chore: update to go 1.23

.github/workflows/azwi-build.yaml

@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.22"
+          go-version: "1.23"
           check-latest: true
       - name: Build azwi
         run: |

.github/workflows/azwi-e2e.yaml

@@ -37,7 +37,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.22"
+          go-version: "1.23"
           check-latest: true
       - name: Azure CLI
         run: |

.github/workflows/codecov.yaml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "^1.22"
+          go-version: "^1.23"
           check-latest: true
       - name: Run tests
         run: make test

.github/workflows/create-release-pull-request.yaml

@@ -34,7 +34,7 @@ jobs:
           ref: "${{ github.event.inputs.based_on_branch }}"
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.22"
+          go-version: "1.23"
           check-latest: true
       - run: make release-manifest
         env:

.github/workflows/create-release.yaml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.22"
+          go-version: "1.23"
           check-latest: true
       - id: get-tag
         name: Get tag

.github/workflows/scan-vulns.yaml

@@ -25,6 +25,6 @@ jobs:
 
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.22"
+          go-version: "1.23"
           check-latest: true
       - uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2

.golangci.yml

@@ -1,6 +1,6 @@
 run:
   deadline: 20m
-  go-version: "1.22"
+  go-version: "1.23"
 
 linters:
   disable-all: true
@@ -28,6 +28,14 @@ linters:
   # Run with --fast=false for more extensive checks
   fast: true
 
+issues:
+  # default: 50
+  max-issues-per-linter: 0
+  exclude-rules:
+    - text: "unused-parameter: parameter '.*' seems to be unused, consider removing or renaming it as _"
+      linters:
+        - revive
+
 linters-settings:
   goimports:
     local-prefixes: github.com/Azure/azure-workload-identity

Makefile

@@ -55,7 +55,7 @@ KUSTOMIZE_VER := v4.1.2
 KUSTOMIZE_BIN := kustomize
 KUSTOMIZE := $(TOOLS_BIN_DIR)/$(KUSTOMIZE_BIN)-$(KUSTOMIZE_VER)
 
-GOLANGCI_LINT_VER := v1.52.2
+GOLANGCI_LINT_VER := v1.61.0
 GOLANGCI_LINT_BIN := golangci-lint
 GOLANGCI_LINT := $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER)
 
@@ -365,7 +365,7 @@ clean:
 
 .PHONY: lint
 lint: $(GOLANGCI_LINT)
-	$(GOLANGCI_LINT) run -v
+	$(GOLANGCI_LINT) run -v --timeout 5m
 
 .PHONY: helm-lint
 helm-lint: $(HELM)

docker/proxy-init.Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=${TARGETPLATFORM:-linux/amd64} registry.k8s.io/build-image/distroless-iptables:v0.6.1
+FROM --platform=${TARGETPLATFORM:-linux/amd64} registry.k8s.io/build-image/distroless-iptables:v0.6.3
 
 COPY ./init/init-iptables.sh /bin/
 RUN chmod +x /bin/init-iptables.sh

docker/proxy.Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.22-bookworm as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23-bookworm as builder
 
 ARG LDFLAGS
 

docker/webhook.Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.22-bookworm as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23-bookworm as builder
 
 ARG LDFLAGS
 

examples/msal-go/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.22-bookworm as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23-bookworm as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests

go.mod

@@ -1,6 +1,6 @@
 module github.com/Azure/azure-workload-identity
 
-go 1.22
+go 1.23.1
 
 require (
 	github.com/Azure/aad-pod-identity v1.8.17

pkg/cmd/podidentity/detect.go

@@ -60,7 +60,7 @@ func init() {
 type detectCmd struct {
 	namespace                     string
 	outputDir                     string
-	proxyPort                     int
+	proxyPort                     int32
 	serviceAccountTokenExpiration time.Duration
 	tenantID                      string
 	kubeClient                    client.Client
@@ -85,7 +85,7 @@ func newDetectCmd() *cobra.Command {
 	f := cmd.Flags()
 	f.StringVar(&detectCmd.namespace, "namespace", "default", "Namespace to detect the configuration")
 	f.StringVarP(&detectCmd.outputDir, "output-dir", "o", "", "Output directory to write the configuration files")
-	f.IntVarP(&detectCmd.proxyPort, "proxy-port", "p", 8000, "Proxy port to use for the proxy container")
+	f.Int32VarP(&detectCmd.proxyPort, "proxy-port", "p", 8000, "Proxy port to use for the proxy container")
 	f.DurationVar(&detectCmd.serviceAccountTokenExpiration, options.ServiceAccountTokenExpiration.Flag, time.Duration(webhook.DefaultServiceAccountTokenExpiration)*time.Second, options.ServiceAccountTokenExpiration.Description)
 	f.StringVar(&detectCmd.tenantID, "tenant-id", "", "Managed identity tenant id. If specified, the tenant id will be set as an annotation on the service account.")
 
@@ -349,7 +349,7 @@ func (dc *detectCmd) addProxyInitContainer(initContainers []corev1.Container) []
 		Env: []corev1.EnvVar{
 			{
 				Name:  "PROXY_PORT",
-				Value: strconv.Itoa(dc.proxyPort),
+				Value: strconv.FormatInt(int64(dc.proxyPort), 10),
 			},
 		},
 	}
@@ -381,7 +381,7 @@ func (dc *detectCmd) addProxyContainer(containers []corev1.Container) []corev1.C
 		},
 		Ports: []corev1.ContainerPort{
 			{
-				ContainerPort: int32(dc.proxyPort),
+				ContainerPort: dc.proxyPort,
 			},
 		},
 		Lifecycle: &corev1.Lifecycle{

pkg/webhook/consts.go

@@ -28,7 +28,7 @@ const (
 	// This is the Kubernetes default value for projected service account token
 	DefaultServiceAccountTokenExpiration = int64(3600)
 	// DefaultProxySidecarPort is the default port for proxy sidecar
-	DefaultProxySidecarPort = int32(8000)
+	DefaultProxySidecarPort = 8000
 )
 
 const (

pkg/webhook/webhook.go

@@ -334,7 +334,7 @@ func getProxyPort(pod *corev1.Pod) (int32, error) {
 		return 0, errors.Wrap(err, "failed to parse proxy sidecar port")
 	}
 
-	return int32(parsed), nil
+	return int32(parsed), nil //nolint:gosec // disable G115
 }
 
 func validServiceAccountTokenExpiry(tokenExpiry int64) bool {

test/e2e/go.mod

@@ -1,6 +1,6 @@
 module github.com/Azure/azure-workload-identity/test/e2e
 
-go 1.22
+go 1.23.1
 
 replace (
 	k8s.io/api => k8s.io/api v0.29.4