Align files

.github/workflows/zz_generated.add-team-labels.yaml

@@ -21,7 +21,7 @@ jobs:
           | jq -r '.content' \
           | base64 -d > artifacts/users.yaml
     - name: Upload Artifact
-      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: users
         path: artifacts/users.yaml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: build_user_list
     steps:
-    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       id: download-users
       with:
         name: users
@@ -51,7 +51,7 @@ jobs:
         echo "EOF" >> $GITHUB_ENV
     - name: Apply label to issue
       if: ${{ env.LABEL != '' && env.LABEL != 'null' && env.LABEL != null }}
-      uses: actions-ecosystem/action-add-labels@bd52874380e3909a1ac983768df6976535ece7f8  # v1.1.3
+      uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf  # v1.1.3
       with:
         github_token: ${{ secrets.ISSUE_AUTOMATION }}
         labels: |

.github/workflows/zz_generated.add-to-project-board.yaml

@@ -23,7 +23,7 @@ jobs:
           | jq -r '.content' \
           | base64 -d > artifacts/users.yaml
     - name: Upload Artifact
-      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: users
         path: artifacts/users.yaml
@@ -38,7 +38,7 @@ jobs:
           | jq -r '.content' \
           | base64 -d > artifacts/labels.yaml
     - name: Upload Artifact
-      uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: labels
         path: artifacts/labels.yaml
@@ -50,7 +50,7 @@ jobs:
     needs: build_user_list
     if: github.event.action == 'assigned'
     steps:
-    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       id: download-users
       with:
         name: users
@@ -65,7 +65,7 @@ jobs:
         echo "BOARD=${BOARD}" >> $GITHUB_ENV
     - name: Add issue to personal board
       if: ${{ env.BOARD != 'null' && env.BOARD != ''  && env.BOARD != null }}
-      uses: actions/add-to-project@9bfe908f2eaa7ba10340b31e314148fcfe6a2458 # v1.0.1
+      uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
       with:
         project-url: ${{ env.BOARD }}
         github-token: ${{ secrets.ISSUE_AUTOMATION }}
@@ -76,7 +76,7 @@ jobs:
     needs: build_user_list
     if: github.event.action == 'labeled'
     steps:
-    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e  # v4.1.7
+    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
       id: download-labels
       with:
         name: labels
@@ -91,7 +91,7 @@ jobs:
         echo "BOARD=${BOARD}" >> $GITHUB_ENV
     - name: Add issue to team board
       if: ${{ env.BOARD != 'null' && env.BOARD != '' && env.BOARD != null }}
-      uses: actions/add-to-project@9bfe908f2eaa7ba10340b31e314148fcfe6a2458 # v1.0.1
+      uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
       with:
         project-url: ${{ env.BOARD }}
         github-token: ${{ secrets.ISSUE_AUTOMATION }}

.github/workflows/zz_generated.create_release.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/0df8c5e633bb1e4fd17c35525a7b382395526f22/pkg/gen/input/workflows/internal/file/create_release.yaml.template
+#    https://github.com/giantswarm/devctl/blob/c4c2f6f84e7bc84f838669bce868465c16ae53fb/pkg/gen/input/workflows/internal/file/create_release.yaml.template
 #
 name: Create Release
 
@@ -22,7 +22,6 @@ jobs:
   create-release:
     uses: giantswarm/github-workflows/.github/workflows/create-release.yaml@main
     with:
-      build-release-artifacts: false
       fetch-deep-gitlog-for-build: true
     secrets:
       TAYLORBOT_GITHUB_ACTION: ${{ secrets.TAYLORBOT_GITHUB_ACTION }}

.github/workflows/zz_generated.create_release_pr.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template
+#    https://github.com/giantswarm/devctl/blob/9731fd539b9bb5903efde223d34137756dab107f/pkg/gen/input/workflows/internal/file/create_release_pr.yaml.template
 #
 name: Create Release PR
 on:
@@ -13,14 +13,29 @@ on:
       - 'main#release#major'
       - 'main#release#minor'
       - 'main#release#patch'
+      - 'main#release#major-rc'
+      - 'main#release#minor-rc'
+      - 'main#release#patch-rc'
+      - 'main#release#rc'
+      - 'main#release#rc-release'
       - 'master#release#v*.*.*'
       - 'master#release#major'
       - 'master#release#minor'
       - 'master#release#patch'
+      - 'master#release#major-rc'
+      - 'master#release#minor-rc'
+      - 'master#release#patch-rc'
+      - 'master#release#rc'
+      - 'master#release#rc-release'
       - 'release#v*.*.*'
       - 'release#major'
       - 'release#minor'
       - 'release#patch'
+      - 'release#major-rc'
+      - 'release#minor-rc'
+      - 'release#patch-rc'
+      - 'release#rc'
+      - 'release#rc-release'
       - 'release-v*.*.x#release#v*.*.*'
       # "!" negates previous positive patterns so it has to be at the end.
       - '!release-v*.x.x#release#v*.*.*'

.github/workflows/zz_generated.fix_vulnerabilities.yaml

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/6ff4d7652142f59436c1d1ef925f8d687e1ac671/pkg/gen/input/workflows/internal/file/fix_vulnerabilities.yaml.template
+#    https://github.com/giantswarm/devctl/blob/8d8b9dbd820fc286616891556b0ed5299130ee30/pkg/gen/input/workflows/internal/file/fix_vulnerabilities.yaml.template
 #
 
 name: Fix Go vulnerabilities
@@ -14,11 +14,12 @@ on:
     inputs:
       branch:
         description: Branch on which to fix vulnerabilities
+        default: main
         required: true
         type: string
       log_level:
         description: Log Level (info / error / debug)
-        default: "info"
+        default: info
         type: string
 
 permissions: {}

.github/workflows/zz_generated.gitleaks.yaml

@@ -2,12 +2,13 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/87f30fd3b955a0daf6017834a776c222d93a207c/pkg/gen/input/workflows/internal/file/gitleaks.yaml.template
+#    https://github.com/giantswarm/devctl/blob/3dc3a7c589ba8beeac28039d88572be2aaa07319/pkg/gen/input/workflows/internal/file/gitleaks.yaml.template
 #
 name: gitleaks
 
 on:
   - pull_request
+  - merge_group
 
 permissions: {}
 

.github/workflows/zz_generated.semantic_pull_request.yaml

@@ -0,0 +1,22 @@
+# DO NOT EDIT. Generated with:
+#
+#    devctl
+#
+#    https://github.com/giantswarm/devctl/blob/814a91071850fc945ec1d58f92b761156ad7edb4/pkg/gen/input/workflows/internal/file/semantic_pull_request.yaml.template
+#
+name: semantic-pull-request
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - synchronize
+
+permissions: {}
+
+jobs:
+  semantic-pull-request:
+    uses: giantswarm/github-workflows/.github/workflows/semantic-pull-request.yaml@main
+    permissions:
+      pull-requests: read

.yamllint.yaml

@@ -0,0 +1,8 @@
+---
+extends: default
+rules:
+  comments:
+    min-spaces-from-content: 1
+  document-start: disable
+  line-length:
+    max: 200

Makefile

@@ -2,7 +2,7 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/6a704f7e2a8b0f09e82b5bab88f17971af849711/pkg/gen/input/makefile/internal/file/Makefile.template
+#    https://github.com/giantswarm/devctl/blob/c0a255e412bf450e122f71e563d74a9bd9f9cddf/pkg/gen/input/makefile/internal/file/Makefile.template
 #
 
 include Makefile.*.mk
@@ -22,4 +22,4 @@ include Makefile.*.mk
 
 .PHONY: help
 help: ## Display this help.
-	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z%\\\/_0-9-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
+	@awk 'BEGIN {FS = ":.*##"; n = 0; w = 0} /^[a-zA-Z%\\\/_0-9-]+:.*?##/ { order[n] = "t"; targets[n] = $$1; descs[n] = $$2; if (length($$1) > w) w = length($$1); n++ } /^##@/ { order[n] = "c"; cats[n] = substr($$0, 5); n++ } END { printf "\nUsage:\n  make \033[36m<target>\033[0m\n"; for (i = 0; i < n; i++) { if (order[i] == "c") printf "\n\033[1m%s\033[0m\n", cats[i]; else printf "  \033[36m%-*s\033[0m  %s\n", w, targets[i], descs[i] } }' $(MAKEFILE_LIST)

Makefile.gen.go.mk

@@ -2,22 +2,25 @@
 #
 #    devctl
 #
-#    https://github.com/giantswarm/devctl/blob/bf7f386ac6a4e807dde959892df1369fee6d789f/pkg/gen/input/makefile/internal/file/Makefile.gen.go.mk.template
+#    https://github.com/giantswarm/devctl/blob/0ec3e49745962245bdd6d5c282d4272c40faec37/pkg/gen/input/makefile/internal/file/Makefile.gen.go.mk.template
 #
 
 APPLICATION    := $(shell go list -m | cut -d '/' -f 3)
 BUILDTIMESTAMP := $(shell date -u '+%FT%TZ')
 GITSHA1        := $(shell git rev-parse --verify HEAD)
 MODULE         := $(shell go list -m)
+# main() is usually in `main.go`, but sometimes in `cmd/main.go` (for example in newer kubebuilder projects)
+MAIN_SOURCE    := $(shell if test -e cmd/main.go; then echo cmd/main.go; else echo main.go; fi)
 OS             := $(shell go env GOOS)
 SOURCES        := $(shell find . -name '*.go')
-VERSION        := $(shell architect project version)
+VERSION        := $(shell gitsemver get)
 ifeq ($(OS), linux)
 EXTLDFLAGS := -static
 endif
 LDFLAGS        ?= -w -linkmode 'auto' -extldflags '$(EXTLDFLAGS)' \
-  -X '$(shell go list -m)/pkg/project.buildTimestamp=${BUILDTIMESTAMP}' \
-  -X '$(shell go list -m)/pkg/project.gitSHA=${GITSHA1}'
+  -X '$(MODULE)/pkg/project.version=$(VERSION)' \
+  -X '$(MODULE)/pkg/project.buildTimestamp=$(BUILDTIMESTAMP)' \
+  -X '$(MODULE)/pkg/project.gitSHA=$(GITSHA1)'
 
 .DEFAULT_GOAL := build
 
@@ -63,25 +66,25 @@ $(APPLICATION)-windows-amd64.exe: $(APPLICATION)-v$(VERSION)-windows-amd64.exe
 
 $(APPLICATION)-v$(VERSION)-%-amd64: $(SOURCES)
 	@echo "====> $@"
-	CGO_ENABLED=0 GOOS=$* GOARCH=amd64 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ .
+	CGO_ENABLED=0 GOOS=$* GOARCH=amd64 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ "$(MAIN_SOURCE)"
 
 $(APPLICATION)-v$(VERSION)-%-arm64: $(SOURCES)
 	@echo "====> $@"
-	CGO_ENABLED=0 GOOS=$* GOARCH=arm64 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ .
+	CGO_ENABLED=0 GOOS=$* GOARCH=arm64 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ "$(MAIN_SOURCE)"
 
 $(APPLICATION)-v$(VERSION)-windows-amd64.exe: $(SOURCES)
 	@echo "====> $@"
-	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ .
+	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -trimpath -ldflags "$(LDFLAGS)" -o $@ "$(MAIN_SOURCE)"
 
 .PHONY: install
 install: ## Install the application.
 	@echo "====> $@"
-	go install -ldflags "$(LDFLAGS)" .
+	go build -ldflags "$(LDFLAGS)" -o "$(shell go env GOPATH)/bin/$(APPLICATION)" "$(MAIN_SOURCE)"
 
 .PHONY: run
 run: ## Runs go run main.go.
 	@echo "====> $@"
-	go run -ldflags "$(LDFLAGS)" -race .
+	go run -ldflags "$(LDFLAGS)" -race "$(MAIN_SOURCE)"
 
 .PHONY: clean
 clean: ## Cleans the binary.
@@ -110,12 +113,17 @@ vet: ## Run go vet against code.
 .PHONY: nancy
 nancy: ## Runs nancy (requires v1.0.37 or newer).
 	@echo "====> $@"
-	CGO_ENABLED=0 go list -json -deps ./... | nancy sleuth --skip-update-check --quiet --exclude-vulnerability-file ./.nancy-ignore --additional-exclude-vulnerability-files ./.nancy-ignore.generated
+	CGO_ENABLED=0 go list -json -m all | nancy sleuth --skip-update-check --quiet --exclude-vulnerability-file ./.nancy-ignore --additional-exclude-vulnerability-files ./.nancy-ignore.generated
+
+# Race detector needs a C toolchain. The architect CI image has none and runs
+# with CGO_ENABLED=0, so degrade to cgo-free there; everywhere a compiler exists
+# (laptops, coding agents, GitHub Actions, any cgo-capable runner) keeps -race.
+RACE := $(shell { [ "$${CGO_ENABLED:-1}" != "0" ] && { command -v gcc || command -v clang; } >/dev/null 2>&1; } && echo -race)
 
 .PHONY: test
-test: ## Runs go test with default values.
+test: ## Runs go test with default values (race detector when a C toolchain is available).
 	@echo "====> $@"
-	go test -ldflags "$(LDFLAGS)" -race ./...
+	go test -ldflags "$(LDFLAGS)" $(RACE) ./...
 
 .PHONY: build-docker
 build-docker: build-linux ## Builds docker image to registry.