Bump Go Modules (#367)

Bumps Go modules used by the project. See the commit for details on what modules were updated.

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: buildpack-bot <buildpack-bot@users.noreply.github.com>

.github/CODEOWNERS

@@ -1 +1 @@
-* @buildpacks/distribution-maintainers
+* @buildpacks/platform-maintainers @buildpacks/toc @edmorley

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
       directory: /
       schedule:
         interval: daily
+      ignore:
+        - dependency-name: github.com/onsi/gomega
       labels:
         - semver:patch
         - type:dependency-upgrade

.github/labels.yml

@@ -25,3 +25,18 @@
 - name: type:task
   description: A general task
   color: e3d9fc
+- name: type:informational
+  description: Provides information or notice to the community
+  color: e3d9fc
+- name: type:poll
+  description: Request for feedback from the community
+  color: e3d9fc
+- name: note:ideal-for-contribution
+  description: An issue that a contributor can help us with
+  color: 54f7a8
+- name: note:on-hold
+  description: We can't start working on this issue yet
+  color: 54f7a8
+- name: note:good-first-issue
+  description: A good first issue to get started with
+  color: 54f7a8

.github/pipeline-descriptor.yml

@@ -4,4 +4,4 @@ github:
 
 codeowners:
 - path:  "*"
-  owner: "@buildpacks/distribution-maintainers"
+  owner: "@buildpacks/platform-maintainers @buildpacks/toc"

.github/pipeline-version

@@ -1 +1 @@
-1.10.5
+1.41.2

.github/workflows/action-buildpack-compute-metadata.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -43,7 +43,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-buildpackage-verify-metadata.yml

@@ -22,7 +22,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -43,7 +43,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-registry-add-entry.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -45,7 +45,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-registry-compute-metadata.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -45,7 +45,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-registry-index-update-release.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v1
+        uses: peter-evans/repository-dispatch@v3
         with:
           token: ${{ secrets.DISTRIBUTION_GITHUB_TOKEN }}
           repository: buildpacks/registry-index

.github/workflows/action-registry-request-add-entry.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -45,7 +45,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-registry-request-yank-entry.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -45,7 +45,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-registry-verify-namespace-owner.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -45,7 +45,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/action-registry-yank-entry.yml

@@ -24,7 +24,7 @@ jobs:
     steps:
     - if:   ${{ github.event_name != 'pull_request' || ! github.event.pull_request.head.repo.fork }}
       name: Docker login ghcr.io
-      uses: docker/login-action@v1.10.0
+      uses: docker/login-action@v3.0.0
       with:
         password: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
         registry: ghcr.io
@@ -45,7 +45,7 @@ jobs:
               VERSION=$(git rev-parse --short HEAD)
             fi
 
-            echo "::set-output name=version::${VERSION}"
+            echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
             echo "Selected ${VERSION} from
               * ref: ${GITHUB_REF}
               * sha: ${GITHUB_SHA}

.github/workflows/pb-minimal-labels.yml

@@ -12,7 +12,7 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - uses: mheap/github-action-required-labels@v1
+            - uses: mheap/github-action-required-labels@v5
               with:
                 count: 1
                 labels: semver:major, semver:minor, semver:patch
@@ -22,7 +22,7 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - uses: mheap/github-action-required-labels@v1
+            - uses: mheap/github-action-required-labels@v5
               with:
                 count: 1
                 labels: type:bug, type:dependency-upgrade, type:documentation, type:enhancement, type:question, type:task

.github/workflows/pb-synchronize-labels.yml

@@ -11,7 +11,7 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - uses: actions/checkout@v2
+            - uses: actions/checkout@v4
             - uses: micnncim/action-label-syncer@v1
               env:
                 GITHUB_TOKEN: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}

.github/workflows/pb-tests.yml

@@ -1,5 +1,10 @@
 name: Tests
 "on":
+    merge_group:
+        types:
+            - checks_requested
+        branches:
+            - main
     pull_request: {}
     push:
         branches:
@@ -10,15 +15,15 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - uses: actions/checkout@v2
-            - uses: actions/cache@v2
+            - uses: actions/checkout@v4
+            - uses: actions/cache@v4
               with:
                 key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
                 path: ${{ env.HOME }}/go/pkg/mod
                 restore-keys: ${{ runner.os }}-go-
-            - uses: actions/setup-go@v2
+            - uses: actions/setup-go@v5
               with:
-                go-version: "1.16"
+                go-version: "1.24"
             - name: Install richgo
               run: |
                 #!/usr/bin/env bash
@@ -37,7 +42,7 @@ jobs:
                   "https://github.com/kyoh86/richgo/releases/download/v${RICHGO_VERSION}/richgo_${RICHGO_VERSION}_linux_amd64.tar.gz" \
                 | tar -C "${HOME}"/bin -xz richgo
               env:
-                RICHGO_VERSION: 0.3.6
+                RICHGO_VERSION: 0.3.10
             - name: Run Tests
               run: |
                 #!/usr/bin/env bash

.github/workflows/pb-update-go.yml

@@ -0,0 +1,72 @@
+name: Update Go
+"on":
+    schedule:
+        - cron: 26 2 * * 1
+    workflow_dispatch: {}
+jobs:
+    update:
+        name: Update Go
+        runs-on:
+            - ubuntu-latest
+        steps:
+            - uses: actions/setup-go@v5
+              with:
+                go-version: "1.24"
+            - uses: actions/checkout@v4
+            - name: Update Go Version & Modules
+              id: update-go
+              run: |
+                #!/usr/bin/env bash
+
+                set -euo pipefail
+
+                if [ -z "${GO_VERSION:-}" ]; then
+                    echo "No go version set"
+                    exit 1
+                fi
+
+                OLD_GO_VERSION=$(grep -P '^go \d\.\d+' go.mod | cut -d ' ' -f 2 | cut -d '.' -f 1-2)
+
+                go mod edit -go="$GO_VERSION"
+                go mod tidy
+                go get -u -t ./...
+                go mod tidy
+
+                git add go.mod go.sum
+                git checkout -- .
+
+                if [ "$OLD_GO_VERSION" == "$GO_VERSION" ]; then
+                    COMMIT_TITLE="Bump Go Modules"
+                    COMMIT_BODY="Bumps Go modules used by the project. See the commit for details on what modules were updated."
+                    COMMIT_SEMVER="semver:patch"
+                else
+                    COMMIT_TITLE="Bump Go from ${OLD_GO_VERSION} to ${GO_VERSION}"
+                    COMMIT_BODY="Bumps Go from ${OLD_GO_VERSION} to ${GO_VERSION} and update Go modules used by the project. See the commit for details on what modules were updated."
+                    COMMIT_SEMVER="semver:minor"
+                fi
+
+                echo "commit-title=${COMMIT_TITLE}" >> "$GITHUB_OUTPUT"
+                echo "commit-body=${COMMIT_BODY}" >> "$GITHUB_OUTPUT"
+                echo "commit-semver=${COMMIT_SEMVER}" >> "$GITHUB_OUTPUT"
+              env:
+                GO_VERSION: "1.24"
+            - uses: peter-evans/create-pull-request@v6
+              with:
+                author: ${{ secrets.IMPLEMENTATION_GITHUB_USERNAME }} <${{ secrets.IMPLEMENTATION_GITHUB_USERNAME }}@users.noreply.github.com>
+                body: |-
+                    ${{ steps.update-go.outputs.commit-body }}
+
+                    <details>
+                    <summary>Release Notes</summary>
+                    ${{ steps.pipeline.outputs.release-notes }}
+                    </details>
+                branch: update/go
+                commit-message: |-
+                    ${{ steps.update-go.outputs.commit-title }}
+
+                    ${{ steps.update-go.outputs.commit-body }}
+                delete-branch: true
+                labels: ${{ steps.update-go.outputs.commit-semver }}, type:task
+                signoff: true
+                title: ${{ steps.update-go.outputs.commit-title }}
+                token: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}

.github/workflows/pb-update-pipeline.yml

@@ -14,19 +14,19 @@ jobs:
         runs-on:
             - ubuntu-latest
         steps:
-            - uses: actions/setup-go@v2
+            - uses: actions/setup-go@v5
               with:
-                go-version: "1.16"
+                go-version: "1.24"
             - name: Install octo
               run: |
                 #!/usr/bin/env bash
 
                 set -euo pipefail
 
-                GO111MODULE=on go get -u -ldflags="-s -w" github.com/paketo-buildpacks/pipeline-builder/cmd/octo
-            - uses: actions/checkout@v2
-            - id: pipeline
-              name: Update Pipeline
+                go install -ldflags="-s -w" github.com/paketo-buildpacks/pipeline-builder/cmd/octo@latest
+            - uses: actions/checkout@v4
+            - name: Update Pipeline
+              id: pipeline
               run: |
                 #!/usr/bin/env bash
 
@@ -38,6 +38,7 @@ jobs:
                   OLD_VERSION="0.0.0"
                 fi
 
+                rm .github/workflows/pb-*.yml || true
                 octo --descriptor "${DESCRIPTOR}"
 
                 PAYLOAD=$(gh api /repos/paketo-buildpacks/pipeline-builder/releases/latest)
@@ -54,15 +55,23 @@ jobs:
                 )
 
                 git add .github/
+                git add .gitignore
+
+                if [ -f scripts/build.sh ]; then
+                  git add scripts/build.sh
+                fi
+
                 git checkout -- .
 
-                echo "::set-output name=old-version::${OLD_VERSION}"
-                echo "::set-output name=new-version::${NEW_VERSION}"
-                echo "::set-output name=release-notes::${RELEASE_NOTES//$'\n'/%0A}"
+                echo "old-version=${OLD_VERSION}" >> "$GITHUB_OUTPUT"
+                echo "new-version=${NEW_VERSION}" >> "$GITHUB_OUTPUT"
+
+                DELIMITER=$(openssl rand -hex 16) # roughly the same entropy as uuid v4 used in https://github.com/actions/toolkit/blob/b36e70495fbee083eb20f600eafa9091d832577d/packages/core/src/file-command.ts#L28
+                printf "release-notes<<%s\n%s\n%s\n" "${DELIMITER}" "${RELEASE_NOTES}" "${DELIMITER}" >> "${GITHUB_OUTPUT}" # see https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings
               env:
                 DESCRIPTOR: .github/pipeline-descriptor.yml
                 GITHUB_TOKEN: ${{ secrets.IMPLEMENTATION_GITHUB_TOKEN }}
-            - uses: peter-evans/create-pull-request@v3
+            - uses: peter-evans/create-pull-request@v6
               with:
                 author: ${{ secrets.IMPLEMENTATION_GITHUB_USERNAME }} <${{ secrets.IMPLEMENTATION_GITHUB_USERNAME }}@users.noreply.github.com>
                 body: |-

.github/workflows/update-pack-version.yml

@@ -0,0 +1,38 @@
+name: update-pack-version
+
+on:
+  workflow_dispatch:
+  repository_dispatch:
+    types:
+      - pack-release
+
+jobs:
+  update-pack-version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Retrieve latest pack version
+        id: version
+        run: |
+            NEW_VERSION=$(curl -s -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/buildpacks/pack/releases/latest | jq .tag_name -r | cut -c 2-)
+            echo "new_version=${NEW_VERSION}" >> ${GITHUB_OUTPUT}
+      - name: Update setup-pack/action.yml with the new Pack version
+        run: |
+            sed -i -z "s/default:     '[0-9]\{1,\}.[0-9]\{1,\}.[0-9]\{1,\}'/default:     '${{ steps.version.outputs.new_version }}'/" setup-pack/action.yml
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v5
+        with:
+          token: ${{ secrets.DISTRIBUTION_GITHUB_TOKEN }}
+          commit-message: Update default Pack version to v${{ steps.version.outputs.new_version }}
+          title: Update default Pack version to v${{ steps.version.outputs.new_version }}
+          body: |
+            Updates the `setup-pack` action's default `pack-version` to the latest Pack release.
+            
+            Release notes:
+            https://github.com/buildpacks/pack/releases/tag/v${{ steps.version.outputs.new_version }}
+          labels: |
+            semver:patch
+            type:dependency-upgrade
+          branch: update-version
+          base: main
+          signoff: true

.github/workflows/update-version.yml

@@ -1,26 +0,0 @@
-name: update-pack-version
-
-on:
-  repository_dispatch:
-    types:
-      - pack-release
-
-jobs:
-  update-version:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Update pack version of buildpacks/github-actions/setup-pack/action.yml on new pack release
-        run: |
-            NEW_VERSION = $(curl -s -H "Accept: application/vnd.github.v3+json" https://api.github.com/repos/buildpacks/pack/releases/latest | jq .tag_name -r | cut -c 2-)
-            sed -i -z "s/default:     '[0-9]\{1,\}.[0-9]\{1,\}.[0-9]\{1,\}'/default:     '$NEW_VERSION'/2" setup-pack/action.yml
-      - name: Create pull request
-        uses: peter-evans/create-pull-request@v3
-        with:
-          token: ${{ secrets.DISTRIBUTION_GITHUB_TOKEN }}
-          commit-message: Update version to latest release of buildpacks/pack
-          title: Update default version of setup-pack/action.yml
-          body: Updates default version of setup-pack/action.yml to reflect release changes in buildpacks/pack
-          branch: update-version
-          base: main
-          signoff: true

.gitignore

@@ -11,4 +11,10 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-.idea/
+
+bin/
+linux/
+dependencies/
+package/
+scratch/
+

Dockerfile

@@ -1,6 +1,4 @@
-FROM golang:1.17 as build-stage
-
-RUN apt-get update && apt-get install -y --no-install-recommends upx
+FROM golang:1.24 as build-stage
 
 WORKDIR /src
 ENV GO111MODULE=on CGO_ENABLED=0
@@ -17,9 +15,8 @@ RUN go build \
 
 RUN strip /bin/action
 
-RUN upx -q -9 /bin/action
-
 FROM scratch
+LABEL org.opencontainers.image.source=https://github.com/buildpacks/github-actions
 COPY --from=build-stage /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
 COPY --from=build-stage /bin/action /bin/action
 ENTRYPOINT ["/bin/action"]

README.md

@@ -19,6 +19,7 @@
     - [Verify Namespace Owner Action](#verify-namespace-owner-action)
     - [Yank Entry Action](#yank-entry-action)
   - [Setup pack CLI Action](#setup-pack-cli-action)
+  - [Setup Tools Action](#setup-tools-action)
   - [License](#license)
 
 ## Buildpack
@@ -178,7 +179,7 @@ with:
 | `add-if-missing` | Whether to add the current user as the owner of the namespace if that namespace does not exist. (Optional. Default `false`)
 
 ### Yank Entry Action
-The `registry/yank-entry` yanks an entry from the [Buildpack Registry Index][bri].
+The `registry/yank-entry` action yanks an entry from the [Buildpack Registry Index][bri].
 
 ```yaml
 uses: docker://ghcr.io/buildpacks/actions/registry/yank-entry
@@ -202,24 +203,34 @@ with:
 | `version` | The version of the buildpack to register.
 
 ## Setup pack CLI Action
-The setup-pack action adds [crane][crane], [`jq`][jq], [`pack`][pack], and [`yj`][yj] to the environment.
+The `setup-pack` action adds [`pack`][pack] to the environment.
 
-[crane]: https://github.com/google/go-containerregistry/tree/master/cmd/crane
-[jq]:    https://stedolan.github.io/jq/
 [pack]:  https://github.com/buildpacks/pack
-[yj]:    https://github.com/sclevine/yj
 
 ```yaml
-uses: buildpacks/github-actions/setup-pack@v4.1.0
+uses: buildpacks/github-actions/setup-pack@v5.0.0
 ```
 
 #### Inputs <!-- omit in toc -->
 | Parameter | Description
 | :-------- | :----------
-| `crane-version` | Optional version of [`crane`][crane] to install. Defaults to latest release.
-| `jq-version` | Optional version of [`jq`][jq] to install. Defaults to latest release.
 | `pack-version` | Optional version of [`pack`][pack] to install. Defaults to latest release.
-| `yj-version` | Optional version of [`yj`][yj] to install. Defaults to latest release.
+
+## Setup Tools Action
+The `setup-tools` action adds [crane][crane] and [`yj`][yj] to the environment.
+
+[crane]: https://github.com/google/go-containerregistry/tree/master/cmd/crane
+[yj]:    https://github.com/sclevine/yj
+
+```yaml
+uses: buildpacks/github-actions/setup-tools@v5.0.0
+```
+
+#### Inputs <!-- omit in toc -->
+| Parameter | Description
+| :-------- | :----------
+| `crane-version` | Optional version of [`crane`][crane] to install. Defaults to `0.12.1`.
+| `yj-version` | Optional version of [`yj`][yj] to install. Defaults to `5.1.0`.
 
 ## License
 This library is released under version 2.0 of the [Apache License][a].

go.mod

@@ -1,41 +1,42 @@
 module github.com/buildpacks/github-actions
 
-go 1.17
+go 1.24
 
 require (
-	github.com/buildpacks/libcnb v1.24.0
-	github.com/google/go-containerregistry v0.6.0
+	github.com/buildpacks/libcnb v1.30.4
+	github.com/google/go-containerregistry v0.20.6
 	github.com/google/go-github/v39 v39.2.0
-	github.com/onsi/gomega v1.16.0
-	github.com/pelletier/go-toml v1.9.4
+	github.com/onsi/gomega v1.38.0
+	github.com/pelletier/go-toml v1.9.5
 	github.com/sclevine/spec v1.4.0
-	github.com/stretchr/testify v1.7.0
-	golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c
+	github.com/stretchr/testify v1.10.0
+	golang.org/x/oauth2 v0.30.0
 	gopkg.in/retry.v1 v1.0.3
 )
 
 require (
-	github.com/BurntSushi/toml v0.4.1 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.17.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/docker/cli v20.10.7+incompatible // indirect
-	github.com/docker/distribution v2.7.1+incompatible // indirect
-	github.com/docker/docker v20.10.7+incompatible // indirect
-	github.com/docker/docker-credential-helpers v0.6.3 // indirect
-	github.com/golang/protobuf v1.5.2 // indirect
+	github.com/docker/cli v28.3.3+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.0.1 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/sirupsen/logrus v1.8.1 // indirect
-	github.com/stretchr/objx v0.2.0 // indirect
-	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 // indirect
-	golang.org/x/net v0.0.0-20210525063256-abc453219eb5 // indirect
-	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1 // indirect
-	golang.org/x/text v0.3.6 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.26.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/stretchr/objx v0.5.2 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
+	golang.org/x/crypto v0.41.0 // indirect
+	golang.org/x/net v0.43.0 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/text v0.28.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

internal/toolkit/toolkit.go

@@ -17,6 +17,8 @@
 package toolkit
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"errors"
 	"fmt"
 	"io"
@@ -92,6 +94,7 @@ type DefaultToolkit struct {
 
 	Environment map[string]string
 	Writer      io.Writer
+	Delemiter   string
 }
 
 func (d *DefaultToolkit) AddPath(paths ...string) error {
@@ -116,11 +119,15 @@ func (d *DefaultToolkit) AddPath(paths ...string) error {
 }
 
 func (d *DefaultToolkit) ExportVariable(name string, value string) error {
+	return d.export("GITHUB_ENV", name, value)
+}
+
+func (d *DefaultToolkit) export(env string, name string, value string) error {
 	d.once.Do(d.init)
 
-	path, ok := d.Environment["GITHUB_ENV"]
+	path, ok := d.Environment[env]
 	if !ok {
-		return FailedError("$GITHUB_ENV must be set")
+		return FailedErrorf("$%s must be set", env)
 	}
 
 	f, err := os.OpenFile(path, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0644)
@@ -130,7 +137,7 @@ func (d *DefaultToolkit) ExportVariable(name string, value string) error {
 	defer f.Close()
 
 	if strings.ContainsRune(value, '\n') {
-		if _, err := fmt.Fprintln(f, fmt.Sprintf("%s<<EOF\n%s\nEOF", name, value)); err != nil {
+		if _, err := fmt.Fprintln(f, fmt.Sprintf("%s<<%s\n%s\n%s", name, d.Delemiter, value, d.Delemiter)); err != nil {
 			return FailedError("unable to write variable")
 		}
 	} else {
@@ -154,8 +161,10 @@ func (d *DefaultToolkit) GetInputList(name string) ([]string, bool) {
 }
 
 func (d *DefaultToolkit) SetOutput(name string, value string) {
-	d.once.Do(d.init)
-	_, _ = fmt.Fprintf(d.Writer, "::set-output name=%s::%s\n", name, escape(value))
+	err := d.export("GITHUB_OUTPUT", name, value)
+	if err != nil {
+		panic(err)
+	}
 }
 
 func (d *DefaultToolkit) GetState(name string) (string, bool) {
@@ -165,8 +174,10 @@ func (d *DefaultToolkit) GetState(name string) (string, bool) {
 }
 
 func (d *DefaultToolkit) SetState(name string, value string) {
-	d.once.Do(d.init)
-	_, _ = fmt.Fprintf(d.Writer, "::save-state name=%s::%s\n", name, escape(value))
+	err := d.export("GITHUB_STATE", name, value)
+	if err != nil {
+		panic(err)
+	}
 }
 
 func (d *DefaultToolkit) AddMask(mask string) {
@@ -248,6 +259,15 @@ func (d *DefaultToolkit) init() {
 	if d.Writer == nil {
 		d.Writer = os.Stdout
 	}
+
+	if d.Delemiter == "" {
+		data := make([]byte, 16) // roughly the same entropy as uuid v4 used in https://github.com/actions/toolkit/blob/b36e70495fbee083eb20f600eafa9091d832577d/packages/core/src/file-command.ts#L28
+		_, err := rand.Read(data)
+		if err != nil {
+			panic(fmt.Errorf("could not generate random delimiter: %w", err))
+		}
+		d.Delemiter = hex.EncodeToString(data)
+	}
 }
 
 func errorString(a ...interface{}) string {

internal/toolkit/toolkit_test.go

@@ -19,7 +19,7 @@ package toolkit_test
 import (
 	"bytes"
 	"fmt"
-	"io/ioutil"
+	"os"
 	"testing"
 
 	. "github.com/onsi/gomega"
@@ -81,11 +81,11 @@ func TestToolkit(t *testing.T) {
 
 			var (
 				b  = &bytes.Buffer{}
-				tk = toolkit.DefaultToolkit{Writer: b}
+				tk = toolkit.DefaultToolkit{Writer: b, Delemiter: "EOF"}
 			)
 
 			it("adds path", func() {
-				f, err := ioutil.TempFile("", "github-path")
+				f, err := os.CreateTemp("", "github-path")
 				Expect(err).NotTo(HaveOccurred())
 				_, err = fmt.Fprintln(f, "test-value")
 				Expect(err).NotTo(HaveOccurred())
@@ -95,12 +95,13 @@ func TestToolkit(t *testing.T) {
 
 				Expect(tk.AddPath("test-path-1", "test-path-2")).To(Succeed())
 
-				b, err := ioutil.ReadFile(f.Name())
+				b, err := os.ReadFile(f.Name())
+				Expect(err).NotTo(HaveOccurred())
 				Expect(string(b)).To(Equal("test-value\ntest-path-1\ntest-path-2\n"))
 			})
 
 			it("exports variable", func() {
-				f, err := ioutil.TempFile("", "github-env")
+				f, err := os.CreateTemp("", "github-env")
 				Expect(err).NotTo(HaveOccurred())
 				_, err = fmt.Fprintln(f, "TEST_KEY=test-value")
 				Expect(err).NotTo(HaveOccurred())
@@ -111,7 +112,8 @@ func TestToolkit(t *testing.T) {
 				Expect(tk.ExportVariable("TEST_NAME_1", "test-value-1")).To(Succeed())
 				Expect(tk.ExportVariable("TEST_NAME_2", "test-value-2\ntest-value-3")).To(Succeed())
 
-				b, err := ioutil.ReadFile(f.Name())
+				b, err := os.ReadFile(f.Name())
+				Expect(err).NotTo(HaveOccurred())
 				Expect(string(b)).To(Equal("TEST_KEY=test-value\nTEST_NAME_1=test-value-1\nTEST_NAME_2<<EOF\ntest-value-2\ntest-value-3\nEOF\n"))
 			})
 
@@ -138,9 +140,18 @@ func TestToolkit(t *testing.T) {
 			})
 
 			it("sets output", func() {
+				f, err := os.CreateTemp("", "github-output")
+				Expect(err).NotTo(HaveOccurred())
+				_, err = fmt.Fprintln(f, "TEST_OUTPUT=test-value")
+				Expect(err).NotTo(HaveOccurred())
+				Expect(f.Close()).To(Succeed())
+				tk.Environment = map[string]string{"GITHUB_OUTPUT": f.Name()}
+
 				tk.SetOutput("test-name", "test-value-1\ntest-value-2")
 
-				Expect(b.String()).To(Equal("::set-output name=test-name::test-value-1%0Atest-value-2\n"))
+				b, err := os.ReadFile(f.Name())
+				Expect(err).NotTo(HaveOccurred())
+				Expect(string(b)).To(Equal("TEST_OUTPUT=test-value\ntest-name<<EOF\ntest-value-1\ntest-value-2\nEOF\n"))
 			})
 
 			it("gets state", func() {
@@ -155,9 +166,18 @@ func TestToolkit(t *testing.T) {
 			})
 
 			it("sets state", func() {
+				f, err := os.CreateTemp("", "github-state")
+				Expect(err).NotTo(HaveOccurred())
+				_, err = fmt.Fprintln(f, "TEST_STATE=test-value")
+				Expect(err).NotTo(HaveOccurred())
+				Expect(f.Close()).To(Succeed())
+				tk.Environment = map[string]string{"GITHUB_STATE": f.Name()}
+
 				tk.SetState("test-name", "test-value-1\ntest-value-2")
 
-				Expect(b.String()).To(Equal("::save-state name=test-name::test-value-1%0Atest-value-2\n"))
+				b, err := os.ReadFile(f.Name())
+				Expect(err).NotTo(HaveOccurred())
+				Expect(string(b)).To(Equal("TEST_STATE=test-value\ntest-name<<EOF\ntest-value-1\ntest-value-2\nEOF\n"))
 			})
 
 			it("adds mask", func() {

registry/internal/namespace/namespace.go

@@ -24,7 +24,6 @@ var restrictedNamespaces = []string{
 	"buildpacks",
 	"buildpacks-io",
 	"buildpacks.io",
-	"buildpacksio",
 	"cnb",
 	"cnbs",
 	"cncf",

registry/request-add-entry/cmd/main.go

@@ -27,7 +27,7 @@ import (
 	"gopkg.in/retry.v1"
 
 	"github.com/buildpacks/github-actions/internal/toolkit"
-	"github.com/buildpacks/github-actions/registry/request-add-entry"
+	entry "github.com/buildpacks/github-actions/registry/request-add-entry"
 )
 
 func main() {
@@ -41,7 +41,7 @@ func main() {
 
 	gh := github.NewClient(oauth2.NewClient(context.Background(), oauth2.StaticTokenSource(&oauth2.Token{AccessToken: t})))
 
-	strategy := retry.LimitTime(2*time.Minute,
+	strategy := retry.LimitTime(20*time.Minute,
 		retry.Exponential{
 			Initial:  time.Second,
 			MaxDelay: 30 * time.Second,

registry/request-yank-entry/cmd/main.go

@@ -27,7 +27,7 @@ import (
 	"gopkg.in/retry.v1"
 
 	"github.com/buildpacks/github-actions/internal/toolkit"
-	"github.com/buildpacks/github-actions/registry/request-yank-entry"
+	entry "github.com/buildpacks/github-actions/registry/request-yank-entry"
 )
 
 func main() {
@@ -41,7 +41,7 @@ func main() {
 
 	gh := github.NewClient(oauth2.NewClient(context.Background(), oauth2.StaticTokenSource(&oauth2.Token{AccessToken: t})))
 
-	strategy := retry.LimitTime(2*time.Minute,
+	strategy := retry.LimitTime(20*time.Minute,
 		retry.Exponential{
 			Initial:  time.Second,
 			MaxDelay: 30 * time.Second,

setup-pack/action.yml

@@ -1,29 +1,17 @@
 name:        'Setup pack CLI'
-description: 'Setup the Cloud Native Buildpacks pack CLI as well as other useful tools and add them to $PATH'
+description: 'Install the Cloud Native Buildpacks pack CLI and add it to $PATH'
 author:      'Cloud Native Buildpacks'
 
 inputs:
-  crane-version:
-    description: 'The version of crane to install'
-    required:    false
-    default:     '0.6.0'
-  jq-version:
-    description: 'The version of jq to install'
-    required:    false
-    default:     '1.6'
   pack-version:
     description: 'The version of pack to install'
     required:    false
-    default:     '0.20.0'
-  yj-version:
-    description: 'The version of yj to install'
-    required:    false
-    default:     '5.0.0'
+    default:     '0.38.2'
 
 runs:
   using: "composite"
   steps:
-  - name:  Setup pack CLI
+  - name:  Install pack CLI
     shell: bash
     run:   |
            #!/usr/bin/env bash
@@ -33,24 +21,10 @@ runs:
            mkdir -p "${HOME}"/bin
            echo "PATH=${HOME}/bin:${PATH}" >> "${GITHUB_ENV}"
 
-           CRANE_VERSION=${{ inputs.crane-version }}
-           echo "Installing crane ${CRANE_VERSION}"
-           curl \
-             --show-error \
-             --silent \
-             --location \
-             "https://github.com/google/go-containerregistry/releases/download/v${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz" \
-           | tar -C "${HOME}/bin" -xz crane
-
-           JQ_VERSION=${{ inputs.jq-version }}
-           echo "Installing jq ${JQ_VERSION}"
-           curl \
-             --show-error \
-             --silent \
-             --location \
-             --output "${HOME}/bin/jq" \
-             "https://github.com/stedolan/jq/releases/download/jq-${JQ_VERSION}/jq-linux64"
-           chmod +x "${HOME}"/bin/jq
+           PLATFORM="linux"
+           if [ $(arch) = "aarch64" ]; then
+              PLATFORM="linux-arm64"
+           fi
 
            PACK_VERSION=${{ inputs.pack-version }}
            echo "Installing pack ${PACK_VERSION}"
@@ -58,15 +32,9 @@ runs:
              --show-error \
              --silent \
              --location \
-             "https://github.com/buildpacks/pack/releases/download/v${PACK_VERSION}/pack-v${PACK_VERSION}-linux.tgz" \
+             --fail \
+             --retry 3 \
+             --connect-timeout 5 \
+             --max-time 60 \
+             "https://github.com/buildpacks/pack/releases/download/v${PACK_VERSION}/pack-v${PACK_VERSION}-${PLATFORM}.tgz" \
            | tar -C "${HOME}/bin" -xz pack
-
-           YJ_VERSION=${{ inputs.yj-version }}
-           echo "Installing yj ${YJ_VERSION}"
-           curl \
-             --show-error \
-             --silent \
-             --location \
-             --output "${HOME}/bin/yj" \
-             "https://github.com/sclevine/yj/releases/download/v${YJ_VERSION}/yj-linux"
-           chmod +x "${HOME}"/bin/yj

setup-tools/action.yml

@@ -0,0 +1,66 @@
+name:        'Setup tools'
+description: 'Install the tools crane and yq, and add them to $PATH'
+author:      'Cloud Native Buildpacks'
+
+inputs:
+  crane-version:
+    description: 'The version of crane to install'
+    required:    false
+    default:     '0.19.1'
+  yj-version:
+    description: 'The version of yj to install'
+    required:    false
+    default:     '5.1.0'
+
+runs:
+  using: "composite"
+  steps:
+  - name:  Install additional buildpack management tools
+    shell: bash
+    run:   |
+           #!/usr/bin/env bash
+
+           set -euo pipefail
+
+           mkdir -p "${HOME}"/bin
+           echo "PATH=${HOME}/bin:${PATH}" >> "${GITHUB_ENV}"
+          
+           CRANE_PLATFORM="Linux_x86_64"
+           if [ $(arch) = "aarch64" ]; then
+              CRANE_PLATFORM="Linux_arm64"
+           fi
+           CRANE_VERSION=${{ inputs.crane-version }}
+           echo "Installing crane ${CRANE_VERSION}"
+           curl \
+             --show-error \
+             --silent \
+             --location \
+             --fail \
+             --retry 3 \
+             --connect-timeout 5 \
+             --max-time 60 \
+             "https://github.com/google/go-containerregistry/releases/download/v${CRANE_VERSION}/go-containerregistry_${CRANE_PLATFORM}.tar.gz" \
+           | tar -C "${HOME}/bin" -xz crane
+
+           YJ_VERSION=${{ inputs.yj-version }}
+           echo "Installing yj ${YJ_VERSION}"
+           YJ_DOWNLOAD_FILENAME="yj-linux"
+           if [[ "${YJ_VERSION}" < "5.1.0" ]]; then
+             YJ_PLATFORM=""
+           else
+             YJ_PLATFORM="-amd64"
+           fi
+           if [ $(arch) = "aarch64" ]; then
+              YJ_PLATFORM="-arm64"
+           fi
+           curl \
+             --show-error \
+             --silent \
+             --location \
+             --fail \
+             --retry 3 \
+             --connect-timeout 5 \
+             --max-time 60 \
+             --output "${HOME}/bin/yj" \
+             "https://github.com/sclevine/yj/releases/download/v${YJ_VERSION}/${YJ_DOWNLOAD_FILENAME}${YJ_PLATFORM}"
+           chmod +x "${HOME}"/bin/yj