openshift-pipelines
diff --git a/‎head‎
Lines changed: 1 addition & 1 deletion b/‎head‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎upstream/.github/dependabot.yml‎
Lines changed: 14 additions & 0 deletions b/‎upstream/.github/dependabot.yml‎
Lines changed: 14 additions & 0 deletions
diff --git a/‎upstream/.github/workflows/codeql.yml‎
Lines changed: 4 additions & 4 deletions b/‎upstream/.github/workflows/codeql.yml‎
Lines changed: 4 additions & 4 deletions
diff --git a/‎upstream/.github/workflows/go-coverage.yml‎
Lines changed: 65 additions & 0 deletions b/‎upstream/.github/workflows/go-coverage.yml‎
Lines changed: 65 additions & 0 deletions
diff --git a/‎upstream/.github/workflows/goclean.yml‎
Lines changed: 3 additions & 3 deletions b/‎upstream/.github/workflows/goclean.yml‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎upstream/.github/workflows/kind-e2e.yaml‎
Lines changed: 15 additions & 11 deletions b/‎upstream/.github/workflows/kind-e2e.yaml‎
Lines changed: 15 additions & 11 deletions
diff --git a/‎upstream/.github/workflows/lint.yaml‎
Lines changed: 9 additions & 5 deletions b/‎upstream/.github/workflows/lint.yaml‎
Lines changed: 9 additions & 5 deletions
diff --git a/‎upstream/.github/workflows/reusable-e2e.yaml‎
Lines changed: 16 additions & 36 deletions b/‎upstream/.github/workflows/reusable-e2e.yaml‎
Lines changed: 16 additions & 36 deletions
@@ -1 +1 @@
-ebcd9c27f283826457714329def9e451bcc6c067
+0c9284f740d672930274efbe75033df55dc78515
@@ -10,3 +10,17 @@ updates:
       all:
         patterns:
           - "*"
+    labels:
+    - "ok-to-test"
+    - "dependencies"
+    - "release-note-none"
+    - "kind/misc"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+    - "ok-to-test"
+    - "dependencies"
+    - "release-note-none"
+    - "kind/misc"
@@ -40,11 +40,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@a8d1ac45b9a34d11fe398d5503176af0d06b303e # v3.30.7
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, Go, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@a8d1ac45b9a34d11fe398d5503176af0d06b303e # v3.30.7
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -71,6 +71,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@a8d1ac45b9a34d11fe398d5503176af0d06b303e # v3.30.7
       with:
         category: "/language:${{matrix.language}}"
@@ -0,0 +1,65 @@
+name: Go coverage
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+  # run at least once every 2 months to prevent the coverage artifact from expiring
+  schedule:
+    - cron: '14 3 1 */2 *'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  go-coverage:
+    name: Go coverage
+    runs-on: ubuntu-24.04
+    permissions:
+      pull-requests: write
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: ${{ github.workspace }}/src/github.com/tektoncd/chains
+
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5  # v5.5.0
+        with:
+          go-version-file: "${{ github.workspace }}/src/github.com/tektoncd/chains/go.mod"
+
+      - name: Generate coverage
+        working-directory: ${{ github.workspace }}/src/github.com/tektoncd/chains
+        run: |
+          go test -cover -coverprofile=coverage.txt ./... || true
+          echo "Generated coverage profile"
+
+      - name: Archive coverage results
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: code-coverage
+          path: ${{ github.workspace }}/src/github.com/tektoncd/chains/coverage.txt
+
+      - name: Comment on PR
+        if: github.event_name == 'pull_request'
+        uses: fgrosse/go-coverage-report@8c1d1a09864211d258937b1b1a5b849f7e4f2682 # v1.2.0
+        continue-on-error: true # This may fail if artifact on main branch does not exist (first run or expired)
+        with:
+          coverage-artifact-name: "code-coverage"
+          coverage-file-name: "coverage.txt"
@@ -24,12 +24,12 @@ jobs:
   goclean:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3 # check-out repository
+    - uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
 
     - name: Setup Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
-        go-version: '1.20.0'
+        go-version: '1.22'
 
     - name: go vet
       run: |
 
@@ -6,6 +6,10 @@ on:
       - main
       - release-*
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 defaults:
   run:
     shell: bash
@@ -17,26 +21,26 @@ jobs:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         # Keep in sync with the list of supported releases: https://kubernetes.io/releases/
+        # Add latest k8s-version once it is added in https://github.com/sigstore/scaffolding/releases
         k8s-version:
-        - v1.25.x
-        - v1.26.x
-        - v1.27.x
-        # Needs https://github.com/sigstore/scaffolding/pull/756
-        # - v1.28.x
+          - v1.31.x
+          - v1.32.x
+          - v1.33.x
     uses: ./.github/workflows/reusable-e2e.yaml
     with:
       k8s-version: ${{ matrix.k8s-version }}
-      pipelines-release: v0.50.1
+      pipelines-release: v1.2.0 # Latest version
   pipelines-lts:
     strategy:
       fail-fast: false # Keep running if one leg fails.
       matrix:
         pipelines-release:
-        - v0.44.4  # LTS
-        - v0.47.3  # LTS
-        - v0.50.1  # LTS
-        - v0.51.0
+          # This should follow the list of versions from https://github.com/tektoncd/pipeline/blob/main/releases.md#release
+          - v0.62.9  # LTS
+          - v0.65.7  # LTS
+          - v0.68.1  # LTS
+          - v1.0.0   # LTS
     uses: ./.github/workflows/reusable-e2e.yaml
     with:
-      k8s-version: v1.26.x
+      k8s-version: v1.30.x  # intersection of the latest version and scaffolding
       pipelines-release: ${{ matrix.pipelines-release }}
@@ -14,17 +14,22 @@ permissions:
   pull-requests: read
 jobs:
   golangci:
+    # Because this repository uses vendored dependencies, and grouping for dependabot updates, the
+    # PRs created by dependabot are huge. This causes issues for the linter:
+    #   https://github.com/golangci/golangci-lint-action/issues/996
+    # The chances of dependabot creating new linting issues are minimal.
+    if: github.actor != 'dependabot[bot]'
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v4
+      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
-          go-version: "1.20"
+          go-version: "1.23"
 
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest
@@ -33,7 +38,6 @@ jobs:
           # working-directory: somedir
 
           # Optional: golangci-lint command line arguments.
-          args: --timeout 10m0s
 
           # Optional: show only new issues if it's a pull request. The default value is `false`.
           only-new-issues: true
 
@@ -19,57 +19,37 @@ defaults:
 jobs:
   e2e-test:
     name: e2e test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     env:
       GOPATH: ${{ github.workspace }}
       GO111MODULE: on
       GOFLAGS: -ldflags=-s -ldflags=-w
       KO_DOCKER_REPO: registry.local:5000/knative
       KOCACHE: ~/ko
-      SIGSTORE_SCAFFOLDING_RELEASE_VERSION: "v0.6.6"
+      SIGSTORE_SCAFFOLDING_RELEASE_VERSION: "v0.7.24"
       TEKTON_PIPELINES_RELEASE: "https://storage.googleapis.com/tekton-releases/pipeline/previous/${{ inputs.pipelines-release }}/release.yaml"
       # Note that we do not include the v prefix here so we can use it in all
       # the places this is used.
-      TEKTON_CLI_RELEASE: "0.30.0"
+      SKIP_INITIALIZE: true
 
     steps:
-    # https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
-    - uses: actions/cache@v2
-      with:
-        # In order:
-        # * Module download cache
-        # * Build cache (Linux)
-        path: |
-          ~/go/pkg/mod
-          ~/.cache/go-build
-          ${{ env.KOCACHE }}
-        key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          ${{ runner.os }}-go-
-
     - name: Set up Go
-      uses: actions/setup-go@v2
+      uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
       with:
-        go-version: 1.20.x
+        go-version: 1.22.x
 
-    - uses: imjasonh/setup-ko@v0.6
+    - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d # v0.9
       with:
         version: tip
 
-    - name: Install tkn cli
-      run: |
-        curl -Lo ./tkn_${{ env.TEKTON_CLI_RELEASE }}_Linux_x86_64.tar.gz https://github.com/tektoncd/cli/releases/download/v${{ env.TEKTON_CLI_RELEASE }}/tkn_${{ env.TEKTON_CLI_RELEASE }}_Linux_x86_64.tar.gz
-        tar xvzf ./tkn_${{ env.TEKTON_CLI_RELEASE }}_Linux_x86_64.tar.gz tkn
-        chmod u+x ./tkn
-
     - name: Check out our repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@6d193bf28034eafb982f37bd894289fe649468fc # v4.1.7
       with:
         path: ./src/github.com/tektoncd/chains
 
     - name: Install mirror, kind, knative + sigstore
-      uses: sigstore/scaffolding/actions/setup@main
+      uses: sigstore/scaffolding/actions/setup@d40cf576f588d980142f0b8462c425d7b32f00b1 # v0.7.25
       with:
         k8s-version: ${{ inputs.k8s-version }}
         version: ${{ env.SIGSTORE_SCAFFOLDING_RELEASE_VERSION }}
@@ -86,12 +66,14 @@ jobs:
         # Restart so picks up the changes.
         kubectl -n tekton-pipelines delete po -l app=tekton-pipelines-controller
 
-    - name: Install all the everythings
+    - name: Run integration tests
       working-directory: ./src/github.com/tektoncd/chains
-      timeout-minutes: 10
       run: |
-        ko apply -BRf ./config/
+        ./test/presubmit-tests.sh --integration-tests
+
 
+    - name: Run tutorial taskrun
+      run: |
         kubectl patch configmap/chains-config \
         --namespace tekton-chains \
         --type merge \
@@ -102,10 +84,8 @@ jobs:
 
         # TODO(vaikas): Better way to find when the chains has picked up
         # the changes
-        sleep 10
+        sleep 20
 
-    - name: Run tutorial taskrun
-      run: |
         kubectl create -f https://raw.githubusercontent.com/tektoncd/chains/main/examples/taskruns/task-output-image.yaml
 
         # Sleep so the taskrun shows up.
@@ -117,7 +97,7 @@ jobs:
         echo "Waiting for Chains to do it's thing"
         for i in {1..10}
         do
-          ./tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/transparency}" > tektonentry
+          tkn tr describe --last -o jsonpath="{.metadata.annotations.chains\.tekton\.dev/transparency}" > tektonentry
 
           if [ -s ./tektonentry ]; then
             if grep --quiet rekor.rekor-system.svc ./tektonentry ; then
@@ -140,7 +120,7 @@ jobs:
 
     - name: Collect diagnostics
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main
+      uses: chainguard-dev/actions/kind-diag@5363dd9eb48083bbf7674a4bbe62d71c3b230edd # v1.1.2
       with:
         cluster-resources: nodes
         namespace-resources: pods,taskruns,jobs
Original file line number	Diff line number	Diff line change
`@@ -1 +1 @@`
`1`		`-ebcd9c27f283826457714329def9e451bcc6c067`
	`1`	`+0c9284f740d672930274efbe75033df55dc78515`