CI fixes

.github/workflows/ci.yml

@@ -34,6 +34,8 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Install Task
         uses: arduino/setup-task@v2
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Install Dagger
         env:
           # renovate: datasource=github-tags depName=dagger/dagger versioning=semver
@@ -51,8 +53,8 @@ jobs:
           github.event_name == 'workflow_dispatch' ||
           github.event.pull_request.head.repo.full_name == github.repository
         env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           task publish
       - name: Attach manifest to workflow run

.github/workflows/release-please.yml

@@ -27,8 +27,8 @@ jobs:
           curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
       - name: Create image and manifest
         env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           task publish
           task manifest

.github/workflows/release-publish.yml

@@ -19,8 +19,8 @@ jobs:
           curl -L https://dl.dagger.io/dagger/install.sh | BIN_DIR=$HOME/.local/bin sh
       - name: Create image and manifest
         env:
-          REGISTRY_USER: ${{ github.actor }}
-          REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
         run: |
           task publish
           task manifest

.golangci.yml

@@ -1,45 +1,26 @@
-linters-settings:
-  lll:
-    line-length: 120
-  gci:
-    sections:
-      - standard
-      - default
-      - prefix(github.com/operasoftware/cnpg-plugin-pgbackrest)
-      - blank
-      - dot
-  gosec:
-    excludes:
-      - G101 # remove this exclude when https://github.com/securego/gosec/issues/1001 is fixed
-
+version: "2"
 linters:
-  # please, do not use `enable-all`: it's deprecated and will be removed soon.
-  # inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
-  disable-all: true
+    # inverted configuration with `default: all` and `disable` is not scalable during updates of golangci-lint
+  default: none
   enable:
     - asciicheck
     - bodyclose
+    - copyloopvar
     - dogsled
     - dupl
     - durationcheck
     - errcheck
-    - copyloopvar
-    - gci
+    - ginkgolinter
     - gocognit
     - goconst
     - gocritic
     - gocyclo
-    - gofmt
-    - gofumpt
     - goheader
-    - goimports
     - gomoddirectives
     - gomodguard
     - goprintffuncname
     - gosec
-    - gosimple
     - govet
-    - ginkgolinter
     - importas
     - ineffassign
     - lll
@@ -53,10 +34,8 @@ linters:
     - rowserrcheck
     - sqlclosecheck
     - staticcheck
-    - stylecheck
     - thelper
     - tparallel
-    - typecheck
     - unconvert
     - unparam
     - unused
@@ -90,45 +69,59 @@ linters:
   # - godox
   # - gomnd
   # - testpackage
-  # - wsl
-
-  # deprecated:
-  # - deadcode
-  # - golint
-  # - interfacer
-  # - maligned
-  # - scopelint
-  # - structcheck
-  # - varcheck
-
-run:
-  timeout: 10m
-
-issues:
-  exclude-rules:
-    # Allow dot imports for ginkgo and gomega
-    - source: ginkgo|gomega
-      linters:
-      - revive
-      text: "should not use dot imports"
-    # Exclude some linters from running on tests files.
-    - path: _test\.go
-      linters:
-        - goconst
-    # Exclude lll issues for lines with long annotations
-    - linters:
-      - lll
-      source: "//\\s*\\+"
-    # We have no control of this in zz_generated files and it looks like that excluding those files is not enough
-    # so we disable "ST1016: methods on the same type should have the same receiver name" in api directory
-    - linters:
-      - stylecheck
-      text: "ST1016:"
-      path: api/
-  exclude-use-default: false
-  exclude-dirs:
-    # This tests are generated by kubebuilder
-    - test
-  exclude-files:
-    - zz_generated.*
-    - internal/operator/controller/suite_test.go
+  # - 
+
+  settings:
+    lll:
+      line-length: 120
+  exclusions:
+    generated: lax
+    rules:
+      # Allow dot imports for ginkgo and gomega
+      - linters:
+          - revive
+        text: should not use dot imports
+        source: ginkgo|gomega
+      # Exclude some linters from running on tests files.
+      - linters:
+          - goconst
+        path: _test\.go
+      # Exclude lll issues for lines with long annotations
+      - linters:
+          - lll
+        source: //\s*\+
+    paths:
+      - zz_generated.*
+      - internal/operator/controller/suite_test.go
+      # Those tests are generated by kubebuilder
+      - test
+      # Added by "golangci-lint migrate", to be removed?
+      - third_party$
+      - builtin$
+      - examples$
+
+formatters:
+  enable:
+    - gci
+    - gofmt
+    - gofumpt
+    - goimports
+  settings:
+    gci:
+      sections:
+        - standard
+        - default
+        - prefix(github.com/operasoftware/cnpg-plugin-pgbackrest)
+        - blank
+        - dot
+  exclusions:
+    generated: lax
+    paths:
+      - zz_generated.*
+      - internal/operator/controller/suite_test.go
+      # Those tests are generated by kubebuilder
+      - test
+      # Added by "golangci-lint migrate", to be removed?
+      - third_party$
+      - builtin$
+      - examples$

.wordlist.txt

@@ -39,6 +39,7 @@ objectstore
 objectstores
 pgbackrestObjectName
 pgbackrest
+pgBackRest
 pgbackrestArchive
 pluginConfiguration
 postgresql

Makefile

@@ -160,9 +160,9 @@ GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
 
 ## Tool Versions
 KUSTOMIZE_VERSION ?= v5.4.3
-CONTROLLER_TOOLS_VERSION ?= v0.16.1
+CONTROLLER_TOOLS_VERSION ?= v0.16.2
 ENVTEST_VERSION ?= release-0.19
-GOLANGCI_LINT_VERSION ?= v1.59.1
+GOLANGCI_LINT_VERSION ?= v2.1.5
 
 .PHONY: kustomize
 kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.

Taskfile.yml

@@ -266,6 +266,8 @@ tasks:
     vars:
       # renovate: datasource=docker depName=golang versioning=semver
       GOLANG_IMAGE_VERSION: 1.23.5
+      # renovate: datasource=docker depName=k3s  versioning=semver
+      K3S_IMAGE_VERSION: 1.29.15
     env:
       _EXPERIMENTAL_DAGGER_RUNNER_HOST: docker-container://{{ .DAGGER_ENGINE_CONTAINER_NAME }}
     cmds:
@@ -274,6 +276,7 @@ tasks:
         --source .
         --ca certs/ca.pem
         --registry {{.REGISTRY_NAME}}:{{.REGISTRY_PORT}}
+        --kubernetes-version v{{ .K3S_IMAGE_VERSION }}-k3s1
         --go-version {{ .GOLANG_IMAGE_VERSION }}
 
   ci:
@@ -299,8 +302,8 @@ tasks:
         - REGISTRY_USER
         - REGISTRY_PASSWORD
     vars:
-      PLUGIN_IMAGE_NAME: ghcr.io/{{.GITHUB_REPOSITORY}}{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}
-      SIDECAR_IMAGE_NAME: ghcr.io/{{.GITHUB_REPOSITORY}}-sidecar{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}
+      PLUGIN_IMAGE_NAME: '{{.GITHUB_REPOSITORY}}{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}'
+      SIDECAR_IMAGE_NAME: '{{.GITHUB_REPOSITORY}}-sidecar{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}'
       # remove /merge suffix from the branch name. This is a workaround for the GitHub workflow on PRs,
       # where the branch name is suffixed with /merge. Prepend pr- to the branch name on PRs.
       IMAGE_VERSION: '{{regexReplaceAll "(\\d+)/merge" .GITHUB_REF_NAME "pr-${1}"}}'
@@ -310,12 +313,12 @@ tasks:
     cmds:
       - >
         dagger call -m github.com/purpleclay/daggerverse/docker@${DAGGER_DOCKER_SHA}
-        --registry ghcr.io --username $REGISTRY_USER --password env:REGISTRY_PASSWORD
+        --registry docker.io --username $REGISTRY_USER --password env:REGISTRY_PASSWORD
         build --dir . --file containers/Dockerfile.plugin --platform linux/amd64 --platform linux/arm64
         publish --ref {{.PLUGIN_IMAGE_NAME}} --tags {{.IMAGE_VERSION}}
       - >
         dagger call -m github.com/purpleclay/daggerverse/docker@${DAGGER_DOCKER_SHA}
-        --registry ghcr.io --username $REGISTRY_USER --password env:REGISTRY_PASSWORD
+        --registry docker.io --username $REGISTRY_USER --password env:REGISTRY_PASSWORD
         build --dir . --file containers/Dockerfile.sidecar --platform linux/amd64 --platform linux/arm64
         publish --ref {{.SIDECAR_IMAGE_NAME}} --tags {{.IMAGE_VERSION}}
 
@@ -344,7 +347,7 @@ tasks:
       - controller-gen
     desc: Generate the manifest for the main branch
     vars:
-      GITHUB_REPOSITORY: cloudnative-pg/plugin-pgbackrest
+      GITHUB_REPOSITORY: operasoftware/cnpg-plugin-pgbackrest
       GITHUB_REF: main
       GITHUB_REF_NAME: main
     cmds:
@@ -383,8 +386,8 @@ tasks:
         - GITHUB_REF
         - GITHUB_REF_NAME
     vars:
-      PLUGIN_IMAGE_NAME: ghcr.io/{{.GITHUB_REPOSITORY}}{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}
-      SIDECAR_IMAGE_NAME: ghcr.io/{{.GITHUB_REPOSITORY}}-sidecar{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}
+      PLUGIN_IMAGE_NAME: '{{.GITHUB_REPOSITORY}}{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}'
+      SIDECAR_IMAGE_NAME: '{{.GITHUB_REPOSITORY}}-sidecar{{if not (hasPrefix "refs/tags/v" .GITHUB_REF)}}-testing{{end}}'
       # remove /merge suffix from the branch name. This is a workaround for the GitHub workflow on PRs,
       # where the branch name is suffixed with /merge. Prepend pr- to the branch name on PRs.
       IMAGE_VERSION: '{{regexReplaceAll "(\\d+)/merge" .GITHUB_REF_NAME "pr-${1}"}}'

api/v1/archive_types.go

@@ -17,10 +17,10 @@ limitations under the License.
 package v1
 
 import (
-	pgbackrestApi "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/api"
-
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	pgbackrestApi "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/api"
 )
 
 // InstanceSidecarConfiguration defines the configuration for the sidecar that runs in the instance pods.

config/crd/bases/pgbackrest.cnpg.opera.com_archives.yaml

@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.16.1
+    controller-gen.kubebuilder.io/version: v0.16.2
   name: archives.pgbackrest.cnpg.opera.com
 spec:
   group: pgbackrest.cnpg.opera.com
@@ -40,6 +40,8 @@ spec:
             description: ArchiveSpec defines the desired state of Archive.
             properties:
               configuration:
+                description: PgbackrestConfiguration is the configuration of all pgBackRest
+                  operations
                 properties:
                   compression:
                     description: |-
@@ -102,6 +104,10 @@ spec:
                     type: object
                   repositories:
                     items:
+                      description: |-
+                        PgbackrestRepository contains configuration of a single Pgbackrest backup target
+                        repository, including all data needed to properly connect and authenticate with
+                        a selected object store.
                       properties:
                         bucket:
                           minLength: 1

dagger/e2e/main.go

@@ -62,12 +62,19 @@ func (m *E2E) RunEphemeral(
 	// +optional
 	// +default="e2e"
 	name string,
+	// version of the k3s image to use
+	// +optional
+	// +default="latest"
+	kubernetesVersion string,
 	// version of the golang image to use
 	// +optional
 	// +default="latest"
 	goVersion string,
 ) (string, error) {
-	k3s := dag.K3S(name)
+	k3sImage := fmt.Sprintf("rancher/k3s:%s", kubernetesVersion)
+	k3s := dag.K3S(name, dagger.K3SOpts{
+		Image: k3sImage,
+	})
 	ctr := k3s.Container()
 	if ca != nil {
 		ctr = ctr.WithMountedFile("/usr/local/share/ca-certificates/ca.crt", ca)

internal/cnpgi/common/wal.go

@@ -27,18 +27,18 @@ import (
 	cnpgv1 "github.com/cloudnative-pg/cloudnative-pg/api/v1"
 	"github.com/cloudnative-pg/cnpg-i/pkg/wal"
 	"github.com/cloudnative-pg/machinery/pkg/log"
-	"github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/archiver"
-	pgbackrestCommand "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/command"
-	pgbackrestCredentials "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/credentials"
-	pgbackrestRestorer "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/restorer"
-	"github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/utils"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	pgbackrestv1 "github.com/operasoftware/cnpg-plugin-pgbackrest/api/v1"
 	"github.com/operasoftware/cnpg-plugin-pgbackrest/internal/cnpgi/metadata"
 	"github.com/operasoftware/cnpg-plugin-pgbackrest/internal/cnpgi/operator/config"
+	"github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/archiver"
+	pgbackrestCommand "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/command"
+	pgbackrestCredentials "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/credentials"
+	pgbackrestRestorer "github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/restorer"
+	"github.com/operasoftware/cnpg-plugin-pgbackrest/internal/pgbackrest/utils"
 )
 
 // WALServiceImplementation is the implementation of the WAL Service
@@ -439,6 +439,7 @@ func gatherWALFilesToRestore(walName string, parallel int, controlledPromotion b
 	if controlledPromotion && (len(segmentList) < parallel || parallel == 1) {
 		// Last WAL file during a token-based promotion can be (always is?) a partial one
 		// and pgbackrest won't download it unless extension is explicitly included.
+		// nolint: makezero // This is a rare operation that most likely should be rewritten anyway.
 		walList = append(walList, walList[len(walList)-1]+".partial")
 	}