chore(deps): bump go 1.23.5 & tools

.github/workflows/ci-build.yaml

@@ -14,7 +14,7 @@ on:
 env:
   # Golang version to use across CI steps
   # renovate: datasource=golang-version packageName=golang
-  GOLANG_VERSION: '1.23.3'
+  GOLANG_VERSION: '1.23.5'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -39,7 +39,7 @@ jobs:
           files_yaml: |
             backend:
               - '!ui/**'
-              - '!**.md'            
+              - '!**.md'
               - '!**/*.md'
               - '!docs/**'
             frontend:
@@ -94,8 +94,8 @@ jobs:
 
   lint-go:
     permissions:
-      contents: read  # for actions/checkout to fetch code
-      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
+      contents: read # for actions/checkout to fetch code
+      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
     name: Lint Go code
     if: ${{ needs.changes.outputs.backend == 'true' }}
     runs-on: ubuntu-22.04
@@ -417,15 +417,15 @@ jobs:
       - changes
     env:
       GOPATH: /home/runner/go
-      ARGOCD_FAKE_IN_CLUSTER: "true"
-      ARGOCD_SSH_DATA_PATH: "/tmp/argo-e2e/app/config/ssh"
-      ARGOCD_TLS_DATA_PATH: "/tmp/argo-e2e/app/config/tls"
-      ARGOCD_E2E_SSH_KNOWN_HOSTS: "../fixture/certs/ssh_known_hosts"
-      ARGOCD_E2E_K3S: "true"
-      ARGOCD_IN_CI: "true"
-      ARGOCD_E2E_APISERVER_PORT: "8088"
-      ARGOCD_APPLICATION_NAMESPACES: "argocd-e2e-external,argocd-e2e-external-2"
-      ARGOCD_SERVER: "127.0.0.1:8088"
+      ARGOCD_FAKE_IN_CLUSTER: 'true'
+      ARGOCD_SSH_DATA_PATH: '/tmp/argo-e2e/app/config/ssh'
+      ARGOCD_TLS_DATA_PATH: '/tmp/argo-e2e/app/config/tls'
+      ARGOCD_E2E_SSH_KNOWN_HOSTS: '../fixture/certs/ssh_known_hosts'
+      ARGOCD_E2E_K3S: 'true'
+      ARGOCD_IN_CI: 'true'
+      ARGOCD_E2E_APISERVER_PORT: '8088'
+      ARGOCD_APPLICATION_NAMESPACES: 'argocd-e2e-external,argocd-e2e-external-2'
+      ARGOCD_SERVER: '127.0.0.1:8088'
       GITHUB_TOKEN: ${{ secrets.E2E_TEST_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
       GITLAB_TOKEN: ${{ secrets.E2E_TEST_GITLAB_TOKEN }}
     steps:
@@ -549,4 +549,4 @@ jobs:
             exit 0
           else
             exit 1
-          fi
+          fi

.github/workflows/image.yaml

@@ -7,7 +7,7 @@ on:
   pull_request:
     branches:
       - master
-    types: [ labeled, unlabeled, opened, synchronize, reopened ]
+    types: [labeled, unlabeled, opened, synchronize, reopened]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -46,22 +46,22 @@ jobs:
     needs: [set-vars]
     permissions:
       contents: read
-      packages: write  # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
+      packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
       id-token: write # for creating OIDC tokens for signing.
     if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name != 'push' }}
     uses: ./.github/workflows/image-reuse.yaml
     with:
       # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
       # renovate: datasource=golang-version packageName=golang
-      go-version: 1.23.3
+      go-version: 1.23.5
       platforms: ${{ needs.set-vars.outputs.platforms }}
       push: false
 
   build-and-publish:
     needs: [set-vars]
     permissions:
       contents: read
-      packages: write  # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
+      packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
       id-token: write # for creating OIDC tokens for signing.
     if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
     uses: ./.github/workflows/image-reuse.yaml
@@ -70,7 +70,7 @@ jobs:
       ghcr_image_name: ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }}
       # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
       # renovate: datasource=golang-version packageName=golang
-      go-version: 1.23.3
+      go-version: 1.23.5
       platforms: ${{ needs.set-vars.outputs.platforms }}
       push: true
     secrets:
@@ -101,8 +101,8 @@ jobs:
       - build-and-publish
       - set-vars
     permissions:
-      contents: write  # for git to push upgrade commit if not already deployed
-      packages: write  # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
+      contents: write # for git to push upgrade commit if not already deployed
+      packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
     if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
     runs-on: ubuntu-22.04
     steps:
@@ -116,4 +116,3 @@ jobs:
           git config --global user.name 'CI'
           git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ needs.set-vars.outputs.image-tag }}' && git push)
         working-directory: argoproj-deployments/argocd
-

.github/workflows/release.yaml

@@ -11,7 +11,7 @@ permissions: {}
 
 env:
   # renovate: datasource=golang-version packageName=golang
-  GOLANG_VERSION: '1.23.3' # Note: go-version must also be set in job argocd-image.with.go-version
+  GOLANG_VERSION: '1.23.5' # Note: go-version must also be set in job argocd-image.with.go-version
 
 jobs:
   argocd-image:
@@ -25,28 +25,28 @@ jobs:
       quay_image_name: quay.io/argoproj/argocd:${{ github.ref_name }}
       # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
       # renovate: datasource=golang-version packageName=golang
-      go-version: 1.23.3
+      go-version: 1.23.5
       platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
       push: true
     secrets:
       quay_username: ${{ secrets.RELEASE_QUAY_USERNAME }}
       quay_password: ${{ secrets.RELEASE_QUAY_TOKEN }}
 
   argocd-image-provenance:
-      needs: [argocd-image]
-      permissions:
-        actions: read # for detecting the Github Actions environment.
-        id-token: write # for creating OIDC tokens for signing.
-        packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
-      # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
-      if: github.repository == 'argoproj/argo-cd'
-      uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
-      with:
-        image: quay.io/argoproj/argocd
-        digest: ${{ needs.argocd-image.outputs.image-digest }}
-      secrets:
-        registry-username: ${{ secrets.RELEASE_QUAY_USERNAME }}
-        registry-password: ${{ secrets.RELEASE_QUAY_TOKEN }}
+    needs: [argocd-image]
+    permissions:
+      actions: read # for detecting the Github Actions environment.
+      id-token: write # for creating OIDC tokens for signing.
+      packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
+    # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
+    if: github.repository == 'argoproj/argo-cd'
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      image: quay.io/argoproj/argocd
+      digest: ${{ needs.argocd-image.outputs.image-digest }}
+    secrets:
+      registry-username: ${{ secrets.RELEASE_QUAY_USERNAME }}
+      registry-password: ${{ secrets.RELEASE_QUAY_TOKEN }}
 
   goreleaser:
     needs:
@@ -107,7 +107,7 @@ jobs:
       - name: Generate subject for provenance
         id: hash
         env:
-          ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
+          ARTIFACTS: '${{ steps.run-goreleaser.outputs.artifacts }}'
         run: |
           set -euo pipefail
 
@@ -128,8 +128,8 @@ jobs:
     # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
     uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
     with:
-      base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
-      provenance-name: "argocd-cli.intoto.jsonl"
+      base64-subjects: '${{ needs.goreleaser.outputs.hashes }}'
+      provenance-name: 'argocd-cli.intoto.jsonl'
       upload-assets: true
 
   generate-sbom:
@@ -164,7 +164,7 @@ jobs:
           SIGS_BOM_VERSION: v0.2.1
           # comma delimited list of project relative folders to inspect for package
           # managers (gomod, yarn, npm).
-          PROJECT_FOLDERS: ".,./ui"
+          PROJECT_FOLDERS: '.,./ui'
           # full qualified name of the docker image to be inspected
           DOCKER_IMAGE: quay.io/argoproj/argocd:${{ github.ref_name }}
         run: |
@@ -212,8 +212,8 @@ jobs:
     # Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
     uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
     with:
-      base64-subjects: "${{ needs.generate-sbom.outputs.hashes }}"
-      provenance-name: "argocd-sbom.intoto.jsonl"
+      base64-subjects: '${{ needs.generate-sbom.outputs.hashes }}'
+      provenance-name: 'argocd-sbom.intoto.jsonl'
       upload-assets: true
 
   post-release:
@@ -296,7 +296,7 @@ jobs:
         uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
         with:
           commit-message: Bump version in master
-          title: "chore: Bump version in master"
+          title: 'chore: Bump version in master'
           body: All images built from master should indicate which version we are on track for.
           signoff: true
           branch: update-version

Dockerfile

@@ -4,7 +4,7 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b
 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image
 # Also used as the image in CI jobs so needs all dependencies
 ####################################################################################################
-FROM docker.io/library/golang:1.23.3@sha256:d56c3e08fe5b27729ee3834854ae8f7015af48fd651cd25d1e3bcf3c19830174 AS builder
+FROM docker.io/library/golang:1.23.5@sha256:8c10f21bec412f08f73aa7b97ca5ac5f28a39d8a88030ad8a339fd0a781d72b4 AS builder
 
 RUN echo 'deb http://archive.debian.org/debian buster-backports main' >> /etc/apt/sources.list
 
@@ -101,7 +101,7 @@ RUN HOST_ARCH=$TARGETARCH NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OP
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
 ####################################################################################################
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.23.3@sha256:d56c3e08fe5b27729ee3834854ae8f7015af48fd651cd25d1e3bcf3c19830174 AS argocd-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.23.5@sha256:8c10f21bec412f08f73aa7b97ca5ac5f28a39d8a88030ad8a339fd0a781d72b4 AS argocd-build
 
 WORKDIR /go/src/github.com/argoproj/argo-cd
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/argoproj/argo-cd/v3
 
-go 1.22.0
+go 1.23.5
 
 require (
 	code.gitea.io/sdk/gitea v0.20.0

hack/get-previous-release/go.mod

@@ -1,6 +1,6 @@
 module github.com/argoproj/argo-cd/get-previous-release
 
-go 1.22.5
+go 1.23.5
 
 require (
 	github.com/stretchr/testify v1.9.0

hack/installers/checksums/add-protoc-checksums.sh

@@ -1,7 +1,9 @@
-#!/usr/bin/env sh
+#!/usr/bin/env bash
 
 # Usage: ./add-protoc-checksums.sh 27.2  # use the desired version
 
+[[ $OSTYPE == 'darwin'* ]] && sha256sum() { shasum -a 256 "$@" ; }
+
 set -e
 for arch in aarch_64 ppcle_64 s390_64 x86_64; do
   wget "https://github.com/protocolbuffers/protobuf/releases/download/v$1/protoc-$1-linux-$arch.zip" -O "protoc-$1-linux-$arch.zip"
@@ -13,4 +15,4 @@ for arch in aarch_64 x86_64; do
   wget "https://github.com/protocolbuffers/protobuf/releases/download/v$1/protoc-$1-osx-$arch.zip" -O "protoc-$1-osx-$arch.zip"
   sha256sum "protoc-$1-osx-$arch.zip" > "protoc-$1-osx-$arch.zip.sha256"
   rm "protoc-$1-osx-$arch.zip"
-done
+done

hack/installers/checksums/kustomize_5.6.0_darwin_amd64.tar.gz.sha256

@@ -0,0 +1 @@
+3432be97f9fb4899148bf2485ccf9080e5e7702758eb16c92cd2f2f335e12a03  kustomize_5.6.0_darwin_amd64.tar.gz

hack/installers/checksums/kustomize_5.6.0_darwin_arm64.tar.gz.sha256

@@ -0,0 +1 @@
+791d9497d2973d4af17c9c0c2b3991ce82e61d1a2bf79f4ef78dd9dce25a6d3d  kustomize_5.6.0_darwin_arm64.tar.gz

hack/installers/checksums/kustomize_5.6.0_linux_amd64.tar.gz.sha256

@@ -0,0 +1 @@
+54e4031ddc4e7fc59e408da29e7c646e8e57b8088c51b84b3df0864f47b5148f  kustomize_5.6.0_linux_amd64.tar.gz

hack/installers/checksums/kustomize_5.6.0_linux_arm64.tar.gz.sha256

@@ -0,0 +1 @@
+ad8ab62d4f6d59a8afda0eec4ba2e5cd2f86bf1afeea4b78d06daac945eb0660  kustomize_5.6.0_linux_arm64.tar.gz

hack/installers/checksums/kustomize_5.6.0_linux_ppc64le.tar.gz.sha256

@@ -0,0 +1 @@
+377ac4cc7d1536aeba6c34e9407bcd0ba48193bc1c3fdb6cc69bcade583e5fa7  kustomize_5.6.0_linux_ppc64le.tar.gz

hack/installers/checksums/kustomize_5.6.0_linux_s390x.tar.gz.sha256

@@ -0,0 +1 @@
+e633bddd040a1d1acedac655044c2d2bcbba048481662ff6035ea1205ee9a869  kustomize_5.6.0_linux_s390x.tar.gz

hack/installers/checksums/protoc-29.3-linux-aarch_64.zip.sha256

@@ -0,0 +1 @@
+6427349140e01f06e049e707a58709a4f221ae73ab9a0425bc4a00c8d0e1ab32  protoc-29.3-linux-aarch_64.zip

hack/installers/checksums/protoc-29.3-linux-ppcle_64.zip.sha256

@@ -0,0 +1 @@
+0e9894ec2e3992b14d183e7ceac16465d6a6ee73e1d234695d80e6d1e947014c  protoc-29.3-linux-ppcle_64.zip

hack/installers/checksums/protoc-29.3-linux-s390_64.zip.sha256

@@ -0,0 +1 @@
+637857fdbab0b1334bdb2b08733f0be49685e693011b6104809491ac62fbd4d5  protoc-29.3-linux-s390_64.zip

hack/installers/checksums/protoc-29.3-linux-x86_64.zip.sha256

@@ -0,0 +1 @@
+3e866620c5be27664f3d2fa2d656b5f3e09b5152b42f1bedbf427b333e90021a  protoc-29.3-linux-x86_64.zip

hack/installers/checksums/protoc-29.3-osx-aarch_64.zip.sha256

@@ -0,0 +1 @@
+2b8a3403cd097f95f3ba656e14b76c732b6b26d7f183330b11e36ef2bc028765  protoc-29.3-osx-aarch_64.zip

hack/installers/checksums/protoc-29.3-osx-x86_64.zip.sha256

@@ -0,0 +1 @@
+9a788036d8f9854f7b03c305df4777cf0e54e5b081e25bf15252da87e0e90875  protoc-29.3-osx-x86_64.zip

hack/installers/install-protoc.sh

@@ -41,7 +41,7 @@ $(dirname $0)/compare-chksum.sh
 mkdir -p /tmp/protoc-${protoc_version}
 unzip -o $DOWNLOADS/${TARGET_FILE} -d /tmp/protoc-${protoc_version}
 mkdir -p ${DIST_PATH}/protoc-include
-cp /tmp/protoc-${protoc_version}/bin/protoc ${DIST_PATH}/protoc
+sudo cp /tmp/protoc-${protoc_version}/bin/protoc ${DIST_PATH}/protoc
 chmod +x ${DIST_PATH}/protoc
 cp -a /tmp/protoc-${protoc_version}/include/* ${DIST_PATH}/protoc-include
 chmod -R +rx ${DIST_PATH}/protoc-include

hack/tool-versions.sh

@@ -12,7 +12,5 @@
 # add-kustomize-checksums.sh to help download checksums.
 ###############################################################################
 helm3_version=3.17.0
-kubectl_version=1.17.8
-kubectx_version=0.6.3
-kustomize5_version=5.4.3
-protoc_version=27.2
+kustomize5_version=5.6.0
+protoc_version=29.3