Skip to content

Commit abde86f

Browse files
jwttyjwtty
authored
chore: Backport 20260409 (#1287)
2 parents 4466069 + ee60e23 commit abde86f

25 files changed

Lines changed: 1103 additions & 114 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,13 @@ updates:
77
commit-message:
88
prefix: "chore"
99

10+
- package-ecosystem: "docker"
11+
directory: "/docker"
12+
schedule:
13+
interval: "weekly"
14+
commit-message:
15+
prefix: "chore"
16+
1017
- package-ecosystem: "gomod"
1118
directory: "/"
1219
schedule:

‎.github/workflows/chart.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,12 @@ jobs:
2727
needs: export-registry
2828
runs-on: ubuntu-latest
2929
steps:
30-
- uses: actions/checkout@v6.0.2
30+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131
with:
3232
submodules: true
3333
fetch-depth: 0
3434
- name: Publish Helm chart to GitHub Pages
35-
uses: stefanprodan/helm-gh-pages@v1.7.0
35+
uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0
3636
with:
3737
token: ${{ secrets.GITHUB_TOKEN }}
3838
charts_dir: charts
@@ -44,10 +44,10 @@ jobs:
4444
runs-on: ubuntu-latest
4545
steps:
4646
- name: Checkout code
47-
uses: actions/checkout@v6.0.2
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4848

4949
- name: Login to GitHub Container Registry
50-
uses: docker/login-action@v3.6.0
50+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
5151
with:
5252
registry: ${{ env.REGISTRY }}
5353
username: ${{ github.actor }}

‎.github/workflows/ci.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
steps:
2525
- name: Detect No-op Changes
2626
id: noop
27-
uses: fkirc/skip-duplicate-actions@v5.3.1
27+
uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
2828
with:
2929
github_token: ${{ secrets.GITHUB_TOKEN }}
3030
do_not_skip: '["workflow_dispatch", "schedule", "push"]'
@@ -36,12 +36,12 @@ jobs:
3636
if: needs.detect-noop.outputs.noop != 'true'
3737
steps:
3838
- name: Set up Go
39-
uses: actions/setup-go@v6
39+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
4040
with:
4141
go-version: ${{ env.GO_VERSION }}
4242

4343
- name: Check out code into the Go module directory
44-
uses: actions/checkout@v6.0.2
44+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4545

4646
- name: Set up Ginkgo CLI
4747
run: |
@@ -76,7 +76,7 @@ jobs:
7676
KUBEFLEET_CI_TEST_RUNNER_NAME: 'ginkgo'
7777

7878
- name: Upload Codecov report
79-
uses: codecov/codecov-action@v5
79+
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
8080
with:
8181
## Repository upload token - get it from codecov.io. Required only for private repositories
8282
token: ${{ secrets.CODECOV_TOKEN }}
@@ -111,12 +111,12 @@ jobs:
111111
if: needs.detect-noop.outputs.noop != 'true'
112112
steps:
113113
- name: Set up Go
114-
uses: actions/setup-go@v6
114+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
115115
with:
116116
go-version: ${{ env.GO_VERSION }}
117117

118118
- name: Check out code into the Go module directory
119-
uses: actions/checkout@v6.0.2
119+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
120120

121121
- name: Move Docker data directory to /mnt
122122
# The default storage device on GitHub-hosted runners is running low during e2e tests.
@@ -184,7 +184,7 @@ jobs:
184184

185185
- name: Upload logs
186186
if: always()
187-
uses: actions/upload-artifact@v7
187+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
188188
with:
189189
name: e2e-logs-${{ matrix.customized-settings }}
190190
path: test/e2e/logs-${{ matrix.customized-settings }}/

‎.github/workflows/code-lint.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
steps:
2525
- name: Detect No-op Changes
2626
id: noop
27-
uses: fkirc/skip-duplicate-actions@v5.3.1
27+
uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
2828
with:
2929
github_token: ${{ secrets.GITHUB_TOKEN }}
3030
do_not_skip: '["workflow_dispatch", "schedule", "push"]'
@@ -37,12 +37,12 @@ jobs:
3737

3838
steps:
3939
- name: Setup Go
40-
uses: actions/setup-go@v6
40+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
4141
with:
4242
go-version: ${{ env.GO_VERSION }}
4343

4444
- name: Checkout
45-
uses: actions/checkout@v6.0.2
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4646
with:
4747
submodules: true
4848

@@ -58,12 +58,12 @@ jobs:
5858

5959
steps:
6060
- name: Set up Go ${{ env.GO_VERSION }}
61-
uses: actions/setup-go@v6
61+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
6262
with:
6363
go-version: ${{ env.GO_VERSION }}
6464

6565
- name: Check out code into the Go module directory
66-
uses: actions/checkout@v6.0.2
66+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6767

6868
- name: golangci-lint
6969
run: make lint
@@ -76,10 +76,10 @@ jobs:
7676

7777
steps:
7878
- name: Check out code
79-
uses: actions/checkout@v6.0.2
79+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
8080

8181
- name: Set up Helm
82-
uses: azure/setup-helm@v5
82+
uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
8383
with:
8484
version: v3.17.0
8585

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,11 +38,11 @@ jobs:
3838

3939
steps:
4040
- name: Checkout repository
41-
uses: actions/checkout@v6.0.2
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4242

4343
# Initializes the CodeQL tools for scanning.
4444
- name: Initialize CodeQL
45-
uses: github/codeql-action/init@v4
45+
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
4646
with:
4747
languages: ${{ matrix.language }}
4848
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
5656
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
5757
# If this step fails, then you should remove it and run the build manually (see below)
5858
- name: Autobuild
59-
uses: github/codeql-action/autobuild@v4
59+
uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13 # v4
6060

6161
# ℹ️ Command-line programs to run using the OS shell.
6262
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
6969
# ./location_of_script_within_repo/buildscript.sh
7070

7171
- name: Perform CodeQL Analysis
72-
uses: github/codeql-action/analyze@v4
72+
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4

‎.github/workflows/markdown-lint.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ jobs:
1010
markdown-link-check:
1111
runs-on: ubuntu-latest
1212
steps:
13-
- uses: actions/checkout@v6.0.2
14-
- uses: tcort/github-action-markdown-link-check@v1
13+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # v1
1515
with:
1616
# this will only show errors in the output
1717
use-quiet-mode: 'yes'

‎.github/workflows/pr-title-lint.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
check:
1818
runs-on: ubuntu-latest
1919
steps:
20-
- uses: thehanimo/pr-title-checker@v1.4.3
20+
- uses: thehanimo/pr-title-checker@7fbfe05602bdd86f926d3fb3bccb6f3aed43bc70 # v1.4.3
2121
with:
2222
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2323
pass_on_octokit_error: true

‎.github/workflows/release.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Release Images
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
workflow_dispatch:
8+
inputs:
9+
tag:
10+
description: "Release tag (e.g., v1.0.0)"
11+
required: true
12+
type: string
13+
14+
permissions:
15+
contents: read
16+
packages: write
17+
18+
env:
19+
REGISTRY: ghcr.io
20+
HUB_AGENT_IMAGE_NAME: hub-agent
21+
MEMBER_AGENT_IMAGE_NAME: member-agent
22+
REFRESH_TOKEN_IMAGE_NAME: refresh-token
23+
GO_VERSION: "1.25.8"
24+
25+
jobs:
26+
export-registry:
27+
uses: ./.github/workflows/setup-release.yml
28+
with:
29+
tag: ${{ inputs.tag || github.ref_name }}
30+
31+
build-and-publish:
32+
needs: export-registry
33+
env:
34+
REGISTRY: ${{ needs.export-registry.outputs.registry }}
35+
TAG: ${{ needs.export-registry.outputs.tag }}
36+
runs-on: ubuntu-latest
37+
steps:
38+
- name: Set up Go ${{ env.GO_VERSION }}
39+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
40+
with:
41+
go-version: ${{ env.GO_VERSION }}
42+
43+
- name: Checkout code
44+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
45+
with:
46+
ref: ${{ needs.export-registry.outputs.tag }}
47+
48+
- name: Login to ghcr.io
49+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
50+
with:
51+
registry: ghcr.io
52+
username: ${{ github.actor }}
53+
password: ${{ secrets.GITHUB_TOKEN }}
54+
55+
- name: Build and push images with tag ${{ env.TAG }}
56+
run: |
57+
make push
58+
59+
- name: Tag and push images without v prefix
60+
env:
61+
VERSION: ${{ needs.export-registry.outputs.version }}
62+
run: |
63+
for IMAGE in ${{ env.HUB_AGENT_IMAGE_NAME }} ${{ env.MEMBER_AGENT_IMAGE_NAME }} ${{ env.REFRESH_TOKEN_IMAGE_NAME }}; do
64+
docker buildx imagetools create \
65+
--tag "${{ env.REGISTRY }}/${IMAGE}:${VERSION}" \
66+
"${{ env.REGISTRY }}/${IMAGE}:${{ env.TAG }}"
67+
done
68+
69+
- name: Verify images
70+
env:
71+
VERSION: ${{ needs.export-registry.outputs.version }}
72+
run: |
73+
echo "✅ Published images:"
74+
echo " - ${{ env.REGISTRY }}/${{ env.HUB_AGENT_IMAGE_NAME }}:${{ env.TAG }}"
75+
echo " - ${{ env.REGISTRY }}/${{ env.HUB_AGENT_IMAGE_NAME }}:${VERSION}"
76+
echo " - ${{ env.REGISTRY }}/${{ env.MEMBER_AGENT_IMAGE_NAME }}:${{ env.TAG }}"
77+
echo " - ${{ env.REGISTRY }}/${{ env.MEMBER_AGENT_IMAGE_NAME }}:${VERSION}"
78+
echo " - ${{ env.REGISTRY }}/${{ env.REFRESH_TOKEN_IMAGE_NAME }}:${{ env.TAG }}"
79+
echo " - ${{ env.REGISTRY }}/${{ env.REFRESH_TOKEN_IMAGE_NAME }}:${VERSION}"

‎.github/workflows/trivy.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,12 @@ jobs:
3939
runs-on: ubuntu-latest #Latest tag points to the latest LTS release of Ubuntu per docker hub
4040
steps:
4141
- name: Set up Go ${{ env.GO_VERSION }}
42-
uses: actions/setup-go@v6
42+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
4343
with:
4444
go-version: ${{ env.GO_VERSION }}
4545

4646
- name: Checkout code
47-
uses: actions/checkout@v6.0.2
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4848

4949
- name: Login to ${{ env.REGISTRY }}
5050
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
@@ -64,7 +64,7 @@ jobs:
6464
TAG: ${{ env.IMAGE_VERSION }}
6565

6666
- name: Scan ${{ env.REGISTRY }}/${{ env.HUB_AGENT_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
67-
uses: aquasecurity/trivy-action@master
67+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
6868
with:
6969
image-ref: ${{ env.REGISTRY }}/${{ env.HUB_AGENT_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
7070
format: 'table'
@@ -80,7 +80,7 @@ jobs:
8080

8181

8282
- name: Scan ${{ env.REGISTRY }}/${{ env.MEMBER_AGENT_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
83-
uses: aquasecurity/trivy-action@master
83+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
8484
with:
8585
image-ref: ${{ env.REGISTRY }}/${{ env.MEMBER_AGENT_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
8686
format: 'table'
@@ -95,7 +95,7 @@ jobs:
9595
TRIVY_DB_REPOSITORY: mcr.microsoft.com/mirror/ghcr/aquasecurity/trivy-db
9696

9797
- name: Scan ${{ env.REGISTRY }}/${{ env.REFRESH_TOKEN_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
98-
uses: aquasecurity/trivy-action@master
98+
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
9999
with:
100100
image-ref: ${{ env.REGISTRY }}/${{ env.REFRESH_TOKEN_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
101101
format: 'table'

‎.github/workflows/upgrade.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
steps:
2828
- name: Detect No-op Changes
2929
id: noop
30-
uses: fkirc/skip-duplicate-actions@v5.3.1
30+
uses: fkirc/skip-duplicate-actions@f75f66ce1886f00957d99748a42c724f4330bdcf # v5.3.1
3131
with:
3232
github_token: ${{ secrets.GITHUB_TOKEN }}
3333
do_not_skip: '["workflow_dispatch", "schedule", "push"]'
@@ -39,12 +39,12 @@ jobs:
3939
if: needs.detect-noop.outputs.noop != 'true'
4040
steps:
4141
- name: Set up Go
42-
uses: actions/setup-go@v6
42+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
4343
with:
4444
go-version: ${{ env.GO_VERSION }}
4545

4646
- name: Check out code into the Go module directory
47-
uses: actions/checkout@v6.0.2
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4848
with:
4949
# Fetch the history of all branches and tags.
5050
# This is needed for the test suite to switch between releases.
@@ -141,12 +141,12 @@ jobs:
141141
if: needs.detect-noop.outputs.noop != 'true'
142142
steps:
143143
- name: Set up Go
144-
uses: actions/setup-go@v6
144+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
145145
with:
146146
go-version: ${{ env.GO_VERSION }}
147147

148148
- name: Check out code into the Go module directory
149-
uses: actions/checkout@v6.0.2
149+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
150150
with:
151151
# Fetch the history of all branches and tags.
152152
# This is needed for the test suite to switch between releases.
@@ -243,12 +243,12 @@ jobs:
243243
if: needs.detect-noop.outputs.noop != 'true'
244244
steps:
245245
- name: Set up Go
246-
uses: actions/setup-go@v6
246+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
247247
with:
248248
go-version: ${{ env.GO_VERSION }}
249249

250250
- name: Check out code into the Go module directory
251-
uses: actions/checkout@v6.0.2
251+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
252252
with:
253253
# Fetch the history of all branches and tags.
254254
# This is needed for the test suite to switch between releases.

0 commit comments

Comments
 (0)