Release v12.0.0

.github/ISSUE_TEMPLATE/bug_report.md

@@ -20,8 +20,9 @@ A clear and concise description of what you expected to happen.
 If applicable, add screenshots to help explain your problem.
 
 **Desktop (please complete the following information):**
- - OS: [e.g. iOS]
- - Version [e.g. 22]
+
+- OS: [e.g. iOS]
+- Version [e.g. 22]
 
 **Additional context**
 Add any other context about the problem here.

.github/dependabot.yml

@@ -1,5 +1,10 @@
 version: 2
 updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: daily
+
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/buf-ci.yml

@@ -0,0 +1,34 @@
+name: Buf CI
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+  push:
+    branches:
+      - development
+      - master
+    tags:
+      - '*'
+  release:
+    types:
+      - published
+
+jobs:
+  buf:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+
+      - name: Buf Action
+        uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c #v1.3.0
+        with:
+          breaking: false
+          token: ${{ secrets.BUF_TOKEN }}

.github/workflows/codeql.yml

@@ -7,29 +7,34 @@ on:
 
 jobs:
   analyze:
-    name: Analyze
+    name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
-
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
     strategy:
       fail-fast: false
       matrix:
-        languages:
-          - go
+        include:
+          - language: actions
+            build-mode: none
+          - language: go
+            build-mode: autobuild
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v4
         with:
-          languages: ${{ matrix.languages }}
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
           queries: security-extended,security-and-quality
 
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
-
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v4
         with:
-          category: /language:${{ matrix.languages }}
+          category: "/language:${{matrix.language}}"

.github/workflows/release.yml

@@ -3,31 +3,34 @@ name: "Release"
 on:
   release:
     types:
-      - created
+      - published
 
 jobs:
   artifacts:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
+      - name: Checkout Repository
+        uses: actions/checkout@v5
 
-      - name: Build Docker image
-        run: docker build --compress --file Dockerfile --force-rm --tag sentinel-official/sentinelhub .
+      - name: Build and Tag Docker Image
+        run: make build-image
 
-      - name: Copy binary file
+      - name: Extract Binary
         run: |
-          docker create --name container sentinel-official/sentinelhub && \
-          docker cp container:/usr/local/bin/sentinelhub ./sentinelhub && \
-          docker rm container
+          docker create --name artifacts sentinelhub:latest
+          docker cp artifacts:/usr/local/bin/sentinelhub ./sentinelhub
+          docker rm artifacts
 
-      - name: Save SHA256 sum
-        run: sha256sum ./sentinelhub > ./sentinelhub_sha256.txt
+      - name: Generate SHA256 Checksum
+        run: sha256sum sentinelhub > ./checksums.txt
 
-      - name: Upload release artifacts
-        uses: softprops/action-gh-release@v1
+      - name: Upload Release Artifacts
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 #v2.4.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           files: |
+            checksums.txt
             sentinelhub
-            sentinelhub_sha256.txt

.github/workflows/test.yml

@@ -1,4 +1,4 @@
-name: Tests and Code coverage
+name: Tests and Code Coverage
 
 on:
   pull_request:
@@ -8,28 +8,39 @@ on:
       - master
 
 jobs:
-  run:
+  go:
     runs-on: ubuntu-latest
-    timeout-minutes: 30
+    permissions:
+      contents: read
+    timeout-minutes: 5
+
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-      - name: Setup Go
-        uses: actions/setup-go@v4
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+
+      - name: Set Up Go
+        uses: actions/setup-go@v6
         with:
-          go-version: '1.20'
-      - name: Generate coverage report
+          go-version: '1.25'
+
+      - name: Generate Coverage Report
         run: |
           make test-coverage
-          filepaths+=" $(find ./ -type f -name '*.go' -exec grep -l 'DO NOT COVER' {} \;)"
-          filepaths+=" $(find ./ -type f -name '*.pb.go')"
-          filepaths+=" $(find ./ -type f -name '*.pb.gw.go')"
-          for filepath in ${filepaths}; do
-            filepath=$(echo ${filepath} | sed 's/^./github.com\/sentinel-official\/hub/g')
-            echo "Excluding file ${filepath} from coverage report..."
-            sed -i "/$(echo ${filepath} | sed 's/\//\\\//g')/d" ./coverage.txt
+          files=""
+          files+=" $(find ./ -type f -name '*.go' -exec grep -l 'DO NOT COVER' {} \;)"
+          files+=" $(find ./ -type f -name '*.pb.go')"
+          files+=" $(find ./ -type f -name '*.pb.gw.go')"
+          files+=" $(find ./ -type f -path '*/client/cli/*')"
+          files+=" $(find ./ -type f -path '*/expected/*')"
+          files+=" $(find ./ -type f -path '*/services/*')"
+          for f in ${files}; do
+            f=$(echo "${f}" | sed 's@^[email protected]/sentinel-official/sentinelhub/v[0-9]*@g')
+            echo "Excluding file ${f} from coverage report..."
+            sed -i "/$(echo "${f}" | sed 's@/@\\/@g')/d" ./coverage.txt
           done
-      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+
+      - name: Upload Coverage to Codecov
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 #v5.5.1
         with:
           file: ./coverage.txt
+          token: ${{ secrets.CODECOV_TOKEN }}

.golangci.yaml

@@ -0,0 +1,36 @@
+version: '2'
+linters:
+  default: all
+  disable:
+    - cyclop
+    - depguard
+    - err113
+    - exhaustruct
+    - forcetypeassert
+    - funlen
+    - gocognit
+    - ireturn
+    - lll
+    - mnd
+    - nestif
+    - nilnil
+    - noinlineerr
+    - nonamedreturns
+    - varnamelen
+    - wsl
+  settings:
+    gosec:
+      excludes:
+        - G115
+        - G204
+        - G404
+    revive:
+      rules:
+        - name: package-comments
+          disabled: true
+    tagliatelle:
+      case:
+        rules:
+          json: snake
+run:
+  timeout: 1m

Dockerfile

@@ -1,16 +1,41 @@
-FROM golang:1.20-alpine3.18 as build
+# Build stage
+FROM golang:1.25-alpine3.22 AS build
 
-COPY . /root/
+# Set working directory
+WORKDIR /root
 
-RUN apk add build-base ca-certificates git linux-headers wget && \
-    cd /root/ && \
+# Install build dependencies
+RUN apk add --no-cache \
+    build-base \
+    ca-certificates \
+    git \
+    linux-headers \
+    wget
+
+# Cache Go modules
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+
+# Copy source code
+COPY . .
+
+# Download and install CosmWasm static library
+RUN unset GOTOOLCHAIN && \
     ARCH=$(uname -m) && \
     WASM_VERSION=$(go list -m all | grep github.com/CosmWasm/wasmvm | awk '{print $NF}') && \
-    wget -q -O /usr/local/lib/libwasmvm_muslc.a https://github.com/CosmWasm/wasmvm/releases/download/${WASM_VERSION}/libwasmvm_muslc.${ARCH}.a && \
-    STATIC=true make --jobs=$(nproc) build
+    wget -q -O /usr/local/lib/libwasmvm_muslc.a \
+        https://github.com/CosmWasm/wasmvm/releases/download/${WASM_VERSION}/libwasmvm_muslc.${ARCH}.a
+
+# Build sentinelhub
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    STATIC=true make --jobs="$(nproc)" build
 
-FROM alpine:3.18
+# Runtime stage
+FROM alpine:3.22
 
-COPY --from=build /root/build/sentinelhub /usr/local/bin/sentinelhub
+# Copy the built binaries from build stage
+COPY --from=build /root/bin/sentinelhub /usr/local/bin/sentinelhub
 
 ENTRYPOINT ["sentinelhub"]