Skip to content

Commit ae14ab1

Browse files
cert-manager-prow[bot]cert-manager-prow[bot]
authored
Merge pull request #1754 from cert-manager/self-upgrade-master
[CI] Merge self-upgrade-master into master
2 parents 108d786 + 573eabe commit ae14ab1

File tree

15 files changed

+275
-141
lines changed

15 files changed

+275
-141
lines changed

‎.github/chainguard/make-self-upgrade.sts.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
2+
# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead.
3+
4+
issuer: https://token.actions.githubusercontent.com
5+
subject_pattern: ^repo:cert-manager/website:ref:refs/heads/(main|master)$
6+
7+
permissions:
8+
contents: write
9+
pull_requests: write
10+
workflows: write

‎.github/chainguard/renovate.sts.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT.
2+
# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/renovate.sts.yaml instead.
3+
4+
issuer: https://token.actions.githubusercontent.com
5+
subject_pattern: ^repo:cert-manager/website:ref:refs/heads/(main|master)$
6+
7+
permissions:
8+
administration: read
9+
contents: write
10+
issues: write
11+
pull_requests: write
12+
security_events: read
13+
statuses: write
14+
workflows: write

‎.github/dependabot.yaml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎.github/renovate.json5‎

Lines changed: 70 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,14 @@
44
{
55
$schema: 'https://docs.renovatebot.com/renovate-schema.json',
66
enabled: true,
7-
gitAuthor: 'cert-manager-bot <[email protected]>',
7+
gitAuthor: 'Renovate Bot <[email protected]>',
8+
gitIgnoredAuthors: [
9+
'Renovate Bot <[email protected]>',
10+
'cert-manager-bot <[email protected]>',
11+
],
12+
recreateWhen: 'always', // TODO: Remove; temporary fix to force Renovate to ignore "foreign" commits
813
enabledManagers: [
14+
'github-actions',
915
'gomod',
1016
],
1117
extends: [
@@ -23,20 +29,33 @@
2329
'ok-to-test',
2430
'release-note-none',
2531
],
26-
postUpgradeTasks: {
27-
commands: [
28-
'make generate',
29-
],
30-
executionMode: 'branch',
31-
},
32+
// packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**.
3233
packageRules: [
34+
{
35+
groupName: 'Misc GitHub actions',
36+
matchManagers: [
37+
'github-actions',
38+
],
39+
},
40+
{
41+
matchManagers: [
42+
'gomod',
43+
],
44+
postUpgradeTasks: {
45+
commands: [
46+
'make vendor-go generate',
47+
],
48+
executionMode: 'branch',
49+
}
50+
},
3351
{
3452
groupName: 'Misc Go deps',
3553
matchManagers: [
3654
'gomod',
3755
],
38-
matchPackageNames: [
39-
'*',
56+
matchUpdateTypes: [
57+
'minor',
58+
'patch',
4059
],
4160
},
4261
{
@@ -45,43 +64,55 @@
4564
'gomod',
4665
],
4766
matchPackageNames: [
48-
'github.com/onsi/ginkgo**/**',
49-
'github.com/onsi/gomega**/**',
50-
'github.com/stretchr/testify**/**',
67+
'github.com/onsi/ginkgo/**',
68+
'github.com/onsi/gomega',
69+
'github.com/stretchr/testify',
5170
],
71+
matchUpdateTypes: [
72+
'minor',
73+
'patch',
74+
]
5275
},
5376
{
5477
groupName: 'Cloud Go deps',
5578
matchManagers: [
5679
'gomod',
5780
],
5881
matchPackageNames: [
59-
'github.com/akamai**/**',
60-
'github.com/aws**/**',
61-
'github.com/Azure**/**',
62-
'github.com/AzureAD**/**',
63-
'github.com/cloudflare**/**',
64-
'github.com/digitalocean**/**',
82+
'github.com/akamai/**',
83+
'github.com/aws/**',
84+
'github.com/Azure/**',
85+
'github.com/AzureAD/**',
86+
'github.com/cloudflare/**',
87+
'github.com/digitalocean/**',
6588
'google.golang.org/api',
6689
],
90+
matchUpdateTypes: [
91+
'minor',
92+
'patch',
93+
]
6794
},
6895
{
6996
groupName: 'Kubernetes Go deps',
7097
matchManagers: [
7198
'gomod',
7299
],
73100
matchPackageNames: [
74-
'sigs.k8s.io**/**',
75-
'k8s.io**/**',
101+
'sigs.k8s.io/**',
102+
'k8s.io/**',
76103
],
104+
matchUpdateTypes: [
105+
'minor',
106+
'patch',
107+
]
77108
},
78109
{
79110
groupName: 'Kubernetes Go patches',
80111
matchManagers: [
81112
'gomod',
82113
],
83114
matchPackageNames: [
84-
'k8s.io**/**',
115+
'k8s.io/**',
85116
],
86117
matchUpdateTypes: [
87118
'patch',
@@ -96,25 +127,40 @@
96127
'gomod',
97128
],
98129
matchPackageNames: [
99-
'golang.org/x**/*',
130+
'golang.org/x/**',
100131
],
101132
addLabels: [
102133
'skip-review', // Adding label to allow PRs to automerge
103134
],
104135
},
105136
{
106-
description: 'Disable Go pseudo-version updates',
137+
matchManagers: [
138+
'gomod',
139+
],
140+
matchUpdateTypes: [
141+
'major',
142+
'digest',
143+
],
144+
dependencyDashboardApproval: true
145+
},
146+
{
147+
description: 'Disable (internal) cert-manager pseudo-version updates',
107148
matchManagers: [
108149
'gomod',
109150
],
110151
matchPackageNames: [
111-
'*',
152+
'github.com/cert-manager/**',
112153
],
113154
matchCurrentValue: 'v0.0.0*',
114155
enabled: false,
115156
},
116157
],
117158
ignorePaths: [
118159
'**/vendor/**',
160+
// Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules.
161+
'make/_shared/**',
162+
'.github/workflows/govulncheck.yaml',
163+
'.github/workflows/make-self-upgrade.yaml',
164+
'.github/workflows/renovate.yaml',
119165
],
120166
}

‎.github/workflows/make-self-upgrade.yaml‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,7 @@ jobs:
1818
if: github.repository == 'cert-manager/website'
1919

2020
permissions:
21-
contents: write
22-
pull-requests: write
21+
id-token: write
2322

2423
env:
2524
SOURCE_BRANCH: "${{ github.ref_name }}"
@@ -32,11 +31,20 @@ jobs:
3231
echo "This workflow should not be run on a non-branch-head."
3332
exit 1
3433
34+
- name: Octo STS Token Exchange
35+
uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main
36+
id: octo-sts
37+
with:
38+
scope: 'cert-manager/website'
39+
identity: make-self-upgrade
40+
3541
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3642
# Adding `fetch-depth: 0` makes sure tags are also fetched. We need
3743
# the tags so `git describe` returns a valid version.
3844
# see https://github.com/actions/checkout/issues/701 for extra info about this option
39-
with: { fetch-depth: 0 }
45+
with:
46+
fetch-depth: 0
47+
token: ${{ steps.octo-sts.outputs.token }}
4048

4149
- id: go-version
4250
run: |
@@ -75,6 +83,7 @@ jobs:
7583
- if: ${{ steps.is-up-to-date.outputs.result != 'true' }}
7684
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
7785
with:
86+
github-token: ${{ steps.octo-sts.outputs.token }}
7887
script: |
7988
const { repo, owner } = context.repo;
8089
const pulls = await github.rest.pulls.list({

‎.github/workflows/renovate.yaml‎

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,7 @@ jobs:
1717
if: github.repository == 'cert-manager/website'
1818

1919
permissions:
20-
contents: write
21-
issues: write
22-
statuses: write
23-
pull-requests: write
20+
id-token: write
2421

2522
steps:
2623
- name: Fail if branch is not head of branch.
@@ -29,11 +26,20 @@ jobs:
2926
echo "This workflow should not be run on a non-branch-head."
3027
exit 1
3128
29+
- name: Octo STS Token Exchange
30+
uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # main
31+
id: octo-sts
32+
with:
33+
scope: 'cert-manager/website'
34+
identity: renovate
35+
3236
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
3337
# Adding `fetch-depth: 0` makes sure tags are also fetched. We need
3438
# the tags so `git describe` returns a valid version.
3539
# see https://github.com/actions/checkout/issues/701 for extra info about this option
36-
with: { fetch-depth: 0 }
40+
with:
41+
fetch-depth: 0
42+
token: ${{ steps.octo-sts.outputs.token }}
3743

3844
- id: go-version
3945
run: |
@@ -47,7 +53,7 @@ jobs:
4753
uses: renovatebot/github-action@a447f09147d00e00ae2a82ad5ef51ca89352da80 # v43.0.9
4854
with:
4955
configurationFile: .github/renovate.json5
50-
token: ${{ secrets.GITHUB_TOKEN }}
56+
token: ${{ steps.octo-sts.outputs.token }}
5157
env:
5258
RENOVATE_REPOSITORIES: '["${{ github.repository }}"]'
5359
RENOVATE_ONBOARDING: "false"

‎klone.yaml‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,30 +10,30 @@ targets:
1010
- folder_name: boilerplate
1111
repo_url: https://github.com/cert-manager/makefile-modules.git
1212
repo_ref: main
13-
repo_hash: c4f8a8a4d10d0efc9d775d4b1e719d779bf46880
13+
repo_hash: 217b9616a01c901044098e5ae0c285ae3b1223ac
1414
repo_path: modules/boilerplate
1515
- folder_name: generate-verify
1616
repo_url: https://github.com/cert-manager/makefile-modules.git
1717
repo_ref: main
18-
repo_hash: c4f8a8a4d10d0efc9d775d4b1e719d779bf46880
18+
repo_hash: 217b9616a01c901044098e5ae0c285ae3b1223ac
1919
repo_path: modules/generate-verify
2020
- folder_name: help
2121
repo_url: https://github.com/cert-manager/makefile-modules.git
2222
repo_ref: main
23-
repo_hash: c4f8a8a4d10d0efc9d775d4b1e719d779bf46880
23+
repo_hash: 217b9616a01c901044098e5ae0c285ae3b1223ac
2424
repo_path: modules/help
2525
- folder_name: klone
2626
repo_url: https://github.com/cert-manager/makefile-modules.git
2727
repo_ref: main
28-
repo_hash: c4f8a8a4d10d0efc9d775d4b1e719d779bf46880
28+
repo_hash: 217b9616a01c901044098e5ae0c285ae3b1223ac
2929
repo_path: modules/klone
3030
- folder_name: repository-base
3131
repo_url: https://github.com/cert-manager/makefile-modules.git
3232
repo_ref: main
33-
repo_hash: c4f8a8a4d10d0efc9d775d4b1e719d779bf46880
33+
repo_hash: 217b9616a01c901044098e5ae0c285ae3b1223ac
3434
repo_path: modules/repository-base
3535
- folder_name: tools
3636
repo_url: https://github.com/cert-manager/makefile-modules.git
3737
repo_ref: main
38-
repo_hash: c4f8a8a4d10d0efc9d775d4b1e719d779bf46880
38+
repo_hash: 217b9616a01c901044098e5ae0c285ae3b1223ac
3939
repo_path: modules/tools

‎make/_shared/repository-base/01_mod.mk‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@ else
3434
## Generate base files in the repository
3535
## @category [shared] Generate/ Verify
3636
generate-base:
37+
# TODO(erikgb): Remove; just a temporary command to clean out Dependabot files
38+
rm -f ./.github/dependabot.yaml
3739
cp -r $(repository_base_dir)/. ./
3840
cd $(repository_base_dir) && \
3941
find . -type f | while read file; do \

‎make/_shared/repository-base/base-dependabot/.github/dependabot.yaml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

0 commit comments

Comments
 (0)