.version-bump.yml

files:
  "Dockerfile*":
    processors:
      - docker-arg-alpine-tag
      - docker-arg-alpine-digest
      - docker-arg-go-tag
      - docker-arg-go-digest
  ".github/workflows/*.yml":
    processors:
      - gha-golang-matrix
      - gha-golang-release
      - gha-uses-vx
      - gha-uses-semver
      - gha-uses-commit
  "Makefile":
    processors:
      - makefile-gomajor
      - makefile-gosec
      - makefile-go-vulncheck
      - makefile-markdown-lint
      - makefile-osv-scanner
      - makefile-staticcheck
  "go.mod":
    processors:
      - go-mod-golang-release
  ".osv-scanner.toml":
    processors:
      - osv-golang-release

x-processor-tmpl:
  git-commit: &git-commit
    key: "{{ .SourceArgs.url }}:{{ .SourceArgs.ref }}"
    scan: "regexp"
    source: "git-commit"
    filter:
      expr: "^{{ .SourceArgs.ref }}$"
  git-tag-semver: &git-tag-semver
    key: "{{ .SourceArgs.url }}"
    scan: "regexp"
    source: "git-tag"
    filter:
      expr: '^v?\d+\.\d+\.\d+$'
    sort:
      method: "semver"
  registry-digest: &registry-digest
    key: "{{ .SourceArgs.image }}"
    scan: "regexp"
    source: "registry-digest"
  registry-tag-semver: &registry-tag-semver
    key: "{{ .SourceArgs.repo }}"
    scan: "regexp"
    source: "registry-tag"
    filter:
      expr: '^v?\d+\.\d+\.\d+$'
    sort:
      method: "semver"

processors:
  docker-arg-alpine-tag:
    <<: *registry-tag-semver
    scanArgs:
      regexp: '^ARG ALPINE_VER=(?P<Version>v?\d+\.\d+\.\d+)@(?P<SHA>sha256:[0-9a-f]+)\s*$'
    sourceArgs:
      repo: "docker.io/library/alpine"
  docker-arg-alpine-digest:
    <<: *registry-digest
    scanArgs:
      regexp: '^ARG ALPINE_VER=(?P<Tag>v?\d+\.\d+\.\d+)@(?P<Version>sha256:[0-9a-f]+)\s*$'
    sourceArgs:
      image: "docker.io/library/alpine:{{.ScanMatch.Tag}}"
  docker-arg-go-tag:
    <<: *registry-tag-semver
    scanArgs:
      regexp: '^ARG GO_VER=(?P<Version>[a-z0-9\-\.]+)-alpine@(?P<SHA>sha256:[0-9a-f]+)\s*$'
    sourceArgs:
      repo: "docker.io/library/golang"
  docker-arg-go-digest:
    <<: *registry-digest
    scanArgs:
      regexp: '^ARG GO_VER=(?P<Tag>[a-z0-9\-\.]+)@(?P<Version>sha256:[0-9a-f]+)\s*$'
    sourceArgs:
      image: "docker.io/library/golang:{{.ScanMatch.Tag}}"

  gha-golang-matrix:
    <<: *registry-tag-semver
    key: "golang-matrix"
    scanArgs:
      regexp: '^\s*gover: (?P<Version>\[["0-9, \.]+\])\s*$'
    sourceArgs:
      repo: "docker.io/library/golang"
    filter:
      expr: '^v?\d+\.\d+$'
    template: '["{{ index .VerMap ( index .VerList 2 ) }}", "{{ index .VerMap ( index .VerList 1 ) }}", "{{ index .VerMap ( index .VerList 0 ) }}"]'
  gha-golang-release:
    <<: *registry-tag-semver
    key: "golang-latest"
    scanArgs:
      regexp: '^\s*RELEASE_GO_VER: "(?P<Version>v?[0-9\.]+)"\s*$'
    sourceArgs:
      repo: "docker.io/library/golang"
    filter:
      expr: '^v?\d+\.\d+$'
  gha-uses-vx:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^\s+-?\s+uses: (?P<Repo>[^@/]+/[^@/]+)[^@]*@(?P<Commit>[0-9a-f]+)\s+#\s+(?P<Version>v?\d+)\s*$'
    sourceArgs:
      url: "https://github.com/{{ .ScanMatch.Repo }}.git"
    filter:
      expr: '^v?\d+$'
  gha-uses-semver:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^\s+-?\s+uses: (?P<Repo>[^@/]+/[^@/]+)[^@]*@(?P<Commit>[0-9a-f]+)\s+#\s+(?P<Version>v?\d+\.\d+\.\d+)\s*$'
    sourceArgs:
      url: "https://github.com/{{ .ScanMatch.Repo }}.git"
  gha-uses-commit:
    <<: *git-commit
    scanArgs:
      regexp: '^\s+-?\s+uses: (?P<Repo>[^@/]+/[^@/]+)[^@]*@(?P<Version>[0-9a-f]+)\s+#\s+(?P<Ref>[\w\d\.]+)\s*$'
    sourceArgs:
      url: "https://github.com/{{ .ScanMatch.Repo }}.git"
      ref: "{{ .ScanMatch.Ref }}"

  go-mod-golang-release:
    <<: *registry-tag-semver
    key: "golang-oldest"
    scanArgs:
      regexp: '^go (?P<Version>[0-9\.]+)\s*$'
    sourceArgs:
      repo: "docker.io/library/golang"
    filter:
      expr: '^\d+\.\d+$'
    template: '{{ index .VerMap ( index .VerList 2 ) }}'

  makefile-gomajor:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^GOMAJOR_VER\?=(?P<Version>v?[0-9\.]+)\s*$'
    sourceArgs:
      url: "https://github.com/icholy/gomajor.git"
  makefile-gosec:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^GOSEC_VER\?=(?P<Version>v?[0-9\.]+)\s*$'
    sourceArgs:
      url: "https://github.com/securego/gosec.git"
  makefile-go-vulncheck:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^GO_VULNCHECK_VER\?=(?P<Version>v?[0-9\.]+)\s*$'
    sourceArgs:
      url: "https://go.googlesource.com/vuln.git"
  makefile-markdown-lint:
    <<: *registry-tag-semver
    scanArgs:
      regexp: '^MARKDOWN_LINT_VER\?=(?P<Version>v?[0-9\.]+)\s*$'
    sourceArgs:
      repo: "docker.io/davidanson/markdownlint-cli2"
  makefile-osv-scanner:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^OSV_SCANNER_VER\?=(?P<Version>v?[0-9\.]+)\s*$'
    sourceArgs:
      url: "https://github.com/google/osv-scanner.git"
  makefile-staticcheck:
    <<: *git-tag-semver
    scanArgs:
      regexp: '^STATICCHECK_VER\?=(?P<Version>v?[0-9\.]+)\s*$'
    sourceArgs:
      url: "https://github.com/dominikh/go-tools.git"
    filter:
      # repo also has dated tags, ignore versions without a preceding "v"
      expr: '^v\d+\.\d+\.\d+$'

  osv-golang-release:
    <<: *registry-tag-semver
    scanArgs:
      regexp: '^GoVersionOverride = "(?P<Version>v?[0-9\.]+)"\s*$'
    sourceArgs:
      repo: "docker.io/library/golang"

scans:
  regexp:
    type: "regexp"

sources:
  git-commit:
    type: "git"
    args:
      type: "commit"
  git-tag:
    type: "git"
    args:
      type: "tag"
  registry-digest:
    type: "registry"
  registry-tag:
    type: "registry"
    args:
      type: "tag"