Pcp 2946

.gitattributes

@@ -0,0 +1,2 @@
+*.sh text eol=lf
+*.yaml text eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -32,5 +32,15 @@ Fixes #
 
 - [ ] squashed commits
 - [ ] includes documentation
+- [ ] includes [emojis](https://github.com/kubernetes-sigs/kubebuilder-release-tools?tab=readme-ov-file#kubebuilder-project-versioning)
 - [ ] adds unit tests
 - [ ] adds or updates e2e tests
+
+**Release note**:
+<!--  Write your release note:
+1. Enter your extended release note in the below block. If the PR requires additional action from users switching to the new release, include the string "action required".
+2. If no release note is required, just write "NONE".
+-->
+```release-note
+
+```

.github/dependabot.yml

@@ -1,27 +1,118 @@
 version: 2
 updates:
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+        interval: "weekly"
+    commit-message:
+        prefix: ":seedling:"
+    labels:
+      - "kind/cleanup"
+      - "area/ci"
+      - "ok-to-test"
+      - "release-note-none"
+
+  # Main Go module
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+    ignore:
+      # Ignore Cluster-API as its upgraded manually.
+      - dependency-name: "sigs.k8s.io/cluster-api*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Ignore controller-runtime as its upgraded manually.
+      - dependency-name: "sigs.k8s.io/controller-runtime"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
+      - dependency-name: "k8s.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      - dependency-name: "go.etcd.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      - dependency-name: "google.golang.org/grpc"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
+      - dependency-name: "sigs.k8s.io/kustomize/api"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
 
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
 
   # Enable version updates for Go tools
   - package-ecosystem: "gomod"
     directory: "/hack/tools"
     schedule:
       interval: "weekly"
+      day: "wednesday"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
+    groups:
+      dependencies:
+        patterns:
+          - "*"
+    ignore:
+      # Ignore Cluster-API as its upgraded manually.
+      - dependency-name: "sigs.k8s.io/cluster-api*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Ignore controller-runtime as its upgraded manually.
+      - dependency-name: "sigs.k8s.io/controller-runtime"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
+      - dependency-name: "k8s.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      - dependency-name: "go.etcd.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      - dependency-name: "google.golang.org/grpc"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
+      - dependency-name: "sigs.k8s.io/kustomize/api"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
 
   - package-ecosystem: "docker"
     directory: "/hack/tools"
     schedule:
       interval: "weekly"
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "daily"
+      day: "wednesday"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
+    groups:
+      dependencies:
+        patterns:
+          - "*"

.github/workflows/codeql-analysis.yml

@@ -21,18 +21,18 @@ jobs:
         language: [ 'go' ]
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/dependabot.yml

@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go 1.x
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@v5
       with:
-        go-version: '1.17'
+        go-version: '1.21'
       id: go
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
-    - uses: actions/cache@v3
+      uses: actions/checkout@v4.1.1
+    - uses: actions/cache@v4
       name: Restore go cache
       with:
         path: |

.github/workflows/md-link-checker.yml

@@ -0,0 +1,14 @@
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/[email protected]
+      - uses: artyom/mdlinks@v0
+        with:
+          dir: 'docs/book'

.github/workflows/pr-gh-workflow-approve.yaml

@@ -0,0 +1,40 @@
+name: PR approve GH Workflows
+
+on:
+  pull_request_target:
+    types:
+      - edited
+      - labeled
+      - reopened
+      - synchronize
+
+jobs:
+  approve:
+    name: Approve ok-to-test
+    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Update PR
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const result = await github.rest.actions.listWorkflowRunsForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: "pull_request",
+              status: "action_required",
+              head_sha: context.payload.pull_request.head.sha,
+              per_page: 100
+            });
+
+            for (var run of result.data.workflow_runs) {
+              await github.rest.actions.approveWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: run.id
+              });
+            }

.github/workflows/pr-golangci-lint.yaml

@@ -0,0 +1,33 @@
+name: PR golangci-lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+# Remove all permissions from GITHUB_TOKEN except metadata.
+permissions: {}
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        working-directory:
+          - ""
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # tag=v4.0.0
+        with:
+          version: v1.56.1
+          args: --out-format=colored-line-number
+          working-directory: ${{matrix.working-directory}}

.github/workflows/pr-verify.yml

@@ -0,0 +1,16 @@
+name: PR verify
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    name: verify PR contents
+    steps:
+    - name: Verifier action
+      id: verifier
+      uses: kubernetes-sigs/kubebuilder-release-tools@012269a88fa4c034a0acf1ba84c26b195c0dbab4 # tag=v0.4.3
+      with:
+        github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yaml

@@ -0,0 +1,38 @@
+name: release
+
+on:
+  push:
+    tags:
+    - 'v*'
+
+permissions:
+  contents: write # required to write to github release.
+
+jobs:
+  release:
+    name: Create draft release
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.21'
+      - name: Set version info
+        run: |
+          echo "VERSION=${GITHUB_REF_NAME}" >> $GITHUB_ENV
+          echo "PREVIOUS_VERSION=$(git describe --abbrev=0 2> /dev/null)" >> $GITHUB_ENV
+          echo "RELEASE_BRANCH=release-$(echo ${GITHUB_REF_NAME} | grep -Eo '[0-9]\.[0-9]+')" >> $GITHUB_ENV
+          echo "RELEASE_TAG=${GITHUB_REF_NAME}" >> $GITHUB_ENV
+      - name: Run release
+        run: |
+          echo "Version is: $VERSION"
+          echo "Previous version is: $PREVIOUS_VERSION"
+          echo "Release branch is: $RELEASE_BRANCH"
+          echo "Release tag is: $RELEASE_TAG"
+          make release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/scan.yml

@@ -0,0 +1,29 @@
+name: scan-images
+
+on:
+  schedule:
+    # every Monday at 12:00AM
+    - cron: "0 12 * * 1"
+
+# Remove all permissions from GITHUB_TOKEN except metadata.
+permissions: {}
+
+jobs:
+  scan:
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: [ main, release-2.2, release-2.1, release-2.0 ]
+    name: Trivy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/[email protected]
+        with:
+          ref: ${{ matrix.branch }}
+      - name: Setup go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: '${{ github.workspace }}/go.mod'
+      - name: Run verify container script
+        run: make verify-container-images

.gitignore

@@ -39,6 +39,10 @@ kubeconfig
 # vscode
 .vscode
 
+# go.work files
+go.work
+go.work.sum
+
 # goland
 .idea
 
@@ -53,6 +57,7 @@ junit.*.xml
 .DS_Store
 
 .tiltbuild
+dist
 
 # test results
 _artifacts