Skip to content

Commit c2da4dd

Browse files
amartin120amartin120
committed
Merge 'v2.2.2' into carbide/2.2
Signed-off-by: Adam Martin <adam.martin@rancherfederal.com>
2 parents 4794db9 + bf6b57b commit c2da4dd

File tree

96 files changed

+1552
-1077
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

96 files changed

+1552
-1077
lines changed

‎.github/dependabot.yml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,18 @@ updates:
2020
schedule:
2121
interval: "daily"
2222
open-pull-requests-limit: 10
23+
groups:
24+
gomod:
25+
update-types:
26+
- "patch"
27+
2328
- package-ecosystem: "github-actions"
2429
directory: "/"
2530
schedule:
2631
interval: "daily"
2732
open-pull-requests-limit: 10
33+
groups:
34+
actions:
35+
update-types:
36+
- "minor"
37+
- "patch"

‎.github/workflows/build.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,9 +41,9 @@ jobs:
4141
contents: read
4242

4343
steps:
44-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
44+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4545

46-
- uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
46+
- uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
4747

4848
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
4949
with:
@@ -54,7 +54,7 @@ jobs:
5454
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5555

5656
- name: Set up Cloud SDK
57-
uses: google-github-actions/auth@35b0e87d162680511bf346c299f71c9c5c379033 # v1.1.1
57+
uses: google-github-actions/auth@67e9c72af6e0492df856527b474995862b7b6591 # v2.0.0
5858
with:
5959
workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-cosign'
6060
service_account: 'github-actions@projectsigstore.iam.gserviceaccount.com'

‎.github/workflows/codeql-analysis.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747

4848
steps:
4949
- name: Checkout repository
50-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
50+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5151

5252
- name: Utilize Go Module Cache
5353
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2

‎.github/workflows/cross.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
go-version: '1.21'
4040
check-latest: true
4141
- name: Checkout code
42-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
42+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4343
- name: build cosign
4444
run: |
4545
make cosign && mv ./cosign ./${{matrix.COSIGN_TARGET}}

‎.github/workflows/donotsubmit.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
steps:
1616
- name: Check out code
17-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 #v2.4.0
17+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v2.4.0
1818

1919
- name: Do Not Submit
2020
uses: chainguard-dev/actions/donotsubmit@84c993eaf02da1c325854fb272a4df9184bd80fc # main

‎.github/workflows/e2e-tests-kms.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
COSIGN_YES: "true"
5454
steps:
5555
- name: Checkout
56-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
56+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5757
- uses: cpanato/vault-installer@4246c92b8f047fdb824eb7387d86b3c7806e2bf3 # v0.0.2
5858
with:
5959
vault-release: '1.14.1'

‎.github/workflows/e2e-tests.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
runs-on: ${{ matrix.os }}
4040

4141
steps:
42-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
42+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4343
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
4444
with:
4545
go-version: '1.21'
@@ -58,7 +58,7 @@ jobs:
5858
runs-on: ${{ matrix.os }}
5959

6060
steps:
61-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
61+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
6262
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
6363
with:
6464
go-version: '1.21'

‎.github/workflows/e2e-with-binary.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545
COSIGN_YES: "true"
4646

4747
steps:
48-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
48+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4949
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
5050
with:
5151
go-version: '1.21'

‎.github/workflows/github-oidc.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
KO_PREFIX: ghcr.io/${{ github.repository }}
4343
runs-on: ubuntu-latest
4444
steps:
45-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
45+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4646
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
4747
with:
4848
go-version: '1.21'

‎.github/workflows/kind-e2e-insecure-registry.yaml

Lines changed: 52 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,12 @@ jobs:
4141
REGISTRY_PORT: 5000
4242
INSECURE_REGISTRY_NAME: insecure-registry.notlocal
4343
INSECURE_REGISTRY_PORT: 5001
44+
INSECURE_OCI_REGISTRY_NAME: insecure-oci-registry.notlocal
45+
INSECURE_OCI_REGISTRY_PORT: 5002
4446
KO_DOCKER_REPO: registry.local:5000/policy-controller
4547

4648
steps:
47-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
49+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
4850
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
4951
with:
5052
go-version: '1.21'
@@ -55,7 +57,7 @@ jobs:
5557
- uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v1.6.1
5658

5759
- name: Install yq
58-
uses: mikefarah/yq@a198f72367ce9da70b564a2cc25399de8e27bf37 # v4.35.2
60+
uses: mikefarah/yq@1c3d55106075bd37df197b4bc03cb4a413fdb903 # v4.40.4
5961

6062
- name: Install Cosign
6163
run: |
@@ -100,6 +102,54 @@ jobs:
100102
go install github.com/google/go-containerregistry/cmd/crane
101103
./test/e2e_test_insecure_registry.sh
102104
105+
- name: Setup local insecure OCI registry
106+
run: |
107+
# Create a self-signed SSL cert
108+
mkdir -p insecure-certs
109+
openssl req \
110+
-subj "/C=US/ST=WA/L=Flavorton/O=Tests-R-Us/OU=Dept. of Insecurity/CN=example.com/emailAddress=testing@example.com" \
111+
-newkey rsa:4096 -nodes -sha256 -keyout insecure-certs/domain.key \
112+
-x509 -days 365 -out insecure-certs/domain.crt
113+
cat > config.json << EOF
114+
{
115+
"distSpecVersion": "1.1.0-dev",
116+
"storage": {
117+
"rootDirectory": "/tmp/zot"
118+
},
119+
"http": {
120+
"address": "0.0.0.0",
121+
"port": "5000",
122+
"realm": "zot",
123+
"tls": {
124+
"cert": "/insecure-certs/domain.crt",
125+
"key": "/insecure-certs/domain.key"
126+
}
127+
},
128+
"log": {
129+
"level": "debug"
130+
}
131+
}
132+
EOF
133+
# Run a registry.
134+
docker run -d --restart=always \
135+
--name $INSECURE_OCI_REGISTRY_NAME \
136+
-v "$(pwd)"/insecure-certs:/insecure-certs \
137+
-v "$(pwd)"/config.json:/etc/zot/config.json \
138+
-p $INSECURE_OCI_REGISTRY_PORT:$REGISTRY_PORT \
139+
ghcr.io/project-zot/zot-minimal-linux-amd64:$ZOT_VERSION
140+
# Connect the registry to the KinD network.
141+
docker network connect "kind" $INSECURE_OCI_REGISTRY_NAME
142+
# Make the $INSECURE_REGISTRY_NAME -> 127.0.0.1, to tell `ko` to publish to
143+
# local registry, even when pushing $INSECURE_REGISTRY_NAME:$INSECURE_REGISTRY_NAME/some/image
144+
sudo echo "127.0.0.1 $INSECURE_OCI_REGISTRY_NAME" | sudo tee -a /etc/hosts
145+
env:
146+
ZOT_VERSION: v2.0.0-rc6
147+
148+
- name: Run Insecure OCI Registry Tests
149+
run: |
150+
go install github.com/google/go-containerregistry/cmd/crane
151+
./test/e2e_test_insecure_oci_registry.sh
152+
103153
- name: Collect diagnostics
104154
if: ${{ failure() }}
105155
uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main

‎.github/workflows/kind-verify-attestation.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
COSIGN_YES: "true"
4848

4949
steps:
50-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
50+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5151
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
5252
with:
5353
go-version: '1.21'
@@ -57,7 +57,7 @@ jobs:
5757
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
5858

5959
- name: Install yq
60-
uses: mikefarah/yq@a198f72367ce9da70b564a2cc25399de8e27bf37 # v4.35.2
60+
uses: mikefarah/yq@1c3d55106075bd37df197b4bc03cb4a413fdb903 # v4.40.4
6161

6262
- name: build cosign
6363
run: |

‎.github/workflows/milestone.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
statuses: none
2424

2525
steps:
26-
- uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
26+
- uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
2727
with:
2828
script: |
2929
if (!context.payload.pull_request.merged) {

‎.github/workflows/scorecard-action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,12 @@ jobs:
2323
id-token: write
2424
steps:
2525
- name: "Checkout code"
26-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
26+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
2727
with:
2828
persist-credentials: false
2929

3030
- name: "Run analysis"
31-
uses: ossf/scorecard-action@483ef80eb98fb506c348f7d62e28055e49fe2398 # v2.3.0
31+
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
3232
with:
3333
results_file: results.sarif
3434
results_format: sarif

‎.github/workflows/stale.yml

Lines changed: 0 additions & 29 deletions
This file was deleted.

‎.github/workflows/tests.yaml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
OS: ${{ matrix.os }}
4747

4848
steps:
49-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
49+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5050
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
5151
- uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
5252
with:
@@ -88,7 +88,7 @@ jobs:
8888
runs-on: ubuntu-latest
8989

9090
steps:
91-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
91+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
9292
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
9393
- uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
9494
with:
@@ -113,7 +113,7 @@ jobs:
113113
- name: setup kind cluster
114114
run: |
115115
# Used to test: cosign generate-key-pair k8s://...
116-
go install sigs.k8s.io/kind@v0.17.0
116+
go install sigs.k8s.io/kind@v0.20.0
117117
kind create cluster
118118
119119
- name: Run end-to-end tests
@@ -127,7 +127,7 @@ jobs:
127127
name: Run PowerShell E2E tests
128128
runs-on: windows-latest
129129
steps:
130-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
130+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
131131
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
132132
with:
133133
go-version: ${{ env.GO_VERSION }}
@@ -153,7 +153,7 @@ jobs:
153153
name: license boilerplate check
154154
runs-on: ubuntu-latest
155155
steps:
156-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
156+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
157157
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
158158
with:
159159
go-version: ${{ env.GO_VERSION }}
@@ -169,7 +169,7 @@ jobs:
169169
name: lint
170170
runs-on: ubuntu-latest
171171
steps:
172-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
172+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
173173
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
174174
with:
175175
go-version: '1.21'
@@ -178,5 +178,5 @@ jobs:
178178
uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
179179
with:
180180
# Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
181-
version: v1.54
181+
version: v1.55
182182
args: --timeout=5m

‎.github/workflows/validate-release.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ jobs:
3131
steps:
3232
- name: Check Signature
3333
run: |
34-
cosign verify ghcr.io/gythialy/golang-cross:v1.21.3-0@sha256:6e2c885532ad276195d3e3f269055fb2742c8963b231d097c467758dd425a632 \
34+
cosign verify ghcr.io/gythialy/golang-cross:v1.21.4-0@sha256:d18679c199db258cac9876a80abf9aff69485cf8a324bf547521f3de4cf3a366 \
3535
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
36-
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.21.3-0"
36+
--certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.21.4-0"
3737
env:
3838
TUF_ROOT: /tmp
3939

@@ -43,12 +43,12 @@ jobs:
4343
- check-signature
4444

4545
container:
46-
image: ghcr.io/gythialy/golang-cross:v1.21.3-0@sha256:6e2c885532ad276195d3e3f269055fb2742c8963b231d097c467758dd425a632
46+
image: ghcr.io/gythialy/golang-cross:v1.21.4-0@sha256:d18679c199db258cac9876a80abf9aff69485cf8a324bf547521f3de4cf3a366
4747

4848
permissions: {}
4949

5050
steps:
51-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
51+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
5252

5353
# Error: fatal: detected dubious ownership in repository at '/__w/cosign/cosign'
5454
# To add an exception for this directory, call:
@@ -117,7 +117,7 @@ jobs:
117117
run: make snapshot
118118
env:
119119
PROJECT_ID: honk-fake-project
120-
RUNTIME_IMAGE: gcr.io/distroless/static:debug-nonroot
120+
RUNTIME_IMAGE: gcr.io/distroless/static-debian12:nonroot
121121

122122
- name: check binaries
123123
run: |

‎.github/workflows/verify-docgen.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
steps:
3232
- name: deps
3333
run: sudo apt-get update && sudo apt-get install -yq libpcsclite-dev
34-
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
34+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
3535
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
3636
with:
3737
go-version: '1.21'

‎.github/workflows/whitespace.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414

1515
steps:
1616
- name: Check out code
17-
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
17+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
1818

1919
- uses: chainguard-dev/actions/trailing-space@84c993eaf02da1c325854fb272a4df9184bd80fc # main
2020
if: ${{ always() }}

‎.goreleaser.yml

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,6 @@ before:
1212
hooks:
1313
- go mod tidy
1414
- /bin/bash -c 'if [ -n "$(git --no-pager diff --exit-code go.mod go.sum)" ]; then exit 1; fi'
15-
# if running a release we will generate the images in this step
16-
# if running in the CI the CI env va is set and we dont run the ko steps
17-
# this is needed because we are generating files that goreleaser was not aware to push to GH project release
18-
- /bin/bash -c 'if [ -z "$CI" ]; then make sign-release-images; fi'
1915

2016
gomod:
2117
proxy: true

0 commit comments

Comments
 (0)