Merge branch 'main' into fall-orascp

Author: bupd

.github/workflows/release-github.yml

@@ -29,7 +29,11 @@ jobs:
       - name: setup go environment
         uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.25.4'
+      - name: Install Syft
+        uses: anchore/sbom-action/download-syft@v0.20.11
+        with:
+          syft-version: v1.32.0
       - name: run goreleaser
         uses: goreleaser/goreleaser-action@v6
         with:

.golangci.yml

@@ -29,6 +29,7 @@ linters:
   enable:
     - depguard
     - dupl
+    - goheader
     - gomodguard
     - govet
     - ineffassign
@@ -64,6 +65,9 @@ linters:
     dupl:
       threshold: 400
 
+    goheader:
+      template-path: copyright.tmpl
+
 run:
   timeout: 10m
 

.goreleaser.yml

@@ -68,6 +68,9 @@ archives:
     - goos: windows
       format: zip
 
+sboms:
+  - artifacts: archive
+
 release:
   draft: true
   prerelease: auto

CODEOWNERS

@@ -1,2 +1,2 @@
 # Derived from OWNERS.md
-* @sajayantony @shizhMSFT @stevelasker @qweeah @Wwwsylvia @TerryHowe
+* @sajayantony @shizhMSFT @Wwwsylvia @TerryHowe

Dockerfile

@@ -11,7 +11,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.25.4-alpine as builder
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.25.5-alpine as builder
 ARG TARGETPLATFORM
 RUN apk add git make
 ENV ORASPKG /oras

OWNERS.md

@@ -3,11 +3,11 @@
 Owners:
   - Sajay Antony (@sajayantony)
   - Shiwei Zhang (@shizhMSFT)
-  - Steve Lasker (@stevelasker)
   - Terry Howe (@TerryHowe)
 
 Emeritus:
   - Avi Deitcher (@deitch)
   - Jimmy Zelinskie (@jzelinskie)
   - Josh Dolitsky (@jdolitsky)
+  - Steve Lasker (@stevelasker)
   - Vincent Batts (@vbatts)

cmd/oras/internal/display/metadata/text/manifest_delete.go

@@ -3,7 +3,9 @@ Copyright The ORAS Authors.
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
+
 http://www.apache.org/licenses/LICENSE-2.0
+
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

cmd/oras/internal/display/metadata/text/tag_test.go

@@ -3,7 +3,9 @@ Copyright The ORAS Authors.
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
+
 http://www.apache.org/licenses/LICENSE-2.0
+
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

cmd/oras/internal/option/platform_test.go

@@ -3,7 +3,9 @@ Copyright The ORAS Authors.
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
+
 http://www.apache.org/licenses/LICENSE-2.0
+
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

cmd/oras/root/manifest/index/cmd.go

@@ -3,7 +3,9 @@ Copyright The ORAS Authors.
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
+
 http://www.apache.org/licenses/LICENSE-2.0
+
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.