Merge branch 'main' into fix/enforce-keyless-verification

Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

.chainloop.yml

@@ -4,7 +4,7 @@ organization: chainloop
 projectName: chainloop
 # This indicates the [current version]+next
 # to indicate that we are building a new version of the project
-projectVersion: v1.115.0+next
+projectVersion: v1.117.0+next
 
 # Experimental feature used by Chainloop labs shared workflow https://github.com/chainloop-dev/labs
 # It maps the material names with location in disk so they get automatically attested

.claude/skills/upgrading-golang/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: upgrading-golang
-description: Upgrades Go version across the entire Chainloop codebase including source files, Docker images, CI/CD workflows, and documentation. Use when the user mentions upgrading Go, golang version, or updating Go compiler version.
+description: Upgrades Go version across the entire Chainloop codebase including source files, Docker images, golangci-lint, CI/CD workflows, and documentation. Use when the user mentions upgrading Go, golang version, or updating Go compiler version, or when CI lint fails because golangci-lint was built with an older Go than the one targeted in go.mod.
 ---
 
 # Upgrading Golang Version
@@ -12,7 +12,7 @@ This skill automates the comprehensive Go version upgrade process across all com
 ### 1. Confirm Target Versions
 
 Ask the user:
-1. What Go version they want to upgrade to (e.g., "1.25.3")
+1. What Go version they want to upgrade to (e.g., "1.25.3"). If they give only a minor version (e.g., "1.27"), use the latest patch from `curl -s 'https://go.dev/dl/?mode=json'`.
 2. Whether they also want to upgrade Atlas migrations Docker image (if yes, ask for target Atlas version, e.g., "0.38.0")
 
 ### 2. Get Docker Image Digest
@@ -25,6 +25,16 @@ docker pull golang:X.XX.X
 
 Extract the SHA256 digest from the output (format: `sha256:abc123...`).
 
+If the Docker daemon is not running, read the multi-arch index digest from the registry instead:
+
+```bash
+TOKEN=$(curl -s "https://auth.docker.io/token?service=registry.docker.io&scope=repository:library/golang:pull" | jq -r .token)
+curl -sI -H "Authorization: Bearer $TOKEN" \
+  -H "Accept: application/vnd.oci.image.index.v1+json" \
+  -H "Accept: application/vnd.docker.distribution.manifest.list.v2+json" \
+  https://registry-1.docker.io/v2/library/golang/manifests/X.XX.X | grep -i docker-content-digest
+```
+
 ### 3. Update Source Code
 
 Update the `go` directive in:
@@ -37,6 +47,8 @@ Pattern to replace:
 go X.XX.X
 ```
 
+Then run `go mod tidy` and `go build ./...`.
+
 ### 4. Update Docker Images
 
 Update all Dockerfiles with the new version and SHA256 digest. See [files-to-update.md](files-to-update.md) for the complete list.
@@ -51,26 +63,50 @@ With:
 FROM golang:X.XX.X@sha256:NEW_DIGEST AS builder
 ```
 
-### 5. Update Documentation
+### 5. Update golangci-lint
+
+golangci-lint refuses to run when it was built with a Go version older than the `go` directive in `go.mod` ("the Go language version (goX.YY) used to build golangci-lint is lower than the targeted Go version"). On a Go minor upgrade, bump it to a release that supports the new Go version.
+
+1. Find the first golangci-lint release that adds support for the new Go minor (its changelog has a "goX.YY support" entry): `gh release list -R golangci/golangci-lint`. Prefer the latest release.
+2. Update every `version:` of `golangci/golangci-lint-action` in `.github/workflows/lint.yml`.
+3. Update the install version in the `init` target of `./common.mk` to the same version.
+4. Verify locally the way CI runs it (CI uses `only-new-issues`), from the repo root and from `app/cli`, `app/controlplane` and `app/artifact-cas`:
+
+```bash
+GOBIN=<scratch-dir> go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@vX.Y.Z
+<scratch-dir>/golangci-lint run --new-from-rev=<upstream>/main
+```
+
+For a Go patch upgrade, the golangci-lint bump is not required.
+
+### 5b. Regenerate Protobuf Code
+
+The protoc plugins (`protoc-gen-go`, etc.) format their output with the `go/format` of the Go toolchain that built them. A new Go minor can change how comments in generated `.pb.go` files are formatted, and the CI `Test (main-module)` job fails with "The Git repository is dirty" when the committed files do not match.
+
+1. Rebuild the codegen tools with the new Go: `make init-api-tools`.
+2. Run `make api` (the openapi step needs Docker running) and `make config`.
+3. Commit the regenerated `.pb.go` files. The changes are expected to be comment-only; investigate anything else.
+
+### 6. Update Documentation
 
 Update the version reference in `./CLAUDE.md` under "Key Technologies":
 ```markdown
-- **Language**: Go X.XX.X. To know how to upgrade go version, see docs/runbooks
+- **Language**: Go X.XX.X
 ```
 
-### 6. Update Atlas Docker Image and CLI (Optional)
+### 7. Update Atlas Docker Image and CLI (Optional)
 
 If the user requested an Atlas upgrade:
 
-**6a. Pull the Atlas Docker image and extract its SHA256 digest:**
+**7a. Pull the Atlas Docker image and extract its SHA256 digest:**
 
 ```bash
 docker pull arigaio/atlas:X.XX.X
 ```
 
 Extract the SHA256 digest from the output (format: `sha256:abc123...`).
 
-**6b. Update `./app/controlplane/Dockerfile.migrations`:**
+**7b. Update `./app/controlplane/Dockerfile.migrations`:**
 
 Pattern to replace:
 ```dockerfile
@@ -100,17 +136,11 @@ If the command fails or the version is not available, do NOT update common.mk. O
 
 Update the Atlas CLI installation version in the `init` target:
 
-Pattern to replace:
-```makefile
-curl -sSf https://atlasgo.sh | ATLAS_VERSION=vX.XX.X sh -s -- -y
-```
-
-With the new version (note: use `v` prefix for the version):
 ```makefile
 curl -sSf https://atlasgo.sh | ATLAS_VERSION=vX.XX.X sh -s -- -y
 ```
 
-### 7. Verify Changes
+### 8. Verify Changes
 
 Run verification commands:
 ```bash
@@ -120,8 +150,9 @@ make lint
 
 If errors occur, address them before completing the upgrade.
 
-### 8. Final Checks
+### 9. Final Checks
 
+- Search for leftover references to the old version: `grep -rnE "golang:OLD|go OLD|OLD_MINOR\.[0-9]" --exclude=go.sum .`
 - Ensure all license headers are updated (2024 → 2024-2025 or add current year)
 - Run `buf format -w` if any proto files were affected
 - Run `wire ./...` if any constructor dependencies changed
@@ -131,5 +162,6 @@ If errors occur, address them before completing the upgrade.
 
 - Always use SHA256 digests for Docker images for security and reproducibility
 - The dagger module (`./extras/dagger/go.mod`) must NOT be updated
+- GitHub Actions workflows read the Go version from `go.mod` (`go-version-file`), so they need no change for Go itself
 - Test thoroughly as Go upgrades can introduce breaking changes
 - Multiple components use Go: CLI, Control Plane, and Artifact CAS

.claude/skills/upgrading-golang/files-to-update.md

@@ -13,9 +13,7 @@ This reference lists all files that must be updated when upgrading Go versions.
 ## Docker Images
 
 ### Dockerfiles (Golang)
-- `./app/artifact-cas/Dockerfile`
 - `./app/artifact-cas/Dockerfile.goreleaser`
-- `./app/controlplane/Dockerfile`
 - `./app/controlplane/Dockerfile.goreleaser`
 - `./app/cli/Dockerfile.goreleaser`
 
@@ -24,6 +22,17 @@ Update pattern in all:
 FROM golang:X.XX.X@sha256:DIGEST AS builder
 ```
 
+## golangci-lint (Go minor upgrades)
+
+- `./.github/workflows/lint.yml` - every `version:` of `golangci/golangci-lint-action` (main module, apps, and dagger module jobs)
+- `./common.mk` - golangci-lint install version in the `init` target
+
+Keep both on the same golangci-lint version.
+
+## GitHub Actions
+
+No change needed for Go itself: `test.yml`, `lint.yml`, `release.yaml` and `codeql.yml` use `go-version-file: 'go.mod'`.
+
 ### Atlas Files (Optional)
 - `./app/controlplane/Dockerfile.migrations` - Docker image for migrations
 - `./common.mk` - CLI tool installation in `make init`
@@ -48,18 +57,20 @@ curl -sSf https://atlasgo.sh | ATLAS_VERSION=vX.XX.X sh -s -- -y
 ### Project Documentation
 - `./CLAUDE.md` - Update "Key Technologies" section:
   ```markdown
-  - **Language**: Go X.XX.X. To know how to upgrade go version, see docs/runbooks
+  - **Language**: Go X.XX.X
   ```
 
 ## Summary
 
-**Total files to update for Go**: 13 files
+**Files to update for Go**: 5 files
 - 1 go.mod file
-- 5 Dockerfiles (Golang)
-- 5 GitHub Actions workflows
-- 1 example workflow
+- 3 Dockerfiles (Golang)
 - 1 documentation file
 
+**golangci-lint (Go minor upgrades)**: 2 files
+- 1 GitHub Actions workflow (lint.yml)
+- 1 Makefile (common.mk)
+
 **Optional Atlas upgrade**: 2 files
 - 1 Dockerfile (Atlas migrations)
 - 1 Makefile (Atlas CLI in make init)

.github/workflows/lint.yml

@@ -37,15 +37,15 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         if: ${{ matrix.app == 'main-module' }}
         with:
-          version: v2.9.0
+          version: v2.14.0
           only-new-issues: 'true'
 
       - name: Lint ${{ matrix.app }}
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         if: ${{ matrix.app != 'main-module' }}
         with:
           working-directory: app/${{ matrix.app }}
-          version: v2.9.0
+          version: v2.14.0
           only-new-issues: 'true'
 
   lint-protos:
@@ -87,5 +87,5 @@ jobs:
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           working-directory: extras/dagger
-          version: v2.9.0
+          version: v2.14.0
           only-new-issues: 'true'