Merge branch 'origin-main' into hwa/fix_deep_copy_with_template

Author: holger-waschke

.coderabbit.yaml

@@ -0,0 +1,10 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+# docs: https://docs.coderabbit.ai/reference/configuration
+reviews:
+  poem: false
+  high_level_summary: false
+  estimated_code_review_effort: false
+  suggested_labels: false
+  suggested_reviewers: false
+  review_status: false
+  in_progress_fortune: false

.dockerignore

@@ -1,8 +1,10 @@
+data/
 .build/
 .tarballs/
 
 !.build/linux-amd64/
-!.build/linux-armv7/
 !.build/linux-arm64/
+!.build/linux-armv7/
 !.build/linux-ppc64le/
+!.build/linux-riscv64/
 !.build/linux-s390x/

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -72,3 +72,50 @@ body:
       label: Logs
       description: Insert Prometheus and Alertmanager logs relevant to the issue here.
       render: text
+  - type: markdown
+    attributes:
+      value: |
+        ## Performance issues
+
+        The fields below are only relevant if you are reporting a performance issue (e.g. high CPU or memory usage). You can skip them otherwise.
+
+        You can upload the captured profiles to https://pprof.me/ and share the link to the profile diff between the previous and current versions.
+  - type: textarea
+    attributes:
+      label: CPU profiles
+      description: |
+        Please attach CPU profiles from both the previous version (where performance was acceptable) and the current version (where you observe the regression). This helps us compare and identify the cause.
+
+        See the upstream Go documentation on diagnostics for how to capture profiles: https://go.dev/doc/diagnostics. You can capture a CPU profile with:
+
+        `go tool pprof http://<alertmanager-host>:9093/debug/pprof/profile?seconds=30`
+  - type: textarea
+    attributes:
+      label: Memory profiles
+      description: |
+        Please attach memory (heap) profiles from both the previous version (where performance was acceptable) and the current version (where you observe the regression).
+
+        See the upstream Go documentation on diagnostics: https://go.dev/doc/diagnostics. You can capture a heap profile with:
+
+        `go tool pprof http://<alertmanager-host>:9093/debug/pprof/heap`
+  - type: input
+    attributes:
+      label: Number of alerts
+      description: Approximate number of alerts Alertmanager is handling when the issue occurs.
+  - type: input
+    attributes:
+      label: Number of silences
+      description: Approximate number of silences configured when the issue occurs.
+  - type: markdown
+    attributes:
+      value: |
+        ## Using prometheus-operator?
+
+        If you deploy Alertmanager via [prometheus-operator](https://github.com/prometheus-operator/prometheus-operator), please confirm the checklist below before opening the issue.
+  - type: checkboxes
+    attributes:
+      label: prometheus-operator checklist
+      description: Only applicable if you use prometheus-operator to manage Alertmanager.
+      options:
+        - label: I have confirmed this issue is not caused by a missing feature in prometheus-operator.
+        - label: I have reproduced this issue when running Alertmanager directly (without prometheus-operator).

.github/dependabot.yml

@@ -1,3 +1,6 @@
+###
+# Avoid syncing from prometheus/prometheus: no_prometheus_repo_sync
+###
 version: 2
 updates:
   - package-ecosystem: "gomod"
@@ -13,6 +16,9 @@ updates:
       go.opentelemetry.io:
         patterns:
           - "go.opentelemetry.io/*"
+      golang.org-x:
+        patterns:
+          - "golang.org/x/*"
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
@@ -21,6 +27,20 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    groups:
+      promci:
+        patterns:
+          - "prometheus/promci*"
+      codeql:
+        patterns:
+          - "github/codeql-action*"
+    # Exclude configs synced from upstream prometheus/prometheus.
+    exclude-paths:
+      - .github/workflows/container_description.yml
+      - .github/workflows/golangci-lint.yml
+      - .github/workflows/govulncheck.yml
+      - .github/workflows/scorecards.yml
+      - .github/workflows/stale.yml
   - package-ecosystem: "npm"
     directory: "/ui/mantine-ui"
     open-pull-requests-limit: 20

.github/workflows/approve-workflows.yml

@@ -0,0 +1,27 @@
+---
+###
+# This action is synced from https://github.com/prometheus/prometheus
+###
+name: Approve pending workflows
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions: read-all
+
+jobs:
+  approve:
+    if: >-
+      github.event.issue.pull_request &&
+      github.event.comment.body == '/workflow-approve' &&
+      (github.repository_owner == 'prometheus' || github.repository_owner == 'prometheus-community')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: read
+      pull-requests: write
+    steps:
+      - uses: prometheus/promci/approve_workflows@370e8c15dcec50043cbe66f2f34633d9efc0a190 # v0.9.0
+        with:
+          github_token: ${{ github.token }}

.github/workflows/build-release-branch.yml

@@ -0,0 +1,27 @@
+---
+name: Build release branch
+on:  # yamllint disable-line rule:truthy
+  push:
+    branches:
+      - release-*
+  workflow_dispatch:
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    name: Run ci
+    uses: ./.github/workflows/ci.yml
+
+  build:
+    name: Build Alertmanager for all architectures
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        thread: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11]
+    needs: ci
+    steps:
+      - uses: prometheus/promci/build@13941414d409d227afd67544e5d306827db5a1a2 # v0.8.5
+        with:
+          parallelism: 12
+          thread: ${{ matrix.thread }}

.github/workflows/ci.yml

@@ -8,24 +8,48 @@ jobs:
     name: Test alertmanager frontend
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: './.nvmrc'
+          cache: 'npm'
+          cache-dependency-path: |
+            .nvmrc
+            **/package-lock.json
       - run: make clean
       - run: make all
         working-directory: ./ui/app
       - run: make assets
       - run: make apiv2
       - run: git diff --exit-code
+      - run: make assets-tarball
+      - uses: prometheus/promci-artifacts/save@f9a587dbc0b2c78a0c54f8ad1cde71ea29a4b76f # v0.1.0
+        with:
+          directory: .tarballs
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4.6.2
+        with:
+          name: ui-dist
+          path: ui/app/dist
+          include-hidden-files: true
 
   build:
     name: Build Alertmanager for common architectures
+    needs: [test_frontend]
     runs-on: ubuntu-latest
     strategy:
       matrix:
         thread: [0, 1, 2]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.0.0
-      - uses: prometheus/promci@fc721ff8497a70a93a881cd552b71af7fb3a9d53 # v0.5.4
-      - uses: ./.github/promci/actions/build
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ui-dist
+          path: ui/app/dist
+      - uses: prometheus/promci/build@13941414d409d227afd67544e5d306827db5a1a2 # v0.8.5
         with:
           promu_opts: "-p linux/amd64 -p windows/amd64 -p linux/arm64 -p darwin/amd64 -p darwin/arm64 -p linux/386"
           parallelism: 3
@@ -34,6 +58,7 @@ jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
+    needs: [test_frontend]
     # Whenever the Go version is updated here, .promu.yml
     # should also be updated.
     container:
@@ -51,8 +76,13 @@ jobs:
       EMAIL_NO_AUTH_CONFIG: testdata/noauth.yml
       EMAIL_AUTH_CONFIG: testdata/auth.yml
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: prometheus/promci@fc721ff8497a70a93a881cd552b71af7fb3a9d53 # v0.5.4
-      - uses: ./.github/promci/actions/setup_environment
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ui-dist
+          path: ui/app/dist
+      - uses: prometheus/promci-setup@3e5cd31b34b8ae19efa8f071c5e3cdb44884a7f8 # v0.2.1
       - run: make
       - run: git diff --exit-code

.github/workflows/container_description.yml

@@ -1,4 +1,7 @@
 ---
+###
+# This action is synced from https://github.com/prometheus/prometheus
+###
 name: Push README to Docker Hub
 on:
   push:
@@ -18,7 +21,7 @@ jobs:
     if: github.repository_owner == 'prometheus' || github.repository_owner == 'prometheus-community' # Don't run this workflow on forks.
     steps:
       - name: git checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Set docker hub repo name
@@ -42,7 +45,7 @@ jobs:
     if: github.repository_owner == 'prometheus' || github.repository_owner == 'prometheus-community' # Don't run this workflow on forks.
     steps:
       - name: git checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Set quay.io org name

.github/workflows/govulncheck.yml

@@ -0,0 +1,33 @@
+---
+###
+# This action is synced from https://github.com/prometheus/prometheus
+###
+name: govulncheck
+on:
+  pull_request:
+    paths:
+      - VERSION
+      - .github/workflows/govulncheck.yml
+  push:
+    branches:
+      - main
+      - master
+  schedule:
+    - cron: '33 2 * * *'
+
+permissions:
+  contents: read
+
+jobs:
+  govulncheck:
+    runs-on: ubuntu-latest
+    name: Run govulncheck
+    steps:
+      - name: Install snmp_exporter/generator dependencies
+        id: snmp-deps
+        run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
+        if: github.repository == 'prometheus/snmp_exporter'
+      - id: govulncheck
+        uses: golang/govulncheck-action@3fa7bd9cee2cfdf3499a8803b226e43de7b7cdb4 # master
+        env:
+          GOOS: ${{ contains(github.repository, 'windows_exporter') && 'windows' || '' }}

.github/workflows/mixin.yml

@@ -4,15 +4,20 @@ on:
     paths:
       - "doc/alertmanager-mixin/**"
 
+permissions:
+  contents: read
+
 jobs:
   mixin:
     name: mixin-lint
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: install Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version: 1.26.x
       # pin the mixtool version until https://github.com/monitoring-mixins/mixtool/issues/135 is merged.