build: publish multi-arch images with rules_oci

.bazelrc

@@ -1,7 +1,5 @@
-run   --workspace_status_command="./tools/print-workspace-status"
-
-build --define repo=changeme --define namespace=node-remediation
-test  --define repo=changeme --define namespace=node-remediation
-run   --define repo=changeme --define namespace=node-remediation
+build --define repo=docker.io/cloudflare --define namespace=node-remediation
+test  --define repo=docker.io/cloudflare --define namespace=node-remediation
+run   --define repo=docker.io/cloudflare --define namespace=node-remediation
 
 try-import %workspace%/user.bazelrc

.bazelversion

@@ -1 +1 @@
-5.4.0
+8.5.1

.github/workflows/check.yaml

@@ -8,7 +8,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.14.0
         with:
           bazelisk-cache: true
@@ -17,16 +17,16 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - uses: actions/setup-go@v5
         with:
           go-version: stable
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
       - uses: bazel-contrib/setup-bazel@0.14.0
         with:
           bazelisk-cache: true

.github/workflows/release.yaml

@@ -6,25 +6,34 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    env:
+      REPO: docker.io/cloudflare
     steps:
       - name: Login to Docker Hub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
-      - run: |
-          git fetch --tags --force
+      - run: git fetch --tags --force
       - uses: bazel-contrib/setup-bazel@0.14.0
         with:
           bazelisk-cache: true
           repository-cache: true
-      - run: bazel --bazelrc=tools/ci.bazelrc run //manifests:stable  > stable.yaml
-      - run: bazel --bazelrc=tools/ci.bazelrc run //manifests:cluster > cluster.yaml
+      - name: Push multi-arch image
+        run: |
+          bazel --bazelrc=tools/ci.bazelrc run //cmd/sciuro:push -- \
+            --repository=${REPO}/sciuro --tag=${GITHUB_REF_NAME}
+      - name: Render manifests
+        run: |
+          bazel --bazelrc=tools/ci.bazelrc build //manifests:stable //manifests:cluster \
+            --define repo=${REPO}
+          cp bazel-bin/manifests/stable.yaml stable.yaml
+          cp bazel-bin/manifests/cluster.yaml cluster.yaml
       - name: Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@v2
         with:
           files: |
             stable.yaml

.golangci.yml

@@ -1,58 +1,17 @@
+version: "2"
+
 run:
   timeout: 5m
-  modules-download-mode: readonly
 
 linters:
-  enable:
-    - bodyclose
-    - contextcheck
-    - copyloopvar
-    - decorder
-    - dogsled
-    - errcheck
-    - errorlint
-    - gochecknoinits
-    - goconst
-    - gocritic
-    - godox
-    - goimports
-    - goprintffuncname
-    - gosec
-    - gosimple
-    - govet
-    - ineffassign
-    - misspell
-    - nakedret
-    - prealloc
-    - revive
-    - staticcheck
-    - stylecheck
-    - typecheck
-    - unconvert
-    - unparam
-    - unused
-linters-settings:
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - experimental
-      - opinionated
-      - performance
-      - style
-    disabled-checks:
-      - commentFormatting
-      - exitAfterDefer
-      - hugeParam
-      - ifElseChain
-      - rangeValCopy
-      - unnecessaryBlock
-  gofmt:
-    simplify: true
-  misspell:
-    locale: US
-    ignore-words:
-      - clas
-  godox:
-    keywords:
-      - HACK
-      - XXX
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+
+formatters:
+  exclusions:
+    generated: lax

BUILD

@@ -1,4 +1,4 @@
-load("@bazel_gazelle//:def.bzl", "gazelle")
+load("@gazelle//:def.bzl", "gazelle")
 
 # gazelle:prefix github.com/cloudflare/sciuro
 gazelle(name = "gazelle")

MODULE.bazel

@@ -0,0 +1,32 @@
+module(
+    name = "sciuro",
+    version = "0.0.0",
+)
+
+bazel_dep(name = "rules_go", version = "0.61.1")
+bazel_dep(name = "gazelle", version = "0.51.3")
+bazel_dep(name = "rules_oci", version = "2.3.0")
+bazel_dep(name = "rules_pkg", version = "1.2.0")
+bazel_dep(name = "aspect_bazel_lib", version = "2.22.5")
+bazel_dep(name = "platforms", version = "1.1.0")
+bazel_dep(name = "bazel_skylib", version = "1.9.0")
+
+go_sdk = use_extension("@rules_go//go:extensions.bzl", "go_sdk")
+go_sdk.download(version = "1.24.13")
+
+include("//:go_deps.MODULE.bazel")
+
+oci = use_extension("@rules_oci//oci:extensions.bzl", "oci")
+
+# Multi-arch distroless static base, suitable for a CGO-free static Go binary.
+# gcr.io/distroless/static-debian12:latest
+oci.pull(
+    name = "distroless_static",
+    digest = "sha256:9c346e4be81b5ca7ff31a0d89eaeade58b0f95cfd3baed1f36083ddb47ca3160",
+    image = "gcr.io/distroless/static-debian12",
+    platforms = [
+        "linux/amd64",
+        "linux/arm64/v8",
+    ],
+)
+use_repo(oci, "distroless_static", "distroless_static_linux_amd64", "distroless_static_linux_arm64_v8")