Additionally as of v3.1.0 of actions/setup-go there is a go-version
output value to retrieve the version of Go installed by the Action.
This allows us to remove the step to manually retrieve this information
from the Go executable.

Go 1.16 is no longer supported as of the release of 1.18 so it makes
sense to update to the latest version available.

Go 1.19 was released while this branch was in the wings and it makes
sense to bump to the latest Go release.

Update Go installation in the `build.yml` workflow

Bumps [hashicorp/setup-terraform](https://github.com/hashicorp/setup-terraform) from 1 to 2.
- [Release notes](https://github.com/hashicorp/setup-terraform/releases)
- [Changelog](https://github.com/hashicorp/setup-terraform/blob/main/CHANGELOG.md)
- [Commits](hashicorp/setup-terraform@v1...v2)

---
updated-dependencies:
- dependency-name: hashicorp/setup-terraform
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

…orp/setup-terraform-2

Bump hashicorp/setup-terraform from 1 to 2

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 3 to 4.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

…s/setup-python-4

Bump actions/setup-python from 3 to 4

Add a comment that states that the commented out ignore directives are
managed by cisagov/skeleton-generic.

This adds the other versioned Actions that should be managed by
cisagov/skeleton-generic to the list of commented out dependencies to
ignore.

…nores

Update Dependabot ignore directives

GitHub has deprecated the set-output command per:
https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

This updates the GitHub Actions workflow to use the newly preferred
method to set the output for a job's step.

Remove usage of `set-output` from our GitHub Actions workflow

Increase the line length maximum from the default of 80 to 88. This 10%
increase mirrors the line length allowed in other linter configurations
such as black.

…-length_rules

Update the `line-length` configuration for `yamllint`

Per PyCQA/flake8#1290 this hook moved from GitLab to GitHub. The
version we use is bumped to the latest tag on GitHub as well.

Update the `flake8` pre-commit hook configuration

Update pre-commit hooks using `pre-commit autoupdate`. The `ansible-lint` hook
is intentionally held back due to issues with upgrading to v6.

Update pre-commit hooks

This configuration file stores information about the labels expected in
this repository.

This adds a workflow to ensure that the repository labels are updated
to reflect changes to the label configuration file .github/labels.yml.

Add workflow to manage repository labels

Update the configuration for repository labels to remove the leading
`#` from color values. With a `#` leading the values they are seen as
invalid by the GitHub API.

There was a missing empty line in the `.yamllint` file between two rule
definitions.

Update two configuration files

…skeleton

Bump actions/setup-python from v3 to v4 and use Python 3.10 to mirror
the `lint` job.

Remove the remaining uses of the `set-output` command since it has been
deprecated per:
https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/

⚠️ CONFLICT! Lineage pull request for: skeleton

The `bandit (everything else)` hook was not updated in sync with the
`bandit (tests tree)` hook and is using an older version of bandit.

Co-authored-by: dav3r <[email protected]>

…configuration

Update the version of the second `bandit` hook

Pull in the CodeQL workflow from cisagov/skeleton-python-library to
update the CodeQL configuration for this repository. We also add
github/codeql-action to the dependencies managed by this repository in
the dependabot configuration.

Update the CodeQL configuration

This argument references a file that is no longer found in the
repository. The configuration also no longer uses any such files so it
is safe to remove this as opposed to updating it instead.

Add all requirements*.txt files in the configuration to this file. This
ensures that all requirements in use are being used for scanning.

Until we completely remove LGTM from our repositories we should keep at
least the minimum badging. This project does not directly use any
Python, JavaScript, etc. so I am enabling the "Total alerts" badge.
Other possibilities are commented out to make it easier for
downstream repositories to enable what suits their configurations.

…rations

Update some outdated items in the project

Bumps [actions/github-script](https://github.com/actions/github-script) from 5 to 6.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](actions/github-script@v5...v6)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

…/github-script-6

Bump actions/github-script from 5 to 6

We saw in cisagov/postfix-docker#47 that the sed commands in the
bump_version.sh script could inadvertently match the CC0 version in
the README.md file.  This change escapes the periods in the version
before passing it on to sed so that they only match periods and not
just any character.

…script

Fix overly eager sed commands

Also add a section to update pip and setuptools via pip.

Improve Dockerfile

LGTM.com is shutting down 2022-12-16 so we should remove all
LGTM-related items to prepare for disabling the LGTM.com integration in
the organization.

Remove LGTM from the repository

I accidentally clobbered these changes when I was updating
cisagov/skeleton-docker#135 for merge. This restores the changes made
during review as well as fixing a missed reference to the CISA_USER
argument.

Co-authored-by: Shane Frasier <[email protected]>

Restore Dockerfile changes from review

Update pre-commit hooks using `pre-commit autoupdate`. The `ansible-lint` hook
is intentionally held back to be updated independently to v6.

Update `pre-commit` hooks

Add a security label

Lineage pull request for: skeleton

When Dependabot creates a PR it requires this permission in order to
push Docker images to ghcr.io.

Add package write permission to workflow

Co-authored-by: Nick <[email protected]>

Update wheel along with pip and setuptools

In this case it doesn't matter because we are starting from a
Python3-specific base container, but other projects that use this
skeleton may not be.  Specifying pip3 ensures that the Python 2
version of pip is not called by mistake.

Specify pip3

Specify the default group to run under in the Dockerfile

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 3 to 4.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](docker/build-push-action@v3...v4)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

…/build-push-action-4

Bump docker/build-push-action from 3 to 4

Specify pip3 in the file where it got blown away by a rebase

Add @jasonodoom as a default codeowner

This is the latest minor release of Python so it makes sense to use it
as the default for this job.

…n_for_lint_job

Use Python 3.11 for the `lint` job in the `build` workflow

This is done automatically with the `pre-commit autoupdate` command.
However the `ansible-lint` hook is manually kept back as we have not
tested functionality to confirm that our roles will generally pass
with the new version.

Update `pre-commit` hooks

Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 4.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>

…s/setup-go-4

Bump actions/setup-go from 3 to 4

When wheel gets installed alongside other packages, it may not get
used when those other packages are installed.  When that happens I see
warnings like this:
  DEPRECATION: ansible-core is being installed using the legacy
  'setup.py install' method, because it does not have a
  'pyproject.toml' and the 'wheel' package is not installed. pip 23.1
  will enforce this behaviour change. A possible replacement is to
  enable the '--use-pep517' option. Discussion can be found at
  pypa/pip#8559

This change should get rid of these warnings.

Nota bene: This is the practice we follow in the Dockerfile in
cisagov/skeleton-docker, but for some reason we never started using it
in our workflows.

…nd-wheel-with-pip

Install/upgrade setuptools and wheel when upgrading pip

Co-authored-by: Shane Frasier <[email protected]>

Co-authored-by: Shane Frasier <[email protected]>

Co-authored-by: Shane Frasier <[email protected]>

Co-authored-by: Shane Frasier <[email protected]>

Co-authored-by: Shane Frasier <[email protected]>

Co-authored-by: Shane Frasier <[email protected]>