security: bump to go 1.23.8 to resolve CVE-2025-22871 (#1597)

Signed-off-by: Anish Ramasekar <[email protected]>

Author: aramase

.github/workflows/azwi-build.yaml

@@ -21,7 +21,7 @@ jobs:
       fail-fast: false
       matrix:
         # TODO(aramase): add windows test env
-        env: [ubuntu-20.04, macos-13]
+        env: [ubuntu-latest, macos-13]
     runs-on: ${{ matrix.env }}
     steps:
       - name: Harden Runner

.github/workflows/azwi-e2e.yaml

@@ -19,7 +19,7 @@ jobs:
       fail-fast: false
       matrix:
         # TODO(aramase): add windows test env
-        env: [ubuntu-20.04, macos-13]
+        env: [ubuntu-latest, macos-13]
     runs-on: ${{ matrix.env }}
     steps:
       - name: Harden Runner

.github/workflows/chart.yaml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   deploy:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1

.github/workflows/create-release-pull-request.yaml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   create-release-pull-request:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1

.github/workflows/publish-images.yaml

@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   export-registry:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     outputs:
       registry: ${{ steps.export.outputs.registry }}
     steps:
@@ -33,7 +33,7 @@ jobs:
       fail-fast: false
       matrix:
         image: [webhook, proxy, proxy-init]
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
@@ -65,7 +65,7 @@ jobs:
       fail-fast: false
       matrix:
         dir: [examples/msal-go, examples/msal-net/akvdotnet, examples/msal-node, examples/msal-python, examples/msal-java]
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1

.github/workflows/website.yaml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   deploy:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1

Makefile

@@ -55,7 +55,7 @@ KUSTOMIZE_VER := v4.1.2
 KUSTOMIZE_BIN := kustomize
 KUSTOMIZE := $(TOOLS_BIN_DIR)/$(KUSTOMIZE_BIN)-$(KUSTOMIZE_VER)
 
-GOLANGCI_LINT_VER := v1.61.0
+GOLANGCI_LINT_VER := v1.64.8
 GOLANGCI_LINT_BIN := golangci-lint
 GOLANGCI_LINT := $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER)
 

docker/proxy.Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23-bookworm as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23.8-bookworm@sha256:e052bd5581c75956d08a78b47ba5d12b746aef722f4cd577c98fb571e3072188 as builder
 
 ARG LDFLAGS
 

docker/webhook.Dockerfile

@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23-bookworm as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23.8-bookworm@sha256:e052bd5581c75956d08a78b47ba5d12b746aef722f4cd577c98fb571e3072188 as builder
 
 ARG LDFLAGS
 

examples/msal-go/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23-bookworm as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.23.8-bookworm@sha256:e052bd5581c75956d08a78b47ba5d12b746aef722f4cd577c98fb571e3072188 as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests