Fix logic for tags creation date retrieving

.github/workflows/checks.yaml

@@ -29,13 +29,13 @@ jobs:
         uses: actions/setup-go@v6
         with:
           check-latest: true
-          go-version: 1.26.1
+          go-version: 1.26.2
       - name: Run golangci-lint
         uses: golangci/golangci-lint-action@v9
         with:
           version: latest
       - name: Delete pre-installed shellcheck
-        run: sudo rm -f $(which shellcheck)
+        run: sudo rm -f "$(which shellcheck)"
       - name: Run shellcheck
         run: make run-shellcheck
       - name: Dependency Licenses Review
@@ -45,7 +45,7 @@ jobs:
         env:
           CLICOLOR: "1"
       - name: Delete typos binary
-        run: rm typos
+        run: rm -f typos
       - name: Check if source code files have license header
         run: make check-addlicense
       - name: REUSE Compliance Check

.github/workflows/ci.yaml

@@ -32,12 +32,12 @@ jobs:
         uses: actions/setup-go@v6
         with:
           check-latest: true
-          go-version: 1.26.1
+          go-version: 1.26.2
       - name: Build all binaries
         run: make build-all
   code_coverage:
     name: Code coverage report
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     needs:
       - test
     runs-on: ubuntu-latest
@@ -65,7 +65,7 @@ jobs:
         uses: actions/setup-go@v6
         with:
           check-latest: true
-          go-version: 1.26.1
+          go-version: 1.26.2
       - name: Run tests and generate coverage report
         run: make build/cover.out
       - name: Archive code coverage results

.github/workflows/codeql.yaml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/setup-go@v6
         with:
           check-latest: true
-          go-version: 1.26.1
+          go-version: 1.26.2
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4
         with:

.golangci.yaml

@@ -91,12 +91,14 @@ linters:
         # Applications wishing to use http.ServeMux should obtain local instances through http.NewServeMux() instead of using the global default instance.
         - pattern: ^http\.DefaultServeMux$
         - pattern: ^http\.Handle(?:Func)?$
-        - pkg: ^gopkg\.in/square/go-jose\.v2$
+        - pkg: ^gopkg\.in/square/go-jose\.v2
           msg: gopk.in/square/go-jose is archived and has CVEs. Replace it with gopkg.in/go-jose/go-jose.v2
-        - pkg: ^github.com/coreos/go-oidc$
+        - pkg: ^github\.com/coreos/go-oidc
           msg: github.com/coreos/go-oidc depends on gopkg.in/square/go-jose which has CVEs. Replace it with github.com/coreos/go-oidc/v3
-        - pkg: ^github.com/howeyc/gopass$
+        - pkg: ^github\.com/howeyc/gopass
           msg: github.com/howeyc/gopass is archived, use golang.org/x/term instead
+        - pkg: ^github\.com/containers/image/v5
+          msg: github.com/containers/image/v5 is deprecated and was replaced with go.podman.io/image/v5
     goconst:
       min-occurrences: 5
     gocritic:
@@ -130,6 +132,8 @@ linters:
         - github.com/mdlayher/arp
         # for github.com/sapcc/vpa_butler
         - k8s.io/client-go
+        # for github.com/sapcc/keppel et al
+        - github.com/go-gorp/gorp/v3
       toolchain-forbidden: true
       go-version-pattern: 1\.\d+(\.0)?$
     gosec:

cloudprofilesync/source.go

@@ -8,7 +8,6 @@ import (
 	"encoding/json"
 	"errors"
 	"strings"
-	"time"
 
 	"golang.org/x/sync/semaphore"
 	"oras.land/oras-go/v2/registry/remote"
@@ -24,7 +23,6 @@ type Result[T any] struct {
 type SourceImage struct {
 	Version       string
 	Architectures []string
-	CreatedAt     time.Time
 }
 
 type Source interface {
@@ -106,21 +104,10 @@ func (o *OCI) GetVersions(ctx context.Context) ([]SourceImage, error) {
 				out <- Result[SourceImage]{err: errors.New("architecture annotation not found in descriptor")}
 				return
 			}
-			created := time.Time{}
-			if s, ok := manifest.Annotations["org.opencontainers.image.created"]; ok {
-				if t, err := time.Parse(time.RFC3339, s); err == nil {
-					created = t
-				}
-			} else if s, ok := manifest.Annotations["created"]; ok {
-				if t, err := time.Parse(time.RFC3339, s); err == nil {
-					created = t
-				}
-			}
 			out <- Result[SourceImage]{
 				value: SourceImage{
 					Version:       strings.ReplaceAll(tag, "_", "+"), // Follow the helm convention
 					Architectures: []string{arch},
-					CreatedAt:     created,
 				},
 			}
 		}()