Bump go version to 1.22.7

[mhutchinson]

Updated lint and vuln checks to pin to the version in go.mod file.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 86.93%. Comparing base (4ebea17) to head (09866b8).
Report is 44 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #141      +/-   ##
==========================================
- Coverage   89.33%   86.93%   -2.41%     
==========================================
  Files           7        7              
  Lines         497      375     -122     
==========================================
- Hits          444      326     -118     
+ Misses         48       44       -4     
  Partials        5        5              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[mhutchinson]

This is a bit messy. ClusterFuzz isn't enjoying the new X.Y.Z go.mod versions, and wants only X.Y. I'm trying to track down where this is coming from.

Looking in the build logs we see it pulls gcr.io/oss-fuzz-base/base-builder-go@sha256:c7f01a616db0fc554d98edbd7d49a7177197f77fd4e1371bcb7774d7eac8216d, which is quite old now:

docker run -it --entrypoint /bin/sh gcr.io/oss-fuzz-base/base-builder-go@sha256:c7f01a616db0fc554d98edbd7d49a7177197f77fd4e1371bcb7774d7eac8216d
/root/.go/bin/go version
go version go1.19 linux/amd64

There is a newer image for this which bundles with go1.22:

docker run -it --entrypoint /bin/sh gcr.io/oss-fuzz-base/base-builder-go@sha256:37d560af1d31ae8d339902acaedb8eb6fdf3f04469706f39e3bbea44fa3fdeec
/root/.go/bin/go version
go version go1.22.1 linux/amd64

If we can get this to pull the later container for base-builder-go then I expect this will resolve itself.

[roger2hk]

This is a bit messy. ClusterFuzz isn't enjoying the new X.Y.Z go.mod versions, and wants only X.Y. I'm trying to track down where this is coming from.

Looking in the build logs we see it pulls gcr.io/oss-fuzz-base/base-builder-go@sha256:c7f01a616db0fc554d98edbd7d49a7177197f77fd4e1371bcb7774d7eac8216d, which is quite old now:

docker run -it --entrypoint /bin/sh gcr.io/oss-fuzz-base/base-builder-go@sha256:c7f01a616db0fc554d98edbd7d49a7177197f77fd4e1371bcb7774d7eac8216d
/root/.go/bin/go version
go version go1.19 linux/amd64

There is a newer image for this which bundles with go1.22:

docker run -it --entrypoint /bin/sh gcr.io/oss-fuzz-base/base-builder-go@sha256:37d560af1d31ae8d339902acaedb8eb6fdf3f04469706f39e3bbea44fa3fdeec
/root/.go/bin/go version
go version go1.22.1 linux/amd64

If we can get this to pull the later container for base-builder-go then I expect this will resolve itself.

Does the following changes in go.mod work before oss-fuzz updates the container image?

go 1.22
toolchain 1.22.7

[roger2hk]

This is a bit messy. ClusterFuzz isn't enjoying the new X.Y.Z go.mod versions, and wants only X.Y. I'm trying to track down where this is coming from.
Looking in the build logs we see it pulls gcr.io/oss-fuzz-base/base-builder-go@sha256:c7f01a616db0fc554d98edbd7d49a7177197f77fd4e1371bcb7774d7eac8216d, which is quite old now:

docker run -it --entrypoint /bin/sh gcr.io/oss-fuzz-base/base-builder-go@sha256:c7f01a616db0fc554d98edbd7d49a7177197f77fd4e1371bcb7774d7eac8216d
/root/.go/bin/go version
go version go1.19 linux/amd64

There is a newer image for this which bundles with go1.22:

docker run -it --entrypoint /bin/sh gcr.io/oss-fuzz-base/base-builder-go@sha256:37d560af1d31ae8d339902acaedb8eb6fdf3f04469706f39e3bbea44fa3fdeec
/root/.go/bin/go version
go version go1.22.1 linux/amd64

If we can get this to pull the later container for base-builder-go then I expect this will resolve itself.

Does the following changes in go.mod work before oss-fuzz updates the container image?

go 1.22
toolchain 1.22.7

Oh my bad, the container base image is defined in our repo.