chore: build with keyring opt-out tags; bump cli-common to v0.3.2 (#156)

Adopts the standard keyring opt-out build configuration
(cli-common working-with-secrets.md §1.10): GOFLAGS in Makefile and CI,
explicit flags in goreleaser builds. Excludes the 1Password backends
(onepassword-sdk-go incl. the wazero WASM runtime, connect-sdk-go incl.
the archived jaeger-client-go) and passage from the binary — 59 packages
out of the import graph. cli-common v0.3.2 brings byteness/keyring
v1.11.0, which ships the tags.

Refs open-cli-collective/cli-common#57

Author: rianjs

.github/workflows/ci.yml

@@ -12,6 +12,10 @@ concurrency:
 permissions:
   contents: read
 
+# Standard keyring opt-out tags (cli-common working-with-secrets.md §1.10).
+env:
+  GOFLAGS: -tags=keyring_no1password,keyring_nopassage
+
 jobs:
   build-platform:                          # OS matrix — NOT a required check
     name: build (${{ matrix.os }})

.goreleaser.yaml

@@ -17,6 +17,9 @@ builds:
   - id: gro-darwin
     main: ./cmd/gro
     binary: gro
+    # Standard keyring opt-out tags (cli-common working-with-secrets.md §1.10).
+    flags:
+      - -tags=keyring_no1password,keyring_nopassage
     env:
       - CGO_ENABLED=1
     goos:
@@ -52,6 +55,8 @@ builds:
   - id: gro-unix-win
     main: ./cmd/gro
     binary: gro
+    flags:
+      - -tags=keyring_no1password,keyring_nopassage
     env:
       - CGO_ENABLED=0
     goos:

Makefile

@@ -9,6 +9,10 @@ LDFLAGS := -ldflags "-s -w \
 
 DIST_DIR = dist
 
+# Standard keyring opt-out tags (cli-common working-with-secrets.md §1.10):
+# exclude the 1Password and passage backends credstore never exposes.
+export GOFLAGS := -tags=keyring_no1password,keyring_nopassage
+
 .PHONY: all build test test-cover test-cover-check test-short lint fmt tidy deps verify check clean release checksums install uninstall
 
 all: build

go.mod

@@ -7,13 +7,13 @@ require (
 	github.com/charmbracelet/huh v0.8.0
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/muesli/termenv v0.16.0
-	github.com/open-cli-collective/cli-common v0.2.2
+	github.com/open-cli-collective/cli-common v0.3.2
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c
 	github.com/spf13/cobra v1.8.0
 	github.com/yuin/goldmark v1.8.2
 	golang.org/x/net v0.53.0
 	golang.org/x/oauth2 v0.34.0
-	golang.org/x/term v0.43.0
+	golang.org/x/term v0.44.0
 	google.golang.org/api v0.262.0
 	gopkg.in/yaml.v3 v3.0.1
 )
@@ -27,7 +27,7 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/byteness/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/byteness/go-libsecret v0.0.0-20260108215642-107379d3dee0 // indirect
-	github.com/byteness/keyring v1.9.3 // indirect
+	github.com/byteness/keyring v1.11.0 // indirect
 	github.com/byteness/percent v0.2.2 // indirect
 	github.com/catppuccin/go v0.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
@@ -81,7 +81,7 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	golang.org/x/crypto v0.51.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260120174246-409b4a993575 // indirect
 	google.golang.org/grpc v1.78.0 // indirect

go.sum

@@ -22,8 +22,8 @@ github.com/byteness/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:HFl8GFmwK1
 github.com/byteness/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:9HlL8SWBRtCZE7sCNq+c3//H/oHywgSwtocmPTdOij8=
 github.com/byteness/go-libsecret v0.0.0-20260108215642-107379d3dee0 h1:j59wGsxaBk6aFBuuYofk2oznMGZYyzFovjDqavlJHM8=
 github.com/byteness/go-libsecret v0.0.0-20260108215642-107379d3dee0/go.mod h1:3FrDGTXj08zj6qtqlIvt0vS8eWNrrYpnXOEbcQgFmvM=
-github.com/byteness/keyring v1.9.3 h1:8ZnsYFdLiyAil2cIttxUVSRbNj5u+UG7AR7jH18tWkE=
-github.com/byteness/keyring v1.9.3/go.mod h1:fHz0D2UQARryadc45oHOmgo/v4F7JheVi2Mt/1GpH7Q=
+github.com/byteness/keyring v1.11.0 h1:RfMEASvS/pxc/Ulshv7h58f5gzU6TXQ5AuUsvbYdqec=
+github.com/byteness/keyring v1.11.0/go.mod h1:eTBEHu0izyjSx+ux8Rdpfrg/2bBco7ENlqEX7+fBP2c=
 github.com/byteness/percent v0.2.2 h1:vnIFh8WBR1xoC+U2etz0EMB1cgp+vsK6vynqTCeDziU=
 github.com/byteness/percent v0.2.2/go.mod h1:nwavge92FhIyfnldz4YWZD8uxPVvdh8NlzLRd1VYRDs=
 github.com/catppuccin/go v0.3.0 h1:d+0/YicIq+hSTo5oPuRi5kOpqkVA5tAsU6dNhvRu+aY=
@@ -128,8 +128,8 @@ github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/noamcohen97/touchid-go v0.3.0 h1:fcXxVCizysD7KHRR6hrURt3nyNIs5JBGSbOIidD/3wo=
 github.com/noamcohen97/touchid-go v0.3.0/go.mod h1:X9MRNIBGEmPqwpDm1G3fQOAQX7fwBlhzUbnkDTxuta0=
-github.com/open-cli-collective/cli-common v0.2.2 h1:m5Uzvw5ya/Xljgn54wuCiVP4zXE9BZKikpQBqrXLCKg=
-github.com/open-cli-collective/cli-common v0.2.2/go.mod h1:nXAwJcuAo5+bMUD2soABKDwy2o27snBggS6/OTKQgvQ=
+github.com/open-cli-collective/cli-common v0.3.2 h1:jj3swzbzmZE9xALMOzTpCQXPylXDxuxWoSTT96G0Q84=
+github.com/open-cli-collective/cli-common v0.3.2/go.mod h1:3AzjCT0V8xgslHlGi1+rUkcV+Vf5wONGwISQkufLZLQ=
 github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs=
 github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
@@ -197,10 +197,10 @@ golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=