feat: port action from Node to Go and decouple image tags

.dockerignore

@@ -1,17 +1,15 @@
-node_modules
-tests
-coverage
-.github
 .git
+.github
 Dockerfile
-.nvmrc
-jest.config.js
-*.pem
-credentials.json
 .dockerignore
 .gitignore
 .env.example
 .env
-.eslintrc.js
-.prettierrc.js
+*.pem
+credentials.json
 action.yml
+README.md
+LICENSE
+SECURITY.md
+renovate.json
+coverage.out

.env.example

@@ -1,12 +1,15 @@
-GOOGLE_EMAIL_ADDRESS=hello@example.com
-GOOGLE_CREDENTIALS=ewogICJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsCiAgInByb2plY3RfaWQiOiAibXlwcm9qZWN0IiwKICAicHJpdmF0ZV9rZXlfaWQiOiAicHJpdmF0ZWtleWlkZ29lc2hlcmUiLAogICJwcml2YXRlX2tleSI6ICItLS0tLUJFR0lOIFBSSVZBVEUgS0VZLS0tLS1cbnByaXZhdGVrZXlnb2VzaGVyZVxuLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLVxuIiwKICAiY2xpZW50X2VtYWlsIjogImdpdGh1YnVzZXJtYW5hZ2VyQGdpdGh1YnVzZXJtYW5hZ2VyLmlhbS5nc2VydmljZWFjY291bnQuY29tIiwKICAiY2xpZW50X2lkIjogImNsaWVudGlkIiwKICAiYXV0aF91cmkiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tL28vb2F1dGgyL2F1dGgiLAogICJ0b2tlbl91cmkiOiAiaHR0cHM6Ly9vYXV0aDIuZ29vZ2xlYXBpcy5jb20vdG9rZW4iLAogICJhdXRoX3Byb3ZpZGVyX3g1MDlfY2VydF91cmwiOiAiaHR0cHM6Ly93d3cuZ29vZ2xlYXBpcy5jb20vb2F1dGgyL3YxL2NlcnRzIiwKICAiY2xpZW50X3g1MDlfY2VydF91cmwiOiAiaHR0cHM6Ly93d3cuZ29vZ2xlYXBpcy5jb20vcm9ib3QvdjEvbWV0YWRhdGEveDUwOS9naXRodWJ1c2VybWFuYWdlciU0MGdpdGh1YnVzZXJtYW5hZ2VyLmlhbS5nc2VydmljZWFjY291bnQuY29tIgp9Cg==
-ADD_USERS=TRUE
-REMOVE_USERS=TRUE
-EXIT_CODE_ON_MISMATCH=0
-GITHUB_ORG=myorg
-GITHUB_INSTALLATION_ID=123
-GITHUB_APP_ID=123
-GITHUB_PRIVATE_KEY=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5wcml2YXRla2V5Z29lc2hlcmVcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
-IGNORED_USERS=user1,user2
-SYNC_TEAM=TRUE
-GITHUB_TEAM_SLUG=remarkable
+# Inputs are read as GitHub Action inputs, exposed to the container as INPUT_*
+# environment variables (upper-cased input name). Set these when running the
+# container directly, e.g. `docker run --env-file .env githubusermanager`.
+INPUT_GOOGLE-EMAIL-ADDRESS=hello@example.com
+INPUT_GOOGLE-CREDENTIALS=ewogICJ0eXBlIjogInNlcnZpY2VfYWNjb3VudCIsCiAgInByb2plY3RfaWQiOiAibXlwcm9qZWN0IiwKICAicHJpdmF0ZV9rZXlfaWQiOiAicHJpdmF0ZWtleWlkZ29lc2hlcmUiLAogICJwcml2YXRlX2tleSI6ICItLS0tLUJFR0lOIFBSSVZBVEUgS0VZLS0tLS1cbnByaXZhdGVrZXlnb2VzaGVyZVxuLS0tLS1FTkQgUFJJVkFURSBLRVktLS0tLVxuIiwKICAiY2xpZW50X2VtYWlsIjogImdpdGh1YnVzZXJtYW5hZ2VyQGdpdGh1YnVzZXJtYW5hZ2VyLmlhbS5nc2VydmljZWFjY291bnQuY29tIiwKICAiY2xpZW50X2lkIjogImNsaWVudGlkIiwKICAiYXV0aF91cmkiOiAiaHR0cHM6Ly9hY2NvdW50cy5nb29nbGUuY29tL28vb2F1dGgyL2F1dGgiLAogICJ0b2tlbl91cmkiOiAiaHR0cHM6Ly9vYXV0aDIuZ29vZ2xlYXBpcy5jb20vdG9rZW4iLAogICJhdXRoX3Byb3ZpZGVyX3g1MDlfY2VydF91cmwiOiAiaHR0cHM6Ly93d3cuZ29vZ2xlYXBpcy5jb20vb2F1dGgyL3YxL2NlcnRzIiwKICAiY2xpZW50X3g1MDlfY2VydF91cmwiOiAiaHR0cHM6Ly93d3cuZ29vZ2xlYXBpcy5jb20vcm9ib3QvdjEvbWV0YWRhdGEveDUwOS9naXRodWJ1c2VybWFuYWdlciU0MGdpdGh1YnVzZXJtYW5hZ2VyLmlhbS5nc2VydmljZWFjY291bnQuY29tIgp9Cg==
+INPUT_ADD-USERS=TRUE
+INPUT_REMOVE-USERS=TRUE
+INPUT_EXIT-CODE-ON-MISMATCH=0
+INPUT_GITHUB-ORG=myorg
+INPUT_GITHUB-INSTALLATION-ID=123
+INPUT_GITHUB-APP-ID=123
+INPUT_GITHUB-PRIVATE-KEY=LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tXG5wcml2YXRla2V5Z29lc2hlcmVcbi0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS1cbg==
+INPUT_IGNORED-USERS=user1,user2
+INPUT_SYNC-TEAM=TRUE
+INPUT_TEAM-SLUG=remarkable

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: ci
-
 on:
   push:
     branches:
@@ -8,51 +7,61 @@ on:
   release:
     types:
       - created
-
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
         with:
-          version: 10
-      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
-        with:
-          node-version-file: .nvmrc
-          cache: pnpm
-
+          go-version-file: go.mod
+          cache: true
       - run: |
-          pnpm install
-          pnpm lint
-          pnpm test
-          pnpm check-types
-
+          go vet ./...
+          go test -race -coverprofile=coverage.out ./...
+          go build ./...
       - id: docker_meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
-          images: docker.pkg.github.com/remarkable/githubUserManager/githubUserManager
+          images: ghcr.io/remarkable/githubusermanager
+          # Tag by event so each image is traceable to what produced it:
+          #   - pull request  -> `pr-<number>` (so a PR build can be tested)
+          #   - push to main  -> `main`
+          #   - release vX.Y.Z -> `vX.Y.Z`, `vX.Y`, `vX` (moving tags)
+          #   - any build      -> `sha-<shortsha>` (for debugging/pinning)
           tags: |
-            type=sha
+            type=ref,event=pr
+            type=ref,event=branch
             type=semver,pattern=v{{version}}
+            type=semver,pattern=v{{major}}.{{minor}}
+            type=semver,pattern=v{{major}}
+            type=sha
           labels: |
             org.opencontainers.image.vendor=reMarkable
             org.opencontainers.image.documentation=https://github.com/reMarkable/githubUserManager
             org.opencontainers.image.authors=Marcus Ramberg <marcus.ramberg@remarkable.com>
             maintainer=reMarkable
-
-      - name: Login to docker registry
-        if: ${{ github.event_name != 'pull_request' }}
+      - name: Login to GitHub Container Registry
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
-          registry: docker.pkg.github.com
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Push to GitHub Packages
+      # Push on every internal build, including same-repo PRs (tagged
+      # `pr-<number>`), so a PR image can be pulled and tested before merge.
+      # Fork PRs only build (no push) because they get a read-only token. The
+      # action itself still runs as a Docker container action built from the
+      # Dockerfile at the referenced commit, so consumers can keep pinning an
+      # immutable SHA.
+      - name: Build and push to GitHub Container Registry
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          push: ${{ github.event_name != 'pull_request' }}
+          push: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}

.github/workflows/codeql-analysis.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
         with:
-          languages: javascript
+          languages: go
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4

.github/workflows/release.yml

@@ -0,0 +1,50 @@
+name: release
+
+# When a release is published for a semver tag (vX.Y.Z), move the matching
+# major (vX) and major.minor (vX.Y) git tags to the released commit. This keeps
+# `uses: reMarkable/githubUserManager@v1` (and @v1.2) pointing at the latest
+# compatible release. The action is a Docker container action built from the
+# Dockerfile at the referenced commit, so these git tags are the only thing
+# consumers pin against.
+on:
+  release:
+    types:
+      - published
+
+permissions:
+  contents: write
+
+jobs:
+  move-major-minor-tags:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          fetch-depth: 0
+
+      - name: Move major and major.minor tags
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          RELEASE_SHA: ${{ github.event.release.target_commitish }}
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$RELEASE_TAG" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            echo "Release tag '$RELEASE_TAG' is not a vX.Y.Z semver tag; skipping."
+            exit 0
+          fi
+
+          major="v${BASH_REMATCH[1]}"
+          minor="v${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
+
+          # Resolve the commit the release points at (the annotated release tag).
+          target="$(git rev-list -n 1 "$RELEASE_TAG")"
+          echo "Release $RELEASE_TAG -> $target; moving $major and $minor"
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          for tag in "$major" "$minor"; do
+            git tag -f "$tag" "$target"
+            git push --force origin "refs/tags/$tag"
+          done

.gitignore

@@ -1,5 +1,6 @@
 credentials.json
-node_modules
 .env
 coverage
-*.pem
+coverage.out
+*.pem
+/githubusermanager

.pre-commit-config.yaml

@@ -0,0 +1,34 @@
+# See https://pre-commit.com for more information
+# See https://pre-commit.com/hooks.html for more hooks
+default_install_hook_types: [pre-commit, commit-msg]
+repos:
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 0.38.2
+    hooks:
+      - id: check-github-workflows
+      - id: check-renovate
+  - repo: builtin
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.109.2
+    hooks:
+      - id: terraform_fmt
+      - id: terraform_tflint
+  - repo: https://github.com/compilerla/conventional-pre-commit
+    rev: v4.4.0
+    hooks:
+      - id: conventional-pre-commit
+        stages: [commit-msg]
+        args: [feat, fix, docs, perf, refactor, test, security, chore]
+  - repo: https://github.com/hadolint/hadolint
+    rev: v2.15.1
+    hooks:
+      - id: hadolint
+  - repo: 'https://github.com/golangci/golangci-lint'
+    rev: v2.15.0
+    hooks:
+      - id: golangci-lint-full
+      - id: golangci-lint-fmt
+      - id: golangci-lint-config-verify

Dockerfile

@@ -1,9 +1,12 @@
-FROM node:24.18.1-alpine@sha256:f70403e87646dc51b45295f4b8b70cdad0b63d2297c4c9899119b03f7af7a6b3
+# syntax=docker/dockerfile:1
+FROM golang:1.27-alpine AS build
 
-WORKDIR /app
-RUN corepack enable && echo yo
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN pnpm install --production --frozen-lockfile
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
+RUN CGO_ENABLED=0 GOFLAGS=-trimpath go build -ldflags="-s -w" -o /githubusermanager .
 
-CMD ["pnpm", "start"]
+FROM gcr.io/distroless/static-debian13:nonroot
+COPY --from=build /githubusermanager /githubusermanager
+ENTRYPOINT ["/githubusermanager"]

LICENSE

@@ -173,4 +173,4 @@ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
   incurred by, or claims asserted against, such Contributor by reason
   of your accepting any such warranty or additional liability.
 
-END OF TERMS AND CONDITIONS
+END OF TERMS AND CONDITIONS