Merge pull request firecracker-microvm#93 from austinvazquez/pin-deps

Resolve build reproducibility issues

.github/workflows/go.yml

@@ -22,7 +22,21 @@ jobs:
         go-version: ${{ matrix.go }}
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
+      with:
+        # By default, the checkout action only fetches the last commit,
+        # but we want to run DCO check against all commit messages.
+        # Assuming that a pull request may have multiple commits,
+        # fetching the single commit doesn't work for us.
+        #
+        # While DCO check (on Makefile) checks latest 5 commits,
+        # the checkout action automatically creates a merge commit
+        # for merging "main" into a pull request branch.
+        # In addition to that, Git cannot recognize merge commits when
+        # one of the parents is missing.
+        # So, we will fetch 15 commits just in case to have
+        # 5 actual commits with associated merged commits.
+        fetch-depth: 15
 
     - name: Run static analysis
       run: make lint

Makefile

@@ -36,19 +36,29 @@ build-in-docker:
 test:
 	go test -v ./...
 
+GO_MINOR_VERSION = $(shell go version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
+
 $(BINPATH)/ltag:
-	GOBIN=$(BINPATH) GO111MODULE=off go get -u github.com/kunalkushwaha/ltag
+	@if [ $(GO_MINOR_VERSION) -lt 16 ]; then \
+		GOBIN=$(BINPATH) GO111MODULE=on go get -u github.com/kunalkushwaha/[email protected]; \
+	else \
+		GOBIN=$(BINPATH) GO111MODULE=on go install github.com/kunalkushwaha/[email protected]; \
+	fi
 
 $(BINPATH)/git-validation:
-	GOBIN=$(BINPATH) GO111MODULE=off go get -u github.com/vbatts/git-validation
+	@if [ $(GO_MINOR_VERSION) -lt 16 ]; then \
+		GOBIN=$(BINPATH) GO111MODULE=on go get -u github.com/vbatts/[email protected]; \
+	else \
+		GOBIN=$(BINPATH) GO111MODULE=on go install github.com/vbatts/[email protected]; \
+	fi
 
 $(BINPATH)/golangci-lint:
 	curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b $(BINPATH) v1.46.2
 	$(BINPATH)/golangci-lint --version
 
 lint: $(BINPATH)/ltag $(BINPATH)/git-validation $(BINPATH)/golangci-lint
 	$(BINPATH)/ltag -v -t ./.headers -check
-	$(BINPATH)/git-validation -q -run DCO,short-subject -range HEAD~3..HEAD
+	$(BINPATH)/git-validation -q -run DCO,short-subject -range HEAD~5..HEAD
 	$(BINPATH)/golangci-lint run
 
 clean: