Upgrade CI to go1.18

.github/workflows/release.yaml

@@ -35,15 +35,6 @@ jobs:
           checkName: "Static analysis"
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Check static analysis golangci-lint results
-        uses: fountainhead/action-wait-for-check@v1.0.0
-        id: static-analysis-go1-17
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          # This check name is defined as the github action job name (in .github/workflows/testing.yaml)
-          checkName: "Static analysis against 1.17"
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-
       - name: Check unit test results
         uses: fountainhead/action-wait-for-check@v1.0.0
         id: unit
@@ -90,10 +81,9 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
       - name: Quality gate
-        if: steps.static-analysis-go1-17.outputs.conclusion != 'success' || steps.static-analysis.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
+        if: steps.static-analysis.outputs.conclusion != 'success' || steps.unit.outputs.conclusion != 'success' || steps.integration.outputs.conclusion != 'success' || steps.cli-linux.outputs.conclusion != 'success' || steps.acceptance-linux.outputs.conclusion != 'success' || steps.acceptance-mac.outputs.conclusion != 'success'
         run: |
           echo "Static Analysis Status: ${{ steps.static-analysis.conclusion }}"
-          echo "Static Analysis Status 1.17: ${{ steps.static-analysis-go1-17.conclusion }}"
           echo "Unit Test Status: ${{ steps.unit.outputs.conclusion }}"
           echo "Integration Test Status: ${{ steps.integration.outputs.conclusion }}"
           echo "Acceptance Test (Linux) Status: ${{ steps.acceptance-linux.outputs.conclusion }}"

.github/workflows/validations.yaml

@@ -11,53 +11,6 @@ env:
   GO_STABLE_VERSION: true
 
 jobs:
-  # TODO: please delete me once once we move to 1.18 and golangci-lint works with it.
-  Static-Analysis-Golangci-lint:
-    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
-    name: "Static analysis against 1.17"
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/setup-go@v2
-        with:
-          go-version: "1.17"
-          stable: ${{ env.GO_STABLE_VERSION }}
-
-      - uses: actions/checkout@v2
-
-      - name: Restore tool cache
-        id: tool-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ${{ github.workspace }}/.tmp
-          key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
-
-      - name: Restore go cache
-        id: go-cache
-        uses: actions/cache@v2.1.3
-        with:
-          path: ~/go/pkg/mod
-          key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go-${{ env.GO_VERSION }}-
-
-      - name: (cache-miss) Bootstrap all project dependencies
-        if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
-        run: make bootstrap
-
-      - name: Bootstrap CI environment dependencies
-        run: make ci-bootstrap
-
-      - name: Run linters
-        run: make lint
-
-      # allow for PRs to skip validating the syft version to allow for incremental updates of syft before release.
-      # In this way checks against the main branch (which are required for release) will fail, but PR checks will not
-      - name: Ensure syft version is a release version
-        run: |
-          echo "GitHub reference: ${GITHUB_REF##*/}"
-          git fetch origin main
-          git merge-base --is-ancestor ${GITHUB_REF##*/} origin/main && make validate-syft-release-version || echo "skipping syft version checkk"
-
   Static-Analysis:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Static analysis"

Makefile

@@ -91,7 +91,7 @@ $(TEMPDIR):
 
 .PHONY: bootstrap-tools
 bootstrap-tools: $(TEMPDIR)
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.42.1
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(TEMPDIR)/ v1.45.0
 	curl -sSfL https://raw.githubusercontent.com/wagoodman/go-bouncer/master/bouncer.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	curl -sSfL https://raw.githubusercontent.com/anchore/chronicle/main/install.sh | sh -s -- -b $(TEMPDIR)/ v0.3.0
 	# the only difference between goimports and gosimports is that gosimports removes extra whitespace between import blocks (see https://github.com/golang/go/issues/20818)
@@ -107,7 +107,7 @@ bootstrap: $(RESULTSDIR) bootstrap-go bootstrap-tools ## Download and install al
 	$(call title,Bootstrapping dependencies)
 
 .PHONY: static-analysis
-static-analysis: check-go-mod-tidy check-licenses validate-grype-db-schema
+static-analysis: lint check-go-mod-tidy check-licenses validate-grype-db-schema
 
 .PHONY: lint
 lint: ## Run gofmt + golangci lint checks

grype/presenter/sarif/presenter.go

@@ -179,15 +179,12 @@ func (pres *Presenter) locationPath(l source.Location) string {
 	in := pres.inputPath()
 	path = strings.TrimPrefix(path, "./")
 	// trimmed off any ./ and accounted for dir:. for both path and input path
-	if pres.srcMetadata != nil {
-		switch pres.srcMetadata.Scheme {
-		case source.DirectoryScheme:
-			if filepath.IsAbs(path) || in == "" {
-				return path
-			}
-			// return a path relative to the cwd, if it's not absolute
-			return fmt.Sprintf("%s/%s", in, path)
+	if pres.srcMetadata != nil && pres.srcMetadata.Scheme == source.DirectoryScheme {
+		if filepath.IsAbs(path) || in == "" {
+			return path
 		}
+		// return a path relative to the cwd, if it's not absolute
+		return fmt.Sprintf("%s/%s", in, path)
 	}
 	return path
 }