 - linux/arm64

.pre-commit-config.yaml

@@ -23,7 +23,7 @@ repos:
       - id: go-imports
       - id: go-unit-tests
   - repo: https://github.com/golangci/golangci-lint
-    rev: v2.12.2
+    rev: v2.13.2
     hooks:
       - id: golangci-lint
   - repo: local
@@ -32,6 +32,6 @@ repos:
         name: gosec
         entry: gosec
         language: golang
-        additional_dependencies: ['github.com/securego/gosec/v2/cmd/gosec@v2.25.0']
+        additional_dependencies: ['github.com/securego/gosec/v2/cmd/gosec@v2.29.0']
         args: ["./..."]
         pass_filenames: false

CLAUDE.md

@@ -64,9 +64,23 @@ gh release view --repo google/ko --json tagName -q '.tagName'
 
 Then update `KO_VERSION` in [Makefile](Makefile) accordingly.
 
-### 6. Update GitHub Actions versions
+### 6. Update the ko base image digest
 
-All workflow files under [.github/workflows/](.github/workflows/) pin actions by commit SHA with a tag comment, e.g.:
+[.ko.yaml](.ko.yaml) pins the base image by digest. Dependabot cannot watch `.ko.yaml`, so this must be updated manually:
+
+```bash
+crane digest cgr.dev/chainguard/static:latest
+```
+
+Then update the `@sha256:...` digest in `defaultBaseImage`:
+
+```yaml
+defaultBaseImage: cgr.dev/chainguard/static:latest@sha256:<digest>
+```
+
+### 7. Update GitHub Actions versions
+
+All workflow files under [.github/workflows/](.github/workflows/) and the composite action [.github/actions/publish-image/action.yaml](.github/actions/publish-image/action.yaml) pin actions by commit SHA with a tag comment, e.g.:
 
 ```yaml
 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -97,9 +111,10 @@ Actions used across the workflows:
 | `actions/checkout` | all |
 | `actions/dependency-review-action` | dependency-review.yml |
 | `actions/setup-go` | release.yml, golangci-lint.yml |
-| `actions/upload-artifact` | scorecard.yml |
+| `actions/upload-artifact` | scorecard.yml, actions/publish-image/action.yaml |
 | `anchore/sbom-action` | release.yml |
 | `creekorful/goreportcard-action` | release.yml |
+| `CycloneDX/gh-gomod-generate-sbom` | actions/publish-image/action.yaml |
 | `docker/login-action` | release.yml |
 | `github/codeql-action` | codeql.yml, scorecard.yml |
 | `golangci/golangci-lint-action` | golangci-lint.yml — also update `version:` param to match `rev` in [.pre-commit-config.yaml](.pre-commit-config.yaml) |
@@ -111,7 +126,7 @@ Actions used across the workflows:
 | `slsa-framework/slsa-github-generator` | release.yml (**tag only**) |
 | `slsa-framework/slsa-verifier` | release-verification.yml |
 
-### 7. Update pre-commit hooks
+### 8. Update pre-commit hooks
 
 [.pre-commit-config.yaml](.pre-commit-config.yaml) pins the `rev` of each hook repository. Update all revisions to their latest tags:
 
@@ -125,7 +140,7 @@ This updates the `rev` fields for all four repos in [.pre-commit-config.yaml](.p
 - `dnephin/pre-commit-golang`
 - `golangci/golangci-lint`
 
-### 8. Verify
+### 9. Verify
 
 ```bash
 go build ./...

Makefile

@@ -17,7 +17,7 @@ DESCRIPTION ?= Export Proxmox Backup Server metrics for Prometheus
 
 .PHONY: go-tidy
 go-tidy:
-	go mod tidy -compat=1.26
+	go mod tidy -compat=1.27
 	@echo "Go modules tidied."
 
 .PHONY: go-update
@@ -35,7 +35,7 @@ go-build:
 # TOOLS #
 #########
 
-KO_VERSION  = v0.18.1
+KO_VERSION  = v0.19.1
 KO = $(shell pwd)/bin/ko
 
 ko:

go.mod

@@ -1,16 +1,16 @@
 module github.com/natrontech/pbs-exporter
 
-go 1.26.5
+go 1.27.1
 
 require github.com/prometheus/client_golang v1.24.1
 
 require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.1 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/client_model v0.6.3 // indirect
+	github.com/prometheus/common v0.71.0 // indirect
+	github.com/prometheus/procfs v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 )

go.sum

@@ -2,8 +2,6 @@ github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk=
@@ -12,25 +10,23 @@ github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
 github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
-github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
-github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
-github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/prometheus/client_model v0.6.3 h1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=
+github.com/prometheus/client_model v0.6.3/go.mod h1:gpN5P9S7Rr6Yr92PiQ+Ixvhf6JZEkF1dnxsYL2aPBEM=
+github.com/prometheus/common v0.71.0 h1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=
+github.com/prometheus/common v0.71.0/go.mod h1:CLJ5H8TEsGX8bl31BdMkfhIZ+QmZ9tBPPotUxUbfcmk=
+github.com/prometheus/procfs v0.22.0 h1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=
+github.com/prometheus/procfs v0.22.0/go.mod h1:CvmFr/GVhIjIvWJZW3tgkODBQMRIf0EyWMQLHCHab58=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
 go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=

main.go

@@ -273,6 +273,7 @@ type Exporter struct {
 }
 
 func ReadSecretFile(secretfilename string) string {
+	// #nosec G703 -- path comes from operator-set *_FILE env vars (docker secrets), not untrusted input
 	file, err := os.Open(filepath.Clean(secretfilename))
 	// flag to check the file format
 	if err != nil {