From 1ee5394b67a0e74567985041effe13788376e36c Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 10:51:24 +0300
Subject: [PATCH 01/11] chore: bump Go to 1.19

Signed-off-by: knqyf263 <knqyf263@gmail.com>
---
 .golangci.yaml    | 2 +-
 Dockerfile.protoc | 2 +-
 go.mod            | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.golangci.yaml b/.golangci.yaml
index 844a86c0269..479087aaca2 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -43,7 +43,7 @@ linters:
     - misspell
 
 run:
-  go: 1.18
+  go: 1.19
   skip-files:
     - ".*._mock.go$"
     - ".*._test.go$"
diff --git a/Dockerfile.protoc b/Dockerfile.protoc
index 791d6185d2c..88671e805ff 100644
--- a/Dockerfile.protoc
+++ b/Dockerfile.protoc
@@ -1,4 +1,4 @@
-FROM golang:1.18.4
+FROM golang:1.19.0
 
 # Install protoc (cf. http://google.github.io/proto-lens/installing-protoc.html)
 ENV PROTOC_ZIP=protoc-3.19.4-linux-x86_64.zip
diff --git a/go.mod b/go.mod
index beeaa91a270..15dec9f3c00 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/aquasecurity/trivy
 
-go 1.18
+go 1.19
 
 require (
 	github.com/CycloneDX/cyclonedx-go v0.6.0

From 44bc04261450c3018d5e7789a823b4c81ecf51bb Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 10:51:50 +0300
Subject: [PATCH 02/11] use go-version-file

---
 .github/workflows/reusable-release.yaml |  5 ++---
 .github/workflows/test.yaml             | 11 ++++-------
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/reusable-release.yaml b/.github/workflows/reusable-release.yaml
index 0db71c1ccad..47cc3d3941e 100644
--- a/.github/workflows/reusable-release.yaml
+++ b/.github/workflows/reusable-release.yaml
@@ -13,7 +13,6 @@ on:
         type: string
 
 env:
-  GO_VERSION: "1.18"
   GH_USER: "aqua-bot"
 
 jobs:
@@ -63,7 +62,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: go.mod
 
       - name: Checkout code
         uses: actions/checkout@v3
@@ -106,4 +105,4 @@ jobs:
           # use 'github.sha' to create a unique cache folder for each run.
           # use 'github.workflow' to create a unique cache folder if some runs have same commit sha.
           # e.g. build and release runs
-          key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}
\ No newline at end of file
+          key: ${{ runner.os }}-bins-${{github.workflow}}-${{github.sha}}
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index bd0f3353b45..0f67d9bd689 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -10,7 +10,6 @@ on:
       - 'LICENSE'
   pull_request:
 env:
-  GO_VERSION: "1.18"
   TINYGO_VERSION: "0.24.0"
 jobs:
   test:
@@ -22,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: ${{ env.GO_VERSION }}
+          go-version-file: go.mod
 
       - name: go mod tidy
         run: |
@@ -54,8 +53,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v3
       with:
-        go-version: ${{ env.GO_VERSION }}
-      id: go
+        go-version-file: go.mod
 
     - name: Check out code into the Go module directory
       uses: actions/checkout@v3
@@ -70,8 +68,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: ${{ env.GO_VERSION }}
-        id: go
+          go-version-file: go.mod
 
       - name: Install TinyGo
         run: |
@@ -107,7 +104,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v3
       with:
-        go-version: ${{ env.GO_VERSION }}
+        go-version-file: go.mod
 
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v3

From 05b17928fe36ac04fde57bf010e832f3fd3d861b Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 10:55:06 +0300
Subject: [PATCH 03/11] Add ./

---
 .github/workflows/reusable-release.yaml | 2 +-
 .github/workflows/test.yaml             | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/reusable-release.yaml b/.github/workflows/reusable-release.yaml
index 47cc3d3941e..9de974a8847 100644
--- a/.github/workflows/reusable-release.yaml
+++ b/.github/workflows/reusable-release.yaml
@@ -62,7 +62,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version-file: go.mod
+          go-version-file: './go.mod'
 
       - name: Checkout code
         uses: actions/checkout@v3
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 0f67d9bd689..f30376940cb 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version-file: go.mod
+          go-version-file: './go.mod'
 
       - name: go mod tidy
         run: |
@@ -53,7 +53,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v3
       with:
-        go-version-file: go.mod
+        go-version-file: './go.mod'
 
     - name: Check out code into the Go module directory
       uses: actions/checkout@v3
@@ -68,7 +68,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version-file: go.mod
+          go-version-file: './go.mod'
 
       - name: Install TinyGo
         run: |
@@ -104,7 +104,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v3
       with:
-        go-version-file: go.mod
+        go-version-file: './go.mod'
 
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v3

From 5ab02196fdee99b7901c64d675376617b4685813 Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 10:57:22 +0300
Subject: [PATCH 04/11] checkout first

---
 .github/workflows/reusable-release.yaml |  2 +-
 .github/workflows/test.yaml             | 28 ++++++++++++-------------
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/reusable-release.yaml b/.github/workflows/reusable-release.yaml
index 9de974a8847..47cc3d3941e 100644
--- a/.github/workflows/reusable-release.yaml
+++ b/.github/workflows/reusable-release.yaml
@@ -62,7 +62,7 @@ jobs:
       - name: Setup Go
         uses: actions/setup-go@v3
         with:
-          go-version-file: './go.mod'
+          go-version-file: go.mod
 
       - name: Checkout code
         uses: actions/checkout@v3
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index f30376940cb..97caa63fd3b 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version-file: './go.mod'
+          go-version-file: go.mod
 
       - name: go mod tidy
         run: |
@@ -50,34 +50,34 @@ jobs:
     name: Integration Test
     runs-on: ubuntu-latest
     steps:
-    - name: Set up Go
-      uses: actions/setup-go@v3
-      with:
-        go-version-file: './go.mod'
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v3
 
-    - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version-file: go.mod
 
-    - name: Run integration tests
-      run: make test-integration
+      - name: Run integration tests
+        run: make test-integration
 
   module-test:
     name: Module Integration Test
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version-file: './go.mod'
+          go-version-file: go.mod
 
       - name: Install TinyGo
         run: |
           wget https://github.com/tinygo-org/tinygo/releases/download/v${TINYGO_VERSION}/tinygo_${TINYGO_VERSION}_amd64.deb
           sudo dpkg -i tinygo_${TINYGO_VERSION}_amd64.deb
 
-      - name: Checkout
-        uses: actions/checkout@v3
-
       - name: Run module integration tests
         run: |
           make test-module-integration
@@ -104,7 +104,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v3
       with:
-        go-version-file: './go.mod'
+        go-version-file: go.mod
 
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@v3

From d73a9ffb2c16dd9104a2e8bbc2faa57cdab1284f Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 11:02:42 +0300
Subject: [PATCH 05/11] bump golang-ci-lint

---
 .github/workflows/test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 97caa63fd3b..0febf790144 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -34,7 +34,7 @@ jobs:
       - name: Lint
         uses: golangci/golangci-lint-action@v3.2.0
         with:
-          version: v1.45
+          version: v1.49
           args: --deadline=30m
           skip-cache: true # https://github.com/golangci/golangci-lint-action/issues/244#issuecomment-1052197778
 

From 82944951697d7aded9bd503054ce5c4a1fa81421 Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 11:04:54 +0300
Subject: [PATCH 06/11] bump TinyGo

---
 .github/workflows/test.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 0febf790144..7da575afb19 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -10,7 +10,7 @@ on:
       - 'LICENSE'
   pull_request:
 env:
-  TINYGO_VERSION: "0.24.0"
+  TINYGO_VERSION: "0.25.0"
 jobs:
   test:
     name: Test

From a4db279885bede3d9061e27b8813c78a29584758 Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 12:22:14 +0300
Subject: [PATCH 07/11] fix lint issues

---
 .golangci.yaml                    |  5 ++---
 Makefile                          |  2 +-
 pkg/fanal/analyzer/pkg/rpm/rpm.go | 10 ++++++----
 pkg/fanal/artifact/sbom/sbom.go   |  4 +---
 pkg/flag/cache_flags.go           | 17 +++++++++--------
 pkg/flag/misconf_flags.go         | 11 ++++++-----
 pkg/flag/options.go               |  2 +-
 pkg/flag/report_flags.go          | 11 +++++------
 pkg/k8s/commands/run.go           |  5 +++--
 pkg/sbom/cyclonedx/unmarshal.go   | 19 +++++++++----------
 10 files changed, 43 insertions(+), 43 deletions(-)

diff --git a/.golangci.yaml b/.golangci.yaml
index 479087aaca2..bcdaafec3a3 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -21,18 +21,17 @@ linters-settings:
     local-prefixes: github.com/aquasecurity
   gosec:
     excludes:
+      - G114
       - G204
       - G402
 
 linters:
   disable-all: true
   enable:
-    - structcheck
+    - unused
     - ineffassign
     - typecheck
     - govet
-    - varcheck
-    - deadcode
     - revive
     - gosec
     - unconvert
diff --git a/Makefile b/Makefile
index 8a81662f199..6f8c498b710 100644
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,7 @@ $(GOBIN)/crane:
 	go install github.com/google/go-containerregistry/cmd/crane@v0.9.0
 
 $(GOBIN)/golangci-lint:
-	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(GOBIN) v1.45.2
+	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(GOBIN) v1.49.0
 
 $(GOBIN)/labeler:
 	go install github.com/knqyf263/labeler@latest
diff --git a/pkg/fanal/analyzer/pkg/rpm/rpm.go b/pkg/fanal/analyzer/pkg/rpm/rpm.go
index f35b430e64d..c4431a918a9 100644
--- a/pkg/fanal/analyzer/pkg/rpm/rpm.go
+++ b/pkg/fanal/analyzer/pkg/rpm/rpm.go
@@ -160,10 +160,12 @@ func (a rpmPkgAnalyzer) parsePkgInfo(rc io.Reader) ([]types.Package, []string, e
 	return pkgs, installedFiles, nil
 }
 
-// splitFileName returns a name, version, release, epoch, arch
-// e.g.
-//    foo-1.0-1.i386.rpm returns foo, 1.0, 1, i386
-//    1:bar-9-123a.ia64.rpm returns bar, 9, 123a, 1, ia64
+// splitFileName returns a name, version, release, epoch, arch:
+//
+//	e.g.
+//		foo-1.0-1.i386.rpm => foo, 1.0, 1, i386
+//		1:bar-9-123a.ia64.rpm => bar, 9, 123a, 1, ia64
+//
 // https://github.com/rpm-software-management/yum/blob/043e869b08126c1b24e392f809c9f6871344c60d/rpmUtils/miscutils.py#L301
 func splitFileName(filename string) (name, ver, rel string, err error) {
 	if strings.HasSuffix(filename, ".rpm") {
diff --git a/pkg/fanal/artifact/sbom/sbom.go b/pkg/fanal/artifact/sbom/sbom.go
index d20615d5eb9..bc5310d98f3 100644
--- a/pkg/fanal/artifact/sbom/sbom.go
+++ b/pkg/fanal/artifact/sbom/sbom.go
@@ -13,7 +13,6 @@ import (
 
 	"github.com/aquasecurity/trivy/pkg/attestation"
 	"github.com/aquasecurity/trivy/pkg/fanal/analyzer"
-	"github.com/aquasecurity/trivy/pkg/fanal/analyzer/config"
 	"github.com/aquasecurity/trivy/pkg/fanal/artifact"
 	"github.com/aquasecurity/trivy/pkg/fanal/cache"
 	"github.com/aquasecurity/trivy/pkg/fanal/handler"
@@ -29,8 +28,7 @@ type Artifact struct {
 	analyzer       analyzer.AnalyzerGroup
 	handlerManager handler.Manager
 
-	artifactOption      artifact.Option
-	configScannerOption config.ScannerOption
+	artifactOption artifact.Option
 }
 
 func NewArtifact(filePath string, c cache.ArtifactCache, opt artifact.Option) (artifact.Artifact, error) {
diff --git a/pkg/flag/cache_flags.go b/pkg/flag/cache_flags.go
index d4aad96bd5a..e37f040f778 100644
--- a/pkg/flag/cache_flags.go
+++ b/pkg/flag/cache_flags.go
@@ -9,14 +9,15 @@ import (
 	"golang.org/x/xerrors"
 )
 
-// e.g. config yaml
-// cache:
-//   clear: true
-//   backend: "redis://localhost:6379"
-//   redis:
-//    ca: ca-cert.pem
-//    cert: cert.pem
-//    key: key.pem
+// e.g. config yaml:
+//
+//	cache:
+//	  clear: true
+//	  backend: "redis://localhost:6379"
+//	redis:
+//	  ca: ca-cert.pem
+//	  cert: cert.pem
+//	  key: key.pem
 var (
 	ClearCacheFlag = Flag{
 		Name:       "clear-cache",
diff --git a/pkg/flag/misconf_flags.go b/pkg/flag/misconf_flags.go
index 69356d18e82..2281de2c69e 100644
--- a/pkg/flag/misconf_flags.go
+++ b/pkg/flag/misconf_flags.go
@@ -4,11 +4,12 @@ import (
 	"github.com/aquasecurity/trivy/pkg/log"
 )
 
-// e.g. config yaml
-// misconfiguration:
-//   trace: true
-//   config-policy: "custom-policy/policy"
-//   policy-namespaces: "user"
+// e.g. config yaml:
+//
+//	misconfiguration:
+//	  trace: true
+//	  config-policy: "custom-policy/policy"
+//	  policy-namespaces: "user"
 var (
 	IncludeNonFailuresFlag = Flag{
 		Name:       "include-non-failures",
diff --git a/pkg/flag/options.go b/pkg/flag/options.go
index 35caeb2de46..bf6852b1570 100644
--- a/pkg/flag/options.go
+++ b/pkg/flag/options.go
@@ -289,7 +289,7 @@ func (f *Flags) Bind(cmd *cobra.Command) error {
 	return nil
 }
 
-//nolint: gocyclo
+// nolint: gocyclo
 func (f *Flags) ToOptions(appVersion string, args []string, globalFlags *GlobalFlagGroup, output io.Writer) (Options, error) {
 	var err error
 	opts := Options{
diff --git a/pkg/flag/report_flags.go b/pkg/flag/report_flags.go
index e450b993b1a..13d7b647caf 100644
--- a/pkg/flag/report_flags.go
+++ b/pkg/flag/report_flags.go
@@ -14,12 +14,11 @@ import (
 	"github.com/aquasecurity/trivy/pkg/result"
 )
 
-// e.g. config yaml
-// report:
-//   format: table
-//   dependency-tree: true
-//   exit-code: 1
-//   severity: HIGH,CRITICAL
+// e.g. config yaml:
+//
+//	format: table
+//	dependency-tree: true
+//	severity: HIGH,CRITICAL
 var (
 	FormatFlag = Flag{
 		Name:       "format",
diff --git a/pkg/k8s/commands/run.go b/pkg/k8s/commands/run.go
index 62ca5164f0e..a424c47b047 100644
--- a/pkg/k8s/commands/run.go
+++ b/pkg/k8s/commands/run.go
@@ -93,8 +93,9 @@ func run(ctx context.Context, opts flag.Options, cluster string, artifacts []*ar
 // To show all the results, user needs to specify "--report all" explicitly
 // even though the default value of "--report" is "all".
 //
-// e.g. $ trivy k8s --report all cluster
-//      $ trivy k8s --report all all
+// e.g.
+// $ trivy k8s --report all cluster
+// $ trivy k8s --report all all
 //
 // Or they can use "--format json" with implicit "--report all".
 //
diff --git a/pkg/sbom/cyclonedx/unmarshal.go b/pkg/sbom/cyclonedx/unmarshal.go
index 6f7a2f69d40..1744fb1b559 100644
--- a/pkg/sbom/cyclonedx/unmarshal.go
+++ b/pkg/sbom/cyclonedx/unmarshal.go
@@ -155,17 +155,16 @@ func parsePkgs(components []cdx.Component, seen map[string]struct{}) ([]ftypes.P
 }
 
 // walkDependencies takes all nested dependencies of the root component.
-//
-// e.g. Library A, B, C, D and E will be returned as dependencies of Application 1.
-// type: Application 1
-//   - type: Library A
-//     - type: Library B
-//   - type: Application 2
-//     - type: Library C
-//     - type: Application 3
-//       - type: Library D
-//       - type: Library E
 func (c *CycloneDX) walkDependencies(rootRef string) []cdx.Component {
+	// e.g. Library A, B, C, D and E will be returned as dependencies of Application 1.
+	// type: Application 1
+	//   - type: Library A
+	//     - type: Library B
+	//   - type: Application 2
+	//     - type: Library C
+	//     - type: Application 3
+	//       - type: Library D
+	//       - type: Library E
 	var components []cdx.Component
 	for _, dep := range c.dependencies[rootRef] {
 		component, ok := c.components[dep]

From fc4ba496672ed12ffb3cb403e8def3443f372cee Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 13:34:50 +0300
Subject: [PATCH 08/11] revert go to 1.18

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index 15dec9f3c00..beeaa91a270 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/aquasecurity/trivy
 
-go 1.19
+go 1.18
 
 require (
 	github.com/CycloneDX/cyclonedx-go v0.6.0

From 2006c572f32431fbcb6e67f14be31628821eac05 Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 14:02:15 +0300
Subject: [PATCH 09/11] revert back to 1.19

---
 go.mod | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/go.mod b/go.mod
index beeaa91a270..15dec9f3c00 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/aquasecurity/trivy
 
-go 1.18
+go 1.19
 
 require (
 	github.com/CycloneDX/cyclonedx-go v0.6.0

From 820b21a7ca9d5e9d92c3c6cfc6fe57f09c4aa384 Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 14:11:56 +0300
Subject: [PATCH 10/11] debug

---
 .github/workflows/test.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 7da575afb19..0615bebe3b5 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -58,6 +58,11 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Setup tmate session
+        uses: mxschmitt/action-tmate@v3
+        with:
+          limit-access-to-actor: true
+
       - name: Run integration tests
         run: make test-integration
 

From f31175185b61c2f8dd602172be3e8cd90fadc918 Mon Sep 17 00:00:00 2001
From: knqyf263 <knqyf263@gmail.com>
Date: Tue, 13 Sep 2022 14:45:28 +0300
Subject: [PATCH 11/11] test: sort os packages

---
 .github/workflows/test.yaml                          |  5 -----
 pkg/fanal/test/integration/library_test.go           |  8 ++++++++
 .../goldens/packages/opensuse-leap-151.json.golden   | 12 ++++++------
 .../goldens/packages/suse-15.3_ndb.json.golden       |  8 ++++----
 4 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 0615bebe3b5..7da575afb19 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -58,11 +58,6 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - name: Setup tmate session
-        uses: mxschmitt/action-tmate@v3
-        with:
-          limit-access-to-actor: true
-
       - name: Run integration tests
         run: make test-integration
 
diff --git a/pkg/fanal/test/integration/library_test.go b/pkg/fanal/test/integration/library_test.go
index df496704de1..7c1eec215a5 100644
--- a/pkg/fanal/test/integration/library_test.go
+++ b/pkg/fanal/test/integration/library_test.go
@@ -241,6 +241,14 @@ func commonChecks(t *testing.T, detail types.ArtifactDetail, tc testCase) {
 }
 
 func checkOSPackages(t *testing.T, detail types.ArtifactDetail, tc testCase) {
+	// Sort OS packages for consistency
+	sort.Slice(detail.Packages, func(i, j int) bool {
+		if detail.Packages[i].Name != detail.Packages[j].Name {
+			return detail.Packages[i].Name < detail.Packages[j].Name
+		}
+		return detail.Packages[i].Version < detail.Packages[j].Version
+	})
+
 	splitted := strings.Split(tc.remoteImageName, ":")
 	goldenFile := fmt.Sprintf("testdata/goldens/packages/%s.json.golden", splitted[len(splitted)-1])
 
diff --git a/pkg/fanal/test/integration/testdata/goldens/packages/opensuse-leap-151.json.golden b/pkg/fanal/test/integration/testdata/goldens/packages/opensuse-leap-151.json.golden
index 9209f6f2040..f86b539200c 100644
--- a/pkg/fanal/test/integration/testdata/goldens/packages/opensuse-leap-151.json.golden
+++ b/pkg/fanal/test/integration/testdata/goldens/packages/opensuse-leap-151.json.golden
@@ -209,8 +209,8 @@
   },
   {
     "Name": "gpg-pubkey",
-    "Version": "3dbdc284",
-    "Release": "53674dd4",
+    "Version": "307e3d54",
+    "Release": "5aaa90a5",
     "Arch": "None",
     "License": "pubkey",
     "Layer": {
@@ -219,8 +219,8 @@
   },
   {
     "Name": "gpg-pubkey",
-    "Version": "307e3d54",
-    "Release": "5aaa90a5",
+    "Version": "39db7c82",
+    "Release": "5847eb1f",
     "Arch": "None",
     "License": "pubkey",
     "Layer": {
@@ -229,8 +229,8 @@
   },
   {
     "Name": "gpg-pubkey",
-    "Version": "39db7c82",
-    "Release": "5847eb1f",
+    "Version": "3dbdc284",
+    "Release": "53674dd4",
     "Arch": "None",
     "License": "pubkey",
     "Layer": {
diff --git a/pkg/fanal/test/integration/testdata/goldens/packages/suse-15.3_ndb.json.golden b/pkg/fanal/test/integration/testdata/goldens/packages/suse-15.3_ndb.json.golden
index f697d356845..0b3f4f1acd2 100644
--- a/pkg/fanal/test/integration/testdata/goldens/packages/suse-15.3_ndb.json.golden
+++ b/pkg/fanal/test/integration/testdata/goldens/packages/suse-15.3_ndb.json.golden
@@ -209,8 +209,8 @@
   },
   {
     "Name": "gpg-pubkey",
-    "Version": "39db7c82",
-    "Release": "5f68629b",
+    "Version": "307e3d54",
+    "Release": "5aaa90a5",
     "Arch": "None",
     "License": "pubkey",
     "Layer": {
@@ -219,8 +219,8 @@
   },
   {
     "Name": "gpg-pubkey",
-    "Version": "307e3d54",
-    "Release": "5aaa90a5",
+    "Version": "39db7c82",
+    "Release": "5f68629b",
     "Arch": "None",
     "License": "pubkey",
     "Layer": {