grype/.binny.yaml

tools:
  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
  - name: binny
    version:
      want: v0.8.0
    method: github-release
    with:
      repo: anchore/binny

  # used to produce SBOMs during release
  - name: syft
    version:
      want: latest
    method: github-release
    with:
      repo: anchore/syft

  # used to sign mac binaries at release
  - name: quill
    version:
      want: v0.4.1
    method: github-release
    with:
      repo: anchore/quill

  # used for linting
  - name: golangci-lint
    version:
      want: v1.59.1
    method: github-release
    with:
      repo: golangci/golangci-lint

  # used for showing the changelog at release
  - name: glow
    version:
      want: v1.5.1
    method: github-release
    with:
      repo: charmbracelet/glow

  # used for signing the checksums file at release
  - name: cosign
    version:
      want: v2.2.4
    method: github-release
    with:
      repo: sigstore/cosign

  # used in integration tests to verify JSON schemas
  - name: yajsv
    version:
      want: v1.4.1
    method: github-release
    with:
      repo: neilpa/yajsv

  # used to release all artifacts
  - name: goreleaser
    version:
      want: v2.0.1
    method: github-release
    with:
      repo: goreleaser/goreleaser

  # used for organizing imports during static analysis
  - name: gosimports
    version:
      want: v0.3.8
    method: github-release
    with:
      repo: rinchsan/gosimports

  # used at release to generate the changelog
  - name: chronicle
    version:
      want: v0.8.0
    method: github-release
    with:
      repo: anchore/chronicle

  # used during static analysis for license compliance
  - name: bouncer
    version:
      want: v0.4.0
    method: github-release
    with:
      repo: wagoodman/go-bouncer

  # used for running all local and CI tasks
  - name: task
    version:
      want: v3.37.2
    method: github-release
    with:
      repo: go-task/task

  # used for triggering a release
  - name: gh
    version:
      want: v2.50.0
    method: github-release
    with:
      repo: cli/cli

  # used for integration tests
  - name: skopeo
    version:
      want: v1.15.1
    method: go-install
    with:
      module: github.com/containers/skopeo
      entrypoint: cmd/skopeo
      args:
        - "-tags"
        - containers_image_openpgp
      env:
        - CGO_ENABLED=0
        - GO_DYN_FLAGS=""