Merge branch 'argoproj-labs:main' into fix/controller-status-reconciliation-loops

ZeBidule · web-flow · commit 3d372720350f · 2026-02-10T11:50:55.000+01:00
diff --git a/.github/workflows/bump-docs-manifests.yml b/.github/workflows/bump-docs-manifests.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Set up Git
         run: |
           git config user.name "${{ github.actor }}"
@@ -28,7 +28,7 @@ jobs:
           ./hack/bump-docs-manifests.sh ${{ github.event.inputs.new_version }}
           git add docs/getting-started.md docs/tutorial-argocd-apps.md docs/argocd-integrations.md
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           commit-message: "docs: bump manifest versions to v${{ github.event.inputs.new_version }}"
           title: "docs: bump manifest versions to v${{ github.event.inputs.new_version }}"
diff --git a/.github/workflows/ci-e2e.yaml b/.github/workflows/ci-e2e.yaml
@@ -32,7 +32,7 @@ jobs:
           cache-dependency-path: |
             go.sum
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1
+        uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
         with:
           cluster_name: kind
           version: v0.30.0
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -24,7 +24,7 @@ jobs:
         with:
           go-version: "1.25"
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -53,7 +53,7 @@ jobs:
         run: go mod download
       - name: Restore build output from cache
         id: cache-build
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: bin/manager
           key: ${{ runner.os }}-go-build-${{ hashFiles('**/*.go', 'go.sum') }}
@@ -66,7 +66,7 @@ jobs:
           fi
           echo "ui/web/static directory exists ✓"
       - name: Lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           version: v2.8.0
           args: --timeout=5m
@@ -79,21 +79,21 @@ jobs:
         run: make test-parallel
       - name: Generate code coverage artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: code-coverage
           path: cover.out
       - name: Upload code coverage information to codecov.io
         if: ${{ !cancelled() }}
-        uses: codecov/codecov-action@v5.5.2
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           files: cover.out
           fail_ci_if_error: false
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload test results to codecov.io
         if: ${{ !cancelled() }}
-        uses: codecov/test-results-action@v1
+        uses: codecov/test-results-action@0fa95f0e1eeaafde2c782583b36b28ad0d8c77d3 # v1.2.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
   codegen:
diff --git a/.github/workflows/release-latest.yaml b/.github/workflows/release-latest.yaml
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Setup Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -47,7 +47,7 @@ jobs:
           git push origin ${{ steps.extract_version.outputs.version }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Setup Go
         uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
@@ -32,17 +32,17 @@ jobs:
       issues: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Get token
         id: get_token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
         with:
           app-id: ${{ secrets.RENOVATE_APP_ID }}
           private-key: ${{ secrets.RENOVATE_APP_PRIVATE_KEY }}
 
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@v46.0.1
+        uses: renovatebot/github-action@e23f4d9675532445118c886434f5a34292b630b4 # v46.0.2
         with:
           configurationFile: renovate.json5
           token: ${{ steps.get_token.outputs.token }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
@@ -0,0 +1,51 @@
+name: Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '17 15 * * 3'
+  push:
+    branches: [ "main" ]
+
+# Declare default permissions as read only.
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
+    if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@b5ebac6f4c00c8ccddb7cdcd45fdb248329f808a # v3.32.2
+        with:
+          sarif_file: results.sarif
diff --git a/.github/workflows/spelling.yaml b/.github/workflows/spelling.yaml
@@ -22,4 +22,4 @@ jobs:
     - name: Checkout Actions Repository
       uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # pin@v6
     - name: Spell Check Repo
-      uses: crate-ci/typos@3a4d65230db538caabac6e156599c8ba8380ff07  # v1.43.1
+      uses: crate-ci/typos@9066e9940a8a05b98fb4733c62a726f83c9e57f8  # v1.43.3
diff --git a/README.md b/README.md
@@ -1,4 +1,6 @@
+[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/gitops-promoter)](https://artifacthub.io/packages/search?repo=gitops-promoter)
 [![codecov](https://codecov.io/gh/argoproj-labs/gitops-promoter/graph/badge.svg?token=Nbye3NDioO)](https://codecov.io/gh/argoproj-labs/gitops-promoter)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/argoproj-labs/gitops-promoter/badge)](https://scorecard.dev/viewer/?uri=github.com/argoproj-labs/gitops-promoter)
 
 # GitOps Promoter
 
diff --git a/api/v1alpha1/commitstatus_types.go b/api/v1alpha1/commitstatus_types.go
@@ -72,12 +72,12 @@ type CommitStatusStatus struct {
 	// Important: Run "make" to regenerate code after modifying this file
 
 	// Id is the unique identifier of the commit status, set by the SCM
-	Id string `json:"id"`
+	Id string `json:"id,omitempty"`
 	// Sha is the commit SHA that the status is set on.
 	// Supports both SHA-1 (40 chars) and SHA-256 (64 chars) Git hash formats.
 	// +kubebuilder:validation:MaxLength=64
 	// +kubebuilder:validation:Pattern=`^([a-f0-9]{40}|[a-f0-9]{64})$`
-	Sha string `json:"sha"`
+	Sha string `json:"sha,omitempty"`
 	// Phase is the state of the commit status. This will be mapped to the appropriate equivalent in the SCM.
 	// +kubebuilder:default:=pending
 	// +kubebuilder:validation:Enum:=pending;success;failure;""
diff --git a/cmd/demo/config/argocd-extension.yaml b/cmd/demo/config/argocd-extension.yaml
@@ -13,9 +13,9 @@ spec:
             - name: EXTENSION_NAME
               value: gitops-promoter
             - name: EXTENSION_URL
-              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.1/gitops-promoter-argocd-extension.tar.gz
+              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.2/gitops-promoter-argocd-extension.tar.gz
             - name: EXTENSION_CHECKSUM_URL
-              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.1/gitops-promoter_0.22.1_checksums.txt
+              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.2/gitops-promoter_0.22.2_checksums.txt
           volumeMounts:
             - name: extensions
               mountPath: /tmp/extensions/
diff --git a/cmd/demo/config/promoter_version b/cmd/demo/config/promoter_version
@@ -1 +1 @@
-v0.22.1
+v0.22.2
diff --git a/config/crd/bases/promoter.argoproj.io_commitstatuses.yaml b/config/crd/bases/promoter.argoproj.io_commitstatuses.yaml
diff --git a/dist/install.yaml b/dist/install.yaml
diff --git a/docs/argocd-integrations.md b/docs/argocd-integrations.md
@@ -25,9 +25,9 @@ spec:
             - name: EXTENSION_NAME
               value: gitops-promoter
             - name: EXTENSION_URL
-              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.1/gitops-promoter-argocd-extension.tar.gz
+              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.2/gitops-promoter-argocd-extension.tar.gz
             - name: EXTENSION_CHECKSUM_URL
-              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.1/gitops-promoter_0.22.1_checksums.txt
+              value: https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.2/gitops-promoter_0.22.2_checksums.txt
           volumeMounts:
             - name: extensions
               mountPath: /tmp/extensions/
diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -15,7 +15,7 @@ GitHub, GitHub Enterprise, GitLab, Forgejo (including Codeberg), Gitea, Bitbucke
 To install GitOps Promoter, you can use the following command:
 
 ```bash
-kubectl apply -f https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.1/install.yaml
+kubectl apply -f https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.2/install.yaml
 ```
 
 ## GitHub App Configuration
diff --git a/docs/tutorial-argocd-apps.md b/docs/tutorial-argocd-apps.md
@@ -66,7 +66,7 @@ Connect with this password for the `admin` user.
 > See [Getting Started](./getting-started.md)
 
 ```bash
-kubectl apply -f https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.1/install.yaml
+kubectl apply -f https://github.com/argoproj-labs/gitops-promoter/releases/download/v0.22.2/install.yaml
 ```
 
 > [!NOTE]
diff --git a/go.mod b/go.mod
@@ -17,7 +17,7 @@ require (
 	github.com/go-task/slim-sprig/v3 v3.0.0
 	github.com/goccy/go-yaml v1.19.2
 	github.com/google/go-github/v71 v71.0.0
-	github.com/ktrysmt/go-bitbucket v0.9.88
+	github.com/ktrysmt/go-bitbucket v0.9.89
 	github.com/microsoft/azure-devops-go-api/azuredevops/v7 v7.1.0
 	github.com/onsi/ginkgo/v2 v2.28.1
 	github.com/onsi/gomega v1.39.1
@@ -28,9 +28,9 @@ require (
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	github.com/tidwall/gjson v1.18.0
-	gitlab.com/gitlab-org/api/client-go v1.27.0
+	gitlab.com/gitlab-org/api/client-go v1.28.1
 	go.uber.org/zap v1.27.1
-	golang.org/x/oauth2 v0.34.0
+	golang.org/x/oauth2 v0.35.0
 	golang.org/x/sync v0.19.0
 	golang.org/x/time v0.14.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -41,7 +41,7 @@ require (
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 	sigs.k8s.io/controller-runtime v0.23.1
 	sigs.k8s.io/multicluster-runtime v0.23.1
-	sigs.k8s.io/structured-merge-diff/v6 v6.3.2-0.20260122202528-d9cc6641c482
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2
 )
 
 require (
diff --git a/go.sum b/go.sum
diff --git a/hack/bump-docs-manifests.sh b/hack/bump-docs-manifests.sh
@@ -29,5 +29,6 @@ echo "Bumped manifest versions to v$NEW_VERSION in docs."
 sed_replace "s/.*/v$NEW_VERSION/" cmd/demo/config/promoter_version
 sed_replace "s/download\/v[0-9]\{1,\}\.[0-9]\{1,\}\.[0-9]\{1,\}/download\/v$NEW_VERSION/g" cmd/demo/config/argocd-extension.yaml
 sed_replace "s/gitops-promoter_[0-9]\{1,\}\.[0-9]\{1,\}\.[0-9]\{1,\}_checksums\.txt/gitops-promoter_${NEW_VERSION}_checksums.txt/g" cmd/demo/config/argocd-extension.yaml
+sed_replace "s|gitops-promoter/releases/download/v[0-9]\{1,\}\.[0-9]\{1,\}\.[0-9]\{1,\}/install.yaml|gitops-promoter/releases/download/v$NEW_VERSION/install.yaml|g" cmd/demo/config/config.yaml
 echo "Bumped manifest versions to v$NEW_VERSION in demo."
 
diff --git a/ui/extension/package-lock.json b/ui/extension/package-lock.json
diff --git a/ui/extension/package.json b/ui/extension/package.json
