Merge branch 'master' into SANDBOX-1561-debug-sandbox-resources

rsoaresd · web-flow · commit 7952b4c2e8f6 · 2026-01-05T11:10:48.000Z
diff --git a/.github/workflows/ci-check-gomod.yml b/.github/workflows/ci-check-gomod.yml
@@ -12,6 +12,6 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     - name: check
       uses: codeready-toolchain/toolchain-cicd/gomod-check@master
diff --git a/.github/workflows/ci-golang-sbom.yml b/.github/workflows/ci-golang-sbom.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Install Go
       uses: actions/setup-go@v6
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
     
     - name: Generate SBOM
       uses: CycloneDX/gh-gomod-generate-sbom@v2
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
@@ -11,11 +11,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Run govulncheck
       uses: codeready-toolchain/toolchain-cicd/govulncheck-action@master
       with:
-        go-version-file: go.mod
-        cache: false
-        config: .govulncheck.yaml
+        config: .govulncheck.yaml 
+        debug: true # optional (default = false)
diff --git a/.github/workflows/operator-cd.yml b/.github/workflows/operator-cd.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         fetch-depth: 0
 
@@ -26,7 +26,7 @@ jobs:
         go-version-file: go.mod
 
     - name: Cache dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ hashFiles ('**/go.sum') }}
diff --git a/.github/workflows/publish-components-for-e2e-tests.yml b/.github/workflows/publish-components-for-e2e-tests.yml
@@ -1,4 +1,4 @@
-name: publish-operators-for-e2e-tests
+name: publish-components-for-e2e-tests
 on:
   issue_comment:
     types: [created]
@@ -10,36 +10,41 @@ env:
 
 jobs:
   binary:
-    name: Build & push operator bundles for e2e tests
+    name: Build & push operator bundles & dashboard image for e2e tests
 
     runs-on: ubuntu-24.04
-    if: ${{ github.event.comment == '' || contains(github.event.comment.body, '/retest') || contains(github.event.comment.body, '/test all') || contains(github.event.comment.body, '/test e2e') }}
+    if: >-
+      ${{ github.event_name == 'pull_request_target' ||
+          (github.event_name == 'issue_comment' &&
+            (contains(github.event.comment.body, '/retest') ||
+             contains(github.event.comment.body, '/test all') ||
+             contains(github.event.comment.body, '/test e2e'))) }}
     steps:
-    # Checkout from PR event - in that case the comment field is empty
+    # Checkout from PR event
     - name: Checkout code from PR event
-      uses: actions/checkout@v5
-      if: ${{ github.event.comment == '' }}
+      uses: actions/checkout@v6
+      if: ${{ github.event_name == 'pull_request_target' }}
       with:
         ref: ${{github.event.pull_request.head.ref}}
         repository: ${{github.event.pull_request.head.repo.full_name}}
         fetch-depth: 0
 
     # If the workflow was triggered based on comment, then we need to get the information about the PR
-    # Is executed only for comment events - in that case the pull_request field is empty
+    # Is executed only for comment events
     - name: Send Github API Request to get PR data
       id: request
       uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # workaround for https://github.com/octokit/request-action/issues/315 - use SHA instead of the tag v2.4.0
-      if: ${{ github.event.pull_request == '' }}
+      if: ${{ github.event_name == 'issue_comment' }}
       with:
         route: ${{ github.event.issue.pull_request.url }}
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     # Checkout the code based on the data retrieved from the previous step
-    # Is executed only for comment events - in that case the pull_request field is empty
+    # Is executed only for comment events
     - name: Checkout code from PR
-      uses: actions/checkout@v5
-      if: ${{ github.event.pull_request == '' }}
+      uses: actions/checkout@v6
+      if: ${{ github.event_name == 'issue_comment' }}
       with:
         repository: ${{ fromJson(steps.request.outputs.data).head.repo.full_name }}
         ref: ${{ fromJson(steps.request.outputs.data).head.ref }}
@@ -51,25 +56,21 @@ jobs:
         go-version-file: go.mod
 
     - name: Cache dependencies
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ~/go/pkg/mod
         key: ${{ runner.os }}-go-${{ hashFiles ('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-
 
-    - uses: actions/setup-python@v6
-      with:
-        python-version: '3.x'
-
     - name: Prepare tools
       uses: codeready-toolchain/toolchain-cicd/prepare-tools-action@master
 
     # Execute composite action using values from PR event
-    # Is executed only for PR events - in that case the comment field is empty
-    - name: Publish current operator bundles for host & member based on PR event
+    # Developer Sandbox Dashboard will be published too in this action
+    - name: Publish current operator bundles & dashboard image based on PR event
       uses: codeready-toolchain/toolchain-cicd/publish-operators-for-e2e-tests@master
-      if: ${{ github.event.comment == '' }}
+      if: ${{ github.event_name == 'pull_request_target' }}
       with:
         quay-token: ${{ secrets.TEST_QUAY_TOKEN }}
         quay-namespace: codeready-toolchain-test
@@ -79,10 +80,10 @@ jobs:
         gh-head-ref: ${{ github.event.pull_request.head.ref }}
 
     # Execute composite action using values from PR event
-    # Is executed only for comment events - in that case the pull_request field is empty
-    - name: Publish current operator bundles for host & member based on comment event
+    # Developer Sandbox Dashboard will be published too in this action
+    - name: Publish current operator bundles & dashboard image based on comment event
       uses: codeready-toolchain/toolchain-cicd/publish-operators-for-e2e-tests@master
-      if: ${{ github.event.pull_request == '' }}
+      if: ${{ github.event_name == 'issue_comment' }}
       with:
         quay-token: ${{ secrets.TEST_QUAY_TOKEN }}
         quay-namespace: codeready-toolchain-test
diff --git a/.github/workflows/test-with-coverage.yml b/.github/workflows/test-with-coverage.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
       with:
         ref: ${{github.event.pull_request.head.ref}}
         repository: ${{github.event.pull_request.head.repo.full_name}}
diff --git a/.govulncheck.yaml b/.govulncheck.yaml
@@ -4,46 +4,58 @@ ignored-vulnerabilities:
   # Fixed in: crypto/x509@go1.24.8
   - id: GO-2025-4013
     info: https://pkg.go.dev/vuln/GO-2025-4013
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # Lack of limit when parsing cookies can cause memory exhaustion in net/http
   # Found in: net/http@go1.23.12
   # Fixed in: net/http@go1.24.8
   - id: GO-2025-4012
     info: https://pkg.go.dev/vuln/GO-2025-4012
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # Parsing DER payload can cause memory exhaustion in encoding/asn1
   # Found in: encoding/asn1@go1.23.12
   # Fixed in: encoding/asn1@go1.24.8
   - id: GO-2025-4011
     info: https://pkg.go.dev/vuln/GO-2025-4011
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # Insufficient validation of bracketed IPv6 hostnames in net/url
   # Found in: net/url@go1.23.12
   # Fixed in: net/url@go1.24.8
   - id: GO-2025-4010
     info: https://pkg.go.dev/vuln/GO-2025-4010
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # Quadratic complexity when parsing some invalid inputs in encoding/pem
   # Found in: encoding/pem@go1.23.12
   # Fixed in: encoding/pem@go1.24.8
   - id: GO-2025-4009
     info: https://pkg.go.dev/vuln/GO-2025-4009
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # ALPN negotiation error contains attacker controlled information in crypto/tls
   # Found in: crypto/tls@go1.23.12
   # Fixed in: crypto/tls@go1.24.8
   - id: GO-2025-4008
     info: https://pkg.go.dev/vuln/GO-2025-4008
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # Quadratic complexity when checking name constraints in crypto/x509
   # Found in: crypto/x509@go1.23.12
   # Fixed in: crypto/x509@go1.24.9
   - id: GO-2025-4007
     info: https://pkg.go.dev/vuln/GO-2025-4007
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
   # Excessive CPU consumption in ParseAddress in net/mail
   # Found in: net/mail@go1.23.12
   # Fixed in: net/mail@go1.24.8
   - id: GO-2025-4006
     info: https://pkg.go.dev/vuln/GO-2025-4006
-    silence-until: 2025-12-03
+    silence-until: 2026-01-09
+  # Excessive resource consumption when printing error string for host certificate validation in crypto/x509
+  # Found in: crypto/x509@go1.23.12
+  # Fixed in: crypto/x509@go1.24.11
+  - id: GO-2025-4155
+    info: https://pkg.go.dev/vuln/GO-2025-4155
+    silence-until: 2026-01-09
+  # Improper application of excluded DNS name constraints when verifying wildcard names in crypto/x509
+  # Found in: crypto/x509@go1.23.12
+  # Fixed in: crypto/x509@go1.24.11
+  - id: GO-2025-4175
+    info: https://pkg.go.dev/vuln/GO-2025-4175
+    silence-until: 2026-01-09
diff --git a/cmd/main.go b/cmd/main.go
@@ -7,6 +7,7 @@ import (
 	goruntime "runtime"
 	"time"
 
+	"github.com/codeready-toolchain/member-operator/pkg/constants"
 	"github.com/codeready-toolchain/member-operator/pkg/host"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 
@@ -224,9 +225,10 @@ func main() {
 
 	// Setup all Controllers
 	if err = (&toolchainclusterresources.Reconciler{
-		Client:    mgr.GetClient(),
-		Scheme:    mgr.GetScheme(),
-		Templates: &deploy.ToolchainClusterTemplateFS,
+		Client:       mgr.GetClient(),
+		Scheme:       mgr.GetScheme(),
+		Templates:    &deploy.ToolchainClusterTemplateFS,
+		FieldManager: constants.MemberOperatorFieldManager,
 	}).SetupWithManager(mgr, namespace); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "ToolchainClusterResources")
 		os.Exit(1)
diff --git a/go.mod b/go.mod
@@ -2,7 +2,7 @@ module github.com/codeready-toolchain/member-operator
 
 require (
 	github.com/codeready-toolchain/api v0.0.0-20251008084914-06282b83d4cd
-	github.com/codeready-toolchain/toolchain-common v0.0.0-20251103123811-4066619e5740
+	github.com/codeready-toolchain/toolchain-common v0.0.0-20251125180949-6ed5aeed75e4
 	github.com/go-logr/logr v1.4.2
 	github.com/google/go-cmp v0.7.0
 	// using latest commit from 'github.com/openshift/api branch release-4.19'
diff --git a/go.sum b/go.sum
@@ -24,6 +24,8 @@ github.com/codeready-toolchain/api v0.0.0-20251008084914-06282b83d4cd h1:A6WOUwl
 github.com/codeready-toolchain/api v0.0.0-20251008084914-06282b83d4cd/go.mod h1:TiQ/yNv3cGL4nxo3fgRtcHyYYuRf+nAgs6B1IAqvxOU=
 github.com/codeready-toolchain/toolchain-common v0.0.0-20251103123811-4066619e5740 h1:cGl01Gakj69am0LopGJjWGpzcCngRqhcaFon/e90hMA=
 github.com/codeready-toolchain/toolchain-common v0.0.0-20251103123811-4066619e5740/go.mod h1:5i7k9O0yVftzJwsjSjJjoXMYtUPkiirVsEswuaC8/5I=
+github.com/codeready-toolchain/toolchain-common v0.0.0-20251125180949-6ed5aeed75e4 h1:OZd7C6PZMc3BL5CD2NAHxWc1VKtuSjRUJtvEuFBVDEE=
+github.com/codeready-toolchain/toolchain-common v0.0.0-20251125180949-6ed5aeed75e4/go.mod h1:5i7k9O0yVftzJwsjSjJjoXMYtUPkiirVsEswuaC8/5I=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
diff --git a/make/test.mk b/make/test.mk
@@ -78,7 +78,7 @@ test-e2e-local:
 .PHONY: publish-current-bundles-for-e2e
 publish-current-bundles-for-e2e: get-e2e-repo
 	# build & publish the bundles via toolchain-e2e repo
-	$(MAKE) -C ${E2E_REPO_PATH} get-and-publish-operators MEMBER_REPO_PATH=${PWD}
+	$(MAKE) -C ${E2E_REPO_PATH} publish-current-bundles-for-e2e MEMBER_REPO_PATH=${PWD}
 
 .PHONY: test-e2e
 test-e2e: get-e2e-repo
