Bump go version, add trivy

.github/workflows/ci.yml

@@ -14,15 +14,16 @@ env:
 jobs:
   test:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
 
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: '1.22.9'
+          go-version: '1.24.8'
 
       - name: Install dependencies
         run: |
@@ -40,15 +41,16 @@ jobs:
 
   docker-tests:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
 
       - name: Set up Go
         uses: actions/setup-go@v3
         with:
-          go-version: '1.22.9'
+          go-version: '1.24.8'
 
       - name: Install dependencies
         run: |
@@ -76,7 +78,8 @@ jobs:
   helm-test:
     runs-on: ubuntu-latest
     needs: test
-
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

.github/workflows/docker.yml

@@ -15,6 +15,7 @@ jobs:
     env:
       IS_DEFAULT_BRANCH: ${{ github.ref == format('refs/heads/{0}', 'main') }}
       IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
+      IS_PUBLISH: ${{ github.event_name == 'workflow_dispatch' || github.ref == format('refs/heads/{0}', 'main') || startsWith(github.ref, 'refs/tags/') }}
 
     steps:
       - name: Checkout code
@@ -54,10 +55,25 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           file: ./docker/Dockerfile
-          push:  ${{ github.event_name == 'workflow_dispatch' || env.IS_DEFAULT_BRANCH == 'true' || env.IS_TAG == 'true' }}
+          push: ${{ env.IS_PUBLISH == 'true' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           # arm64 is more expensive to build, so only build it on the default branch or for tags
-          platforms: ${{ (env.IS_DEFAULT_BRANCH == 'true' || env.IS_TAG == 'true') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
+          platforms: ${{ env.IS_PUBLISH == 'true' && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
           cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache
+          load: ${{ env.IS_PUBLISH != 'true' }}
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/${{ github.repository_owner }}/cortex-axon-agent:${{ steps.meta.outputs.version }}
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
+        with:
+          sarif_file: 'trivy-results.sarif'

.github/workflows/sdks-python-publish.yml

@@ -9,6 +9,8 @@ on:
 jobs:
   test-and-publish-sdk:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

.github/workflows/sdks-python-test.yml

@@ -8,6 +8,8 @@ on:
 jobs:
   test-sdk:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
         uses: actions/checkout@v2

.github/workflows/validate-filters.yml

@@ -12,7 +12,8 @@ on:
 jobs:
     test:
         runs-on: ubuntu-latest
-
+        permissions:
+          contents: read
         steps:
         - name: Checkout code
           uses: actions/checkout@v2    

agent/go.mod

@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon
 
-go 1.22.9
+go 1.24.8
 
 require (
 	github.com/google/uuid v1.6.0

agent/test/relay/docker-compose.yml

@@ -64,7 +64,7 @@ services:
     stop_grace_period: 1s  # SIGKILL after 1s
 
   cortex-fake:
-    image: golang:1.22-alpine
+    image: golang:1.24-alpine
     volumes:
       - .:/src
     environment:

docker/Dockerfile

@@ -10,7 +10,7 @@ ARG SNYK_BROKER_VERSION=4.203.4
 RUN wget -q -O - https://deb.nodesource.com/setup_${NODE_VERSION}.x | bash - && apt install -y nodejs
 RUN npm install -g snyk-broker@${SNYK_BROKER_VERSION}
 
-ENV GOLANG_VERSION=1.22.9
+ENV GOLANG_VERSION=1.24.8
 # Install Go, this script will work for ARM or AMD64
 RUN wget -q -O /tmp/goinstall.sh https://raw.githubusercontent.com/canha/golang-tools-install-script/master/goinstall.sh && chmod +x /tmp/goinstall.sh && /tmp/goinstall.sh --version ${GOLANG_VERSION}
 

examples/go/axon-ev-sync/go.mod

@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon_apps/axon-ev-sync
 
-go 1.22.9
+go 1.24.8
 
 require (
 	github.com/cortexapps/axon-go v0.0.0

scaffold/go/axon_client/go.mod

@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon-go
 
-go 1.22.9
+go 1.24.8
 
 require (
 	github.com/google/uuid v1.6.0

scaffold/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon_apps/{{.ProjectName}}
 
-go 1.22.9
+go 1.24.8
 
 require (
 	github.com/google/uuid v1.6.0

sdks/go/go.mod

@@ -1,6 +1,6 @@
 module github.com/cortexapps/axon-go
 
-go 1.22.9
+go 1.24.8
 
 require (
 	github.com/google/uuid v1.6.0