Merge branch 'main' into llvm/llvm-20

Author: javacruft

.github/chainguard/ci-license-check.sts.yaml

@@ -6,3 +6,4 @@ subject_pattern: "(111508570611001124410)"
 
 permissions:
   checks: write
+  pull_requests: write # need to comment on PRs

.github/chainguard/elastic-build.sts.yaml

@@ -8,7 +8,11 @@ issuer: https://accounts.google.com
 #  presubmit: 114870839879105817572: ebuild-zasv64d5x1oc4m3epw39yod@prod-enforce-fabc.iam.gserviceaccount.com
 #  postsubmit: 118124811908286464886: ebuild-ckhudf69he6dfl1xy83uuke@prod-enforce-fabc.iam.gserviceaccount.com
 #  world: 100027593799559093519: ebuild-n0ppcbm8uzc6ew2wy4gesfg@prod-enforce-fabc.iam.gserviceaccount.com
-subject_pattern: "(116478844699827634314|115457633213442188328|118305965159726888964|114870839879105817572|118124811908286464886|100027593799559093519)"
+# eco-2-28:
+#  presubmit: 109278469796396932019: ebuild-456o8jve9m82pzkyd0rxyya@prod-enforce-fabc.iam.gserviceaccount.com
+#  postsubmit: 116606566869655215545: ebuild-dg05lqlr2tymodkwd5go6a9@prod-enforce-fabc.iam.gserviceaccount.com
+#  world: 115998046588963941434: ebuild-d7lrzt8tuql0tod9242jkco@prod-enforce-fabc.iam.gserviceaccount.com
+subject_pattern: "(116478844699827634314|115457633213442188328|118305965159726888964|114870839879105817572|118124811908286464886|100027593799559093519|109278469796396932019|116606566869655215545|115998046588963941434)"
 
 permissions:
   contents: read

.pre-commit-config.yaml

@@ -1,6 +1,7 @@
+# Update with `pre-commit autoupdate --freeze` which
+# pins all repos using commit hashes, not mutable references
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    # Use commit hashes here, not tags.
     rev: cef0300fd0fc4d2a87a85fa2093c6b283ea36f4b # v5.0.0
     hooks:
       - id: check-yaml
@@ -11,3 +12,8 @@ repos:
       - id: check-symlinks
       - id: detect-private-key
         exclude: ^ruby-3\.0/0001-ruby-3\.0\.6-openssl-patch\.patch$
+  - repo: https://github.com/chainguard-dev/yam
+    rev: 498642e77997ba79709f43a7ee2c84b12b2145bb # v0.2.12
+    hooks:
+      - id: yam
+        files: ^[^/]+\.yaml$

Makefile

@@ -16,10 +16,17 @@ KEY ?= local-melange.rsa
 REPO ?= $(shell pwd)/packages
 QEMU_KERNEL_REPO := https://apk.cgr.dev/chainguard-private/
 
-ifneq (${MELANGE_RUNNER},)
-	MELANGE_OPTS += --runner=${MELANGE_RUNNER}
-	MELANGE_TEST_OPTS += --runner=${MELANGE_RUNNER}
+ifeq (${MELANGE_RUNNER},)
+MELANGE_RUNNER = qemu
+$(warning ****************************** WARNING ******************************)
+$(warning *** MELANGE_RUNNER is unset. The default runner is now qemu, which)
+$(warning *** requires chainctl authentication to access the Chainguard kernel.)
+$(warning *** See `melange build --help` for a list of other runner options.)
+$(warning ****************************** WARNING ******************************)
 endif
+
+MELANGE_OPTS += --runner=${MELANGE_RUNNER}
+MELANGE_TEST_OPTS += --runner=${MELANGE_RUNNER}
 QEMU_KERNEL_IMAGE ?= kernel/$(ARCH)/vmlinuz
 ifeq (${MELANGE_RUNNER},qemu)
 	QEMU_KERNEL_DEP = ${QEMU_KERNEL_IMAGE}

airflow.yaml

@@ -1,7 +1,7 @@
 package:
   name: airflow
-  version: "2.10.5"
-  epoch: 43
+  version: "2.11.0"
+  epoch: 0
   description: Platform to programmatically author, schedule, and monitor workflows
   options:
     #  There is a dependency on libarrow.so although it
@@ -54,7 +54,7 @@ pipeline:
     with:
       repository: https://github.com/apache/airflow
       tag: ${{package.version}}
-      expected-commit: b93c3db6b1641b0840bd15ac7d05bc58ff2cccbf
+      expected-commit: d9ed7b94d033dc61ee1c05aafb9f1c1f7b82cfb2
 
   - runs: |
       # By default, the airflow celery provider is not built, but running the upstream helm chart requires it
@@ -98,7 +98,7 @@ pipeline:
       #GHSA-8w49-h785-mj3c/GHSA-8495-4g3g-x7pr/GHSA-27mf-ghqm-j3j8 fixes
       pip3.12 install --verbose \
         --force-reinstall --prefix=/opt/airflow --root="${{targets.contextdir}}" \
-        aiohttp>=3.10.11 tornado>=6.4.2 statsd packaging pyparsing \
+        aiohttp>=3.10.11 tornado>=6.5.0 statsd packaging pyparsing \
         apache-airflow==${{package.version}} apache-airflow-providers-celery==3.10.0 "flask>=2.2.1,<2.3"
       # NOTE: apache-airflow-providers-celery is pinned to 3.10.0 because 3.10.3 introduced a regresssion.
       # https://github.com/apache/airflow/issues/47781 details more about it.

amazon-cloudwatch-agent.yaml

@@ -1,7 +1,7 @@
 package:
   name: amazon-cloudwatch-agent
   version: "1.300056.0"
-  epoch: 0
+  epoch: 1
   description: CloudWatch Agent enables you to collect and export host-level metrics and logs on instances running Linux or Windows server.
   copyright:
     - license: Apache-2.0
@@ -19,7 +19,7 @@ pipeline:
     with:
       repository: https://github.com/aws/amazon-cloudwatch-agent
       tag: v${{package.version}}
-      expected-commit: f9c10f2cd7d097ec55cb316a5195feec05ccf460
+      expected-commit: 2e9286bb298345f88abe6df880803cce21d0713b
 
   - uses: go/build
     with:

apache-arrow.yaml

@@ -1,7 +1,7 @@
 package:
   name: apache-arrow
   version: "20.0.0"
-  epoch: 0
+  epoch: 1
   description: "multi-language toolbox for accelerated data interchange and in-memory processing"
   copyright:
     - license: Apache-2.0
@@ -168,6 +168,9 @@ subpackages:
     dependencies:
       runtime:
         - libarrow
+    test:
+      pipeline:
+        - uses: test/tw/ldd-check
 
   - name: "libarrow"
     description: "multi-language toolbox for accelerated data interchange and in-memory processing (libarrow library)"

argo-cd-3.0.yaml

@@ -1,6 +1,6 @@
 package:
   name: argo-cd-3.0
-  version: "3.0.1"
+  version: "3.0.2"
   epoch: 0
   description: Declarative continuous deployment for Kubernetes.
   copyright:
@@ -23,7 +23,7 @@ pipeline:
     with:
       repository: https://github.com/argoproj/argo-cd
       tag: v${{package.version}}
-      expected-commit: 2bcef4877285db808e47b862567b278c3793d056
+      expected-commit: 8a7c0f0c86b4a189669041fd4df671316fd4c977
 
   - uses: go/bump
     with:

atmoz-sftp.yaml

@@ -1,7 +1,7 @@
 #nolint:valid-pipeline-git-checkout-commit,valid-pipeline-git-checkout-tag
 package:
   name: atmoz-sftp
-  version: "0.0.0_git20250512"
+  version: "0.0.0_git20250519"
   epoch: 0
   description: Various scripts from https://github.com/atmoz/sftp to help run SFTP in a container
   copyright:

aws-c-cal.yaml

@@ -1,6 +1,6 @@
 package:
   name: aws-c-cal
-  version: "0.9.0"
+  version: "0.9.1"
   epoch: 0
   description: "AWS Crypto Abstraction Layer: Cross-Platform, C99 wrapper for cryptography primitives"
   copyright:
@@ -20,7 +20,7 @@ environment:
 pipeline:
   - uses: git-checkout
     with:
-      expected-commit: fa108de5280afd71018e0a0534edb36b33f030f6
+      expected-commit: 938d0fea30d8476a7cf260278d636404682a28d4
       repository: https://github.com/awslabs/aws-c-cal
       tag: v${{package.version}}