[EXPERIMENTAL] CLOUDP-346302: Manage go tools with go.mod

[josvazg]

Summary

Try to manage Go tools with go.mod rather than devbox.

Open Questions>

• Will the license tool complain for tools licenses or ignore them as they are not linked in?
• How easy or painful the change is in terms automation changes?
• Does developer UX improve?

Tools moved:

• golangci-lint (GPLv3)
• act (MIT)
• govulncheck (BSD 3 Clause)
• ginkgo (MIT)
• operator-sdk (Apache 2.0)
• controller-gen (Apache 2.0)
• setup-envtest (Apache 2.0)
• yq (MIT)

Tools moved back into devbox:

• go-licenses was being using with go run directly. It failed as a go tool because it broke some denpendencies, so it had to be a devbox dependency instead.

Removed unused:

• gettext
• gotools

Replaced:

• wget replaced by curl.

Go programs left in devbox:

• kubectl: It does not even work as a go tool.
• jq is a C tool.
• docker: Is a complex client-server setup.
• cosign broke dependencies for mgechev/revive/formatter.
• kubernetes-helm broke dependencies for kustomize/kyaml.
• kubebuilder broke dependencies for controller-gen.
• shellcheck is a Haskel program.
• awscli2 is a Python tool.
• docker-sbom does not work as a go tool.
• openshift is a complex setup.
• gci broke dependencies for kustomize.
• gh broke dependencies for controller-gen.
• kustomize broke e2e tests as a go tool.

Proof of Work

CI should work.

Checklist

• Have you linked a jira ticket and/or is the ticket in the title?
• Have you checked whether your jira ticket required DOCSP changes?
• Have you signed our CLA?