Merge branch 'v8' into hash-based-v8

Author: b1tamara

.github/CONTRIBUTING.md

@@ -33,11 +33,11 @@ After reaching out to the CLI team and the conclusion is to make a PR, please fo
    [Product Style Guide](https://github.com/cloudfoundry/cli/wiki/CLI-Product-Specific-Style-Guide),
    and [Internationalization Guide](https://github.com/cloudfoundry/cli/wiki/Internationalization-Guide).
 1. Fork the project repository.
-1. Create a feature branch from the earliest branch that's [appropriate for your change](#cli-versions) (e.g. `git checkout v7 && git checkout -b better_cli`) and make changes on this branch
+1. Create a feature branch from the earliest branch that's [appropriate for your change](#cli-versions) (e.g. `git checkout v8 && git checkout -b v8_better_cli`) and make changes on this branch
    * Follow the other sections on this page to [set up your development environment](#development-environment-setup), [build `cf`](#building-the-cf-binary) and [run the tests](#testing).
    * Tests are required for any changes.
-1. Push to your fork (e.g. `git push origin better_cli`) and [submit a pull request](https://help.github.com/articles/creating-a-pull-request)
-1. The cf CLI team will merge your changes from the versioned branch (e.g. v7) to master for you after the PR is merged.
+1. Push to your fork (e.g. `git push origin v8_better_cli`) and [submit a pull request](https://help.github.com/articles/creating-a-pull-request)
+1. The cf CLI team will merge your PR after review.
 
 Note: All contributions must be sent using GitHub Pull Requests.
 We prefer a small, focused pull request with a clear message
@@ -97,12 +97,9 @@ how to cross compile binaries for other architectures.
 To run the unit tests:
 ```bash
 cd cli
-make units-full # will run all unit tests
-make units # runs all non-cf directory unit tests
+make units
 ```
-
-**Note: `make units-full` is recommended over `make units` if you are unsure of
-how wide-reaching the intended changes are.**
+(For historic reasons, there are multiple synonyms in the `Makefile`.)
 
 ## Running the Integration tests
 

.github/ops-files/increase-max-service-credential-bindings.yml

@@ -0,0 +1,6 @@
+# Enable service binding rotation feature
+# See https://github.com/cloudfoundry/community/blob/main/toc/rfc/rfc-0040-service-binding-rotation.md#cf-cli
+---
+- type: replace
+  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/cc/max_service_credential_bindings_per_app_service_instance?
+  value: 2

.github/ops-files/use-latest-capi.yml

@@ -8,3 +8,6 @@
 
 - type: remove
   path: /releases/name=capi/sha1?
+
+- type: remove
+  path: /releases/name=capi/stemcell?

.github/workflows/check-cves.yml

@@ -26,7 +26,7 @@ jobs:
       if: always()
 
     - name: Archive CVE scan results
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       if: always()
       with:
         name: cve-scan-results-${{ github.sha }}-${{ github.run_id }}-${{ github.run_number }}

.github/workflows/create-bosh-lite.yml

@@ -122,16 +122,15 @@ jobs:
           
           env_name="${{ steps.setup-bbl-env.outputs.envName }}"
           cd $env_name/bbl-state
-          eval "$(bbl print-env)"
+          eval "$(bbl print-env --shell-type posix)"
           
-          jq -r .bosh.jumpbox_private_key metadata.json > /tmp/${env_name}.priv
-
           bosh upload-release "https://bosh.io/d/github.com/cloudfoundry/capi-release?v=$capi_release_version"          
       - name: Deploy cf
         run: |
           env_name="${{ steps.setup-bbl-env.outputs.envName }}"
           cd $env_name/bbl-state
-          eval "$(bbl print-env)"
+          eval "$(bbl print-env --shell-type posix)"
+
           bosh update-runtime-config ${GITHUB_WORKSPACE}/bosh-deployment/runtime-configs/dns.yml --name dns
           STEMCELL_VERSION=$(bosh interpolate ${GITHUB_WORKSPACE}/cf-deployment/cf-deployment.yml --path /stemcells/alias=default/version)
           bosh upload-stemcell "https://bosh.io/d/stemcells/bosh-warden-boshlite-ubuntu-jammy-go_agent?v=${STEMCELL_VERSION}"
@@ -152,6 +151,7 @@ jobs:
           -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/add-uaa-client-credentials.yml \
           -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/increase-route-registration-interval.yml \
           -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/add-oidc-provider.yml ${additional_args} \
+          -o ${GITHUB_WORKSPACE}/cli/.github/ops-files/increase-max-service-credential-bindings.yml \
           -v client-secret="${{ secrets.CLIENT_SECRET }}" \
           -v system_domain=${SYSTEM_DOMAIN} \
           > ./director.yml
@@ -162,10 +162,10 @@ jobs:
         if: failure()
         run: |
           env_name="${{ steps.setup-bbl-env.outputs.envName }}"
-          if [ -d ${env_name}/bbl_state ]; then
+          if [ -d ${env_name}/bbl-state ]; then
             cd ${env_name}/bbl-state
-            eval "$(bbl print-env)"
-            
+            eval "$(bbl print-env --shell-type posix)"
+
             echo "Deleting env ${env_name}"
             bbl down --no-confirm --gcp-service-account-key=key.json
 
@@ -174,4 +174,4 @@ jobs:
               gsutil rm -R gs://cf-cli-bosh-lites/${env_name} 
             fi
           fi
-          
+

.github/workflows/delete-bosh-lite.yml

@@ -71,7 +71,7 @@ jobs:
       - name: delete bosh
         run: |
           cd ${ENV_NAME}/bbl-state
-          eval "$(bbl print-env)"
+          eval "$(bbl print-env --shell-type posix)"
           
           echo "Deleting env ${ENV_NAME}"
           echo ${BBL_GCP_SERVICE_ACCOUNT_KEY} > key.json

.github/workflows/release-build-sign-upload.yml

@@ -151,7 +151,7 @@ jobs:
         go env
 
     - name: Go Assets Cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ${{ steps.go-cache-paths.outputs.go-mod }}
@@ -169,7 +169,7 @@ jobs:
         make out/cf-cli_linux_arm64
 
     - name: Store Linux Binaries
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: cf-cli-linux-binaries
@@ -274,7 +274,7 @@ jobs:
       working-directory: signed-redhat-installer
 
     - name: Store Signed Linux RPM Packages
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: cf-cli-linux-rpm-packages
@@ -375,7 +375,7 @@ jobs:
       working-directory: packaged-deb
 
     - name: Store Debian Packages
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: cf-cli-linux-deb-packages
@@ -428,7 +428,7 @@ jobs:
         cat "$(brew --repository)/Library/Taps/pivotalsoftware/homebrew-gon/gon.rb" > .github/brew-formulae
 
     - name: Configure Homebrew cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ~/Library/Caches/Homebrew/gon--*
@@ -448,7 +448,7 @@ jobs:
         go env
 
     - name: Go Assets Cache
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: |
           ${{ steps.go-cache-paths.outputs.go-mod }}
@@ -465,7 +465,7 @@ jobs:
         make out/cf-cli_macosarm
 
     - name: Store macOS Binaries
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: cf-cli-macos-binaries
@@ -604,7 +604,7 @@ jobs:
           "signed-macos-installer/cf${VERSION_MAJOR}-cli-installer_${VERSION_BUILD}_macosarm.pkg"
 
     - name: Store macOS Signed Packages
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: cf-cli-macos-packages
@@ -690,7 +690,7 @@ jobs:
           New-Item -ItemType SymbolicLink -Target .\out\cf-cli_winx64.exe -Path .\out\cf-cli_winx64-link.exe
 
       - name: Save signed binaries as a GitHub Action Artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: cf-cli-windows-binaries
           if-no-files-found: error
@@ -735,7 +735,7 @@ jobs:
           Get-ChildItem "${env:RUNNER_TEMP}"
 
       - name: Save installer and dist files as a GitHub Action Artifact
-        uses: actions/upload-artifact@v5
+        uses: actions/upload-artifact@v7
         with:
           name: cf-cli-windows-packages
           if-no-files-found: error
@@ -770,7 +770,7 @@ jobs:
       uses: actions/checkout@v6
 
     - name: Download signed artifacts
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         path: signed # download all artifacts to 'signed/'
 
@@ -856,14 +856,14 @@ jobs:
           signed/winx64/*zip
 
     - name: Store Artifacts
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: final-artifacts
         path: signed/*          
 
     - name: Setup aws to upload installers to CLAW S3 bucket
-      uses: aws-actions/configure-aws-credentials@v5
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         aws-access-key-id:     ${{ vars.AWS_ACCESS_KEY_ID }}
         aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY  }}
@@ -889,7 +889,7 @@ jobs:
     steps:
 
     - name: Download Signed Linux Packages
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: cf-cli-linux-rpm-packages
 
@@ -916,7 +916,7 @@ jobs:
     steps:
 
     - name: Download Signed Linux Packages
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: cf-cli-linux-deb-packages
 
@@ -944,7 +944,7 @@ jobs:
     steps:
 
     - name: Download Signed macOS Packages
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: cf-cli-macos-packages
 
@@ -968,7 +968,7 @@ jobs:
     steps:
 
     - name: Download Signed Windows Binaries
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: cf-cli-windows-binaries
 
@@ -978,7 +978,7 @@ jobs:
         Get-AuthenticodeSignature -Verbose -ErrorAction Stop .\cf-cli_winx64.exe
 
     - name: Download Signed Windows Binaries
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: cf-cli-windows-packages
 
@@ -1008,7 +1008,7 @@ jobs:
     - s3-upload
     steps:
     - name: Download signed artifacts
-      uses: actions/download-artifact@v6
+      uses: actions/download-artifact@v8
       with:
         name: final-artifacts
         path: ${{ env.ARTIFACTS_DIR }}

.github/workflows/release-update-repos.yml

@@ -385,7 +385,7 @@ jobs:
     #     ls -R
     #
     # - name: Backup current Linux RPM repodata
-    #   uses: actions/upload-artifact@v5
+    #   uses: actions/upload-artifact@v7
     #   with:
     #     if-no-files-found: error
     #     name: cf-cli-linux-rpm-repodata-backup
@@ -403,7 +403,7 @@ jobs:
         && pip3 install awscli
 
     - name: Setup aws to upload installers to CLAW S3 bucket
-      uses: aws-actions/configure-aws-credentials@v5
+      uses: aws-actions/configure-aws-credentials@v6
       with:
         aws-access-key-id:     ${{ vars.AWS_ACCESS_KEY_ID }}
         aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -428,7 +428,7 @@ jobs:
       run: ls -R
 
     - name: Store Linux RPM repodata
-      uses: actions/upload-artifact@v5
+      uses: actions/upload-artifact@v7
       with:
         if-no-files-found: error
         name: cf-cli-linux-rpm-repodata
@@ -592,13 +592,13 @@ jobs:
         ref: ${{ github.ref_name }}
 
     - name: Login to Docker Hub
-      uses: docker/login-action@v3
+      uses: docker/login-action@v4
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
 
     - name: Build and export to Docker locally
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@v7
       with:
         context: docker
         load: true
@@ -636,7 +636,7 @@ jobs:
         rm test.sh
 
     - name: Push image 
-      uses: docker/build-push-action@v6
+      uses: docker/build-push-action@v7
       with:
         context: docker
         push: true

.github/workflows/tests-integration-reusable.yml

@@ -18,8 +18,8 @@ on:
 
 env:
   ENV_NAME: ${{ inputs.env-name }}
-  NODES: 12
-  FLAKE_ATTEMPTS: ${{ vars.TEST_FLAKE_ATTEMPTS || '4' }}
+  NODES: 4
+  FLAKE_ATTEMPTS: ${{ vars.TEST_FLAKE_ATTEMPTS || '5' }}
   BBL_CLI_VERSION: ${{ vars.BBL_CLI_VERSION }}
   BOSH_CLI_VERSION: ${{ vars.BOSH_CLI_VERSION }}
   CREDHUB_CLI_VERSION: ${{ vars.CREDHUB_CLI_VERSION }}
@@ -88,7 +88,7 @@ jobs:
       if: ${{ !inputs.run-with-client-creds }}
       run: |
         pushd ./${ENV_NAME}/bbl-state
-          eval "$(bbl print-env)"
+          eval "$(bbl print-env --shell-type posix)"
         popd
 
         cd cli
@@ -119,7 +119,7 @@ jobs:
         CF_INT_CLIENT_SECRET: ${{ secrets.CLIENT_SECRET }}
       run: |
         pushd ./${ENV_NAME}/bbl-state
-          eval "$(bbl print-env)"
+          eval "$(bbl print-env --shell-type posix)"
         popd
 
         cd cli

.github/workflows/tests-integration.yml

@@ -120,11 +120,13 @@ jobs:
     needs:
       - get-sha
       - set-env-name
+      - run-integration-tests-cf-env
     if: ${{ 
       always() && 
       needs.set-env-name.result == 'success' && 
       (github.event_name != 'workflow_dispatch' || inputs.workflow == 'all' ||
-       inputs.workflow == 'run-integration-tests-cf-env-with-client-creds') }}
+       inputs.workflow == 'run-integration-tests-cf-env-with-client-creds') &&
+      needs.run-integration-tests-cf-env.result != 'failure' }}
     uses: ./.github/workflows/tests-integration-reusable.yml
     with:
       name: Integration client creds