Skip to content

Commit e3ca295

Browse files
adwk67adwk67
committed
Merge branch 'main' into refactor/remove-product-config
2 parents 94ce2bb + bb2b0c5 commit e3ca295

10 files changed

Lines changed: 161 additions & 27 deletions

File tree

‎.github/workflows/build.yaml‎

Lines changed: 119 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848

4949
- name: Check for changed files
5050
id: check
51-
uses: stackabletech/actions/detect-changes@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
51+
uses: stackabletech/actions/detect-changes@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
5252
with:
5353
patterns: |
5454
- '.github/workflows/build.yaml'
@@ -83,9 +83,8 @@ jobs:
8383
submodules: recursive
8484

8585
- name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
86-
uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
87-
with:
88-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
86+
shell: bash
87+
run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
8988

9089
- name: Setup Rust Cache
9190
uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
@@ -160,22 +159,21 @@ jobs:
160159
uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
161160

162161
- name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
163-
uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
164-
with:
165-
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
162+
shell: bash
163+
run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
166164

167165
- name: Build Container Image
168166
id: build
169-
uses: stackabletech/actions/build-container-image@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
167+
uses: stackabletech/actions/build-container-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
170168
with:
171169
image-name: ${{ env.OPERATOR_NAME }}
172170
image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
173171
build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
174172
container-file: docker/Dockerfile
175173

176-
- name: Publish Container Image
174+
- name: Publish Container Image to oci.stackable.tech
177175
if: ${{ !github.event.pull_request.head.repo.fork }}
178-
uses: stackabletech/actions/publish-image@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
176+
uses: stackabletech/actions/publish-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
179177
with:
180178
image-registry-uri: oci.stackable.tech
181179
image-registry-username: robot$sdp+github-action-build
@@ -184,6 +182,17 @@ jobs:
184182
image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
185183
source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
186184

185+
- name: Publish Container Image to quay.io
186+
if: ${{ !github.event.pull_request.head.repo.fork }}
187+
uses: stackabletech/actions/publish-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
188+
with:
189+
image-registry-uri: quay.io
190+
image-registry-username: stackable+robot_sdp_github_action_build
191+
image-registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
192+
image-repository: stackable/sdp/${{ env.OPERATOR_NAME }}
193+
image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
194+
source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
195+
187196
publish-index-manifest:
188197
name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
189198
if: |
@@ -196,21 +205,93 @@ jobs:
196205
permissions:
197206
id-token: write
198207
runs-on: ubuntu-latest
208+
outputs:
209+
oci-index-digest: ${{ steps.publish-oci.outputs.image-index-manifest-digest }}
210+
quay-index-digest: ${{ steps.publish-quay.outputs.image-index-manifest-digest }}
199211
steps:
200212
- name: Checkout Repository
201213
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
202214
with:
203215
persist-credentials: false
204216

205-
- name: Publish and Sign Image Index
206-
uses: stackabletech/actions/publish-image-index-manifest@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
217+
- name: Publish and Sign Image Index to oci.stackable.tech
218+
id: publish-oci
219+
uses: stackabletech/actions/publish-image-index-manifest@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
207220
with:
208221
image-registry-uri: oci.stackable.tech
209222
image-registry-username: robot$sdp+github-action-build
210223
image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
211224
image-repository: sdp/${{ env.OPERATOR_NAME }}
212225
image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
213226

227+
- name: Publish and Sign Image Index to quay.io
228+
id: publish-quay
229+
uses: stackabletech/actions/publish-image-index-manifest@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
230+
with:
231+
image-registry-uri: quay.io
232+
image-registry-username: stackable+robot_sdp_github_action_build
233+
image-registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
234+
image-repository: stackable/sdp/${{ env.OPERATOR_NAME }}
235+
image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
236+
237+
# Generate SLSA build provenance for the multi-arch image index and attach it
238+
# to the published image in each registry. The reusable workflow signs the
239+
# provenance with keyless signing (GitHub Actions as the OIDC identity) and
240+
# pushes the attestation next to the image.
241+
provenance-oci:
242+
name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (oci.stackable.tech)
243+
if: |
244+
(github.event_name != 'merge_group')
245+
&& needs.detect-changes.outputs.detected == 'true'
246+
&& !github.event.pull_request.head.repo.fork
247+
needs:
248+
- detect-changes
249+
- build-container-image
250+
- publish-index-manifest
251+
permissions:
252+
actions: read # detect the build workflow that generated the image
253+
id-token: write # mint the OIDC token for keyless signing
254+
packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
255+
# MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
256+
# workflow cannot verify its own provenance.
257+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
258+
with:
259+
# The 'env' context is not available in job-level 'with' inputs of
260+
# reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME
261+
# can't be used here and the operator name is templated in directly.
262+
image: oci.stackable.tech/sdp/zookeeper-operator
263+
digest: ${{ needs.publish-index-manifest.outputs.oci-index-digest }}
264+
registry-username: robot$sdp+github-action-build
265+
secrets:
266+
registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
267+
268+
provenance-quay:
269+
name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (quay.io)
270+
if: |
271+
(github.event_name != 'merge_group')
272+
&& needs.detect-changes.outputs.detected == 'true'
273+
&& !github.event.pull_request.head.repo.fork
274+
needs:
275+
- detect-changes
276+
- build-container-image
277+
- publish-index-manifest
278+
permissions:
279+
actions: read # detect the build workflow that generated the image
280+
id-token: write # mint the OIDC token for keyless signing
281+
packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
282+
# MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
283+
# workflow cannot verify its own provenance.
284+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
285+
with:
286+
# The 'env' context is not available in job-level 'with' inputs of
287+
# reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME
288+
# can't be used here and the operator name is templated in directly.
289+
image: quay.io/stackable/sdp/zookeeper-operator
290+
digest: ${{ needs.publish-index-manifest.outputs.quay-index-digest }}
291+
registry-username: stackable+robot_sdp_github_action_build
292+
secrets:
293+
registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
294+
214295
publish-helm-chart:
215296
name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
216297
if: |
@@ -229,8 +310,8 @@ jobs:
229310
persist-credentials: false
230311
submodules: recursive
231312

232-
- name: Package, Publish, and Sign Helm Chart
233-
uses: stackabletech/actions/publish-helm-chart@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
313+
- name: Package, Publish, and Sign Helm Chart to oci.stackable.tech
314+
uses: stackabletech/actions/publish-helm-chart@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
234315
with:
235316
chart-registry-uri: oci.stackable.tech
236317
chart-registry-username: robot$sdp-charts+github-action-build
@@ -241,6 +322,19 @@ jobs:
241322
app-version: ${{ needs.build-container-image.outputs.operator-version }}
242323
publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }}
243324

325+
- name: Package, Publish, and Sign Helm Chart to quay.io
326+
uses: stackabletech/actions/publish-helm-chart@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
327+
with:
328+
chart-registry-uri: quay.io
329+
chart-registry-username: stackable+robot_sdp_charts_github_action_build
330+
chart-registry-password: ${{ secrets.QUAY_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
331+
chart-repository: stackable/sdp-charts
332+
chart-directory: deploy/helm/${{ env.OPERATOR_NAME }}
333+
chart-version: ${{ needs.build-container-image.outputs.operator-version }}
334+
app-version: ${{ needs.build-container-image.outputs.operator-version }}
335+
publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }}
336+
helm-version: v3.17.4 # This is currently the latest version which supports pushing to quay.io
337+
244338
openshift-preflight-check:
245339
name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
246340
if: |
@@ -259,12 +353,18 @@ jobs:
259353
- arm64
260354
runs-on: ubuntu-latest
261355
steps:
262-
- name: Run OpenShift Preflight Check
263-
uses: stackabletech/actions/run-openshift-preflight@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
356+
- name: Run OpenShift Preflight Check for oci.stackable.tech
357+
uses: stackabletech/actions/run-openshift-preflight@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
264358
with:
265359
image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
266360
image-architecture: ${{ matrix.arch }}
267361

362+
- name: Run OpenShift Preflight Check for quay.io
363+
uses: stackabletech/actions/run-openshift-preflight@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
364+
with:
365+
image-index-uri: quay.io/stackable/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
366+
image-architecture: ${{ matrix.arch }}
367+
268368
# This job is a required check in GitHub Settings for this repository.
269369
# It saves us having to list many required jobs, or work around dynamically
270370
# named jobs (since there is no concept of required settings).
@@ -291,6 +391,8 @@ jobs:
291391
- detect-changes
292392
- build-container-image
293393
- publish-index-manifest
394+
- provenance-oci
395+
- provenance-quay
294396
- publish-helm-chart
295397
runs-on: ubuntu-latest
296398
steps:
@@ -300,7 +402,7 @@ jobs:
300402
persist-credentials: false
301403

302404
- name: Send Notification
303-
uses: stackabletech/actions/send-slack-notification@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
405+
uses: stackabletech/actions/send-slack-notification@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
304406
with:
305407
publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
306408
publish-manifests-result: ${{ needs.publish-index-manifest.result }}

‎.github/workflows/integration-test.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,8 @@ on:
2323
test:
2424
description: Name of the test. Only used of test-mode is `custom`
2525

26+
permissions: {}
27+
2628
jobs:
2729
test:
2830
name: Run Integration Test
@@ -41,7 +43,7 @@ jobs:
4143
# TODO: Enable the scheduled runs which hard-code what profile to use
4244
- name: Run Integration Test
4345
id: test
44-
uses: stackabletech/actions/run-integration-test@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
46+
uses: stackabletech/actions/run-integration-test@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
4547
with:
4648
replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }}
4749
test-mode-input: ${{ inputs.test-mode-input }}
@@ -51,7 +53,7 @@ jobs:
5153

5254
- name: Send Notification
5355
if: ${{ failure() || github.run_attempt > 1 }}
54-
uses: stackabletech/actions/send-slack-notification@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
56+
uses: stackabletech/actions/send-slack-notification@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
5557
with:
5658
slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }}
5759
failed-tests: ${{ steps.test.outputs.failed-tests }}

.github/workflows/pr_pre-commit.yaml renamed to .github/workflows/pr_prek.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,21 @@
11
---
2-
name: pre-commit
2+
name: prek
33

44
on:
55
pull_request:
66
merge_group:
77

8+
permissions: {}
9+
810
env:
911
CARGO_TERM_COLOR: always
1012
NIX_PKG_MANAGER_VERSION: "2.33.3"
1113
RUST_TOOLCHAIN_VERSION: "nightly-2026-02-24"
1214
HADOLINT_VERSION: "v2.14.0"
13-
PYTHON_VERSION: "3.14"
1415
JINJA2_CLI_VERSION: "1.0.0"
1516

1617
jobs:
17-
pre-commit:
18+
prek:
1819
runs-on: ubuntu-latest
1920
steps:
2021
- name: Install host dependencies
@@ -27,9 +28,8 @@ jobs:
2728
persist-credentials: false
2829
submodules: recursive
2930
fetch-depth: 0
30-
- uses: stackabletech/actions/run-pre-commit@6a84fcfccf4ee37d85217407bc6a94742afbb45f # v0.14.2
31+
- uses: stackabletech/actions/run-prek@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
3132
with:
32-
python-version: ${{ env.PYTHON_VERSION }}
3333
rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
3434
hadolint: ${{ env.HADOLINT_VERSION }}
3535
nix: ${{ env.NIX_PKG_MANAGER_VERSION }}

‎.pre-commit-config.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ repos:
3838
hooks:
3939
- id: shellcheck
4040
args: ["--severity=info"]
41+
# Temporarily needed until all getting_started.sh.j2 scripts are made non-executable.
42+
# As long as they are, prek will treat them as shell scripts and so this hook will fail.
43+
# pre-commit behaves differently apparently and doesn't pass .j2 files to this hook.
44+
exclude: \.j2$
4145

4246
# WARNING (@NickLarsenNZ): Nix users need to install ruff first.
4347
# If you do not, you will need to delete the cached ruff binary shown in the

‎.readme/partials/borrowed/overview_blurb.md.j2‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
<!-- markdownlint-disable MD041 MD051 -->
2-
It is part of the Stackable Data Platform, a curated selection of the best open source data apps like Apache Kafka, Apache Druid, Trino or Apache Spark, [all](#other-operators) working together seamlessly. Based on Kubernetes, it runs everywhere – [on prem or in the cloud](#supported-platforms).
2+
It is part of the Stackable Data Platform, a curated selection of the best open source data apps like Apache Kafka®, OpenSearch, Trino or Apache Spark™, [all](#other-operators) working together seamlessly. Based on Kubernetes, it runs everywhere – [on prem or in the cloud](#supported-platforms).

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
This is a Kubernetes operator to manage [Apache ZooKeeper](https://zookeeper.apache.org/) ensembles.
1616

1717
<!-- markdownlint-disable MD041 MD051 -->
18-
It is part of the Stackable Data Platform, a curated selection of the best open source data apps like Apache Kafka, Apache Druid, Trino or Apache Spark, [all](#other-operators) working together seamlessly. Based on Kubernetes, it runs everywhere – [on prem or in the cloud](#supported-platforms).
18+
It is part of the Stackable Data Platform, a curated selection of the best open source data apps like Apache Kafka®, OpenSearch, Trino or Apache Spark™, [all](#other-operators) working together seamlessly. Based on Kubernetes, it runs everywhere – [on prem or in the cloud](#supported-platforms).
1919

2020
## Installation
2121

‎deny.toml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,25 @@ ignore = [
4545
# This version is pulled in transitively via num-bigint-dig -> rsa -> stackable-certs and cannot be
4646
# updated until the upstream rsa crate bumps its rand dependency.
4747
"RUSTSEC-2026-0097",
48+
49+
# https://rustsec.org/advisories/RUSTSEC-2026-0173
50+
# The author of `proc-macro-error2` has [confirmed](https://github.com/GnomedDev/proc-macro-error-2/issues/17#issuecomment-4643215473)
51+
# that the crate is no longer maintained and recommends that users migrate away from it.
52+
#
53+
# There currently is no way for us to negate this advisory, because that crate is not used
54+
# directly by us. We need to wait for new versions of oci-spec and getset. See the following
55+
# issue which tracks moving to a newer getset version: https://github.com/youki-dev/oci-spec-rs/issues/340
56+
#
57+
# proc-macro-error2 v2.0.1
58+
# └── getset v0.1.6
59+
# └── oci-spec v0.9.0
60+
# └── boil v0.2.1
61+
#
62+
# Alternate crates are:
63+
#
64+
# - https://crates.io/crates/manyhow
65+
# - https://github.com/SergioBenitez/proc-macro2-diagnostics
66+
"RUSTSEC-2026-0173",
4867
]
4968

5069
[bans]

‎deploy/helm/zookeeper-operator/values/quay.io.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
# Values overlay for chart packages published to quay.io.
3+
image:
4+
repository: quay.io/stackable/sdp

‎renovate.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,5 +3,5 @@
33
"extends": [
44
"local>stackabletech/.github:renovate-config"
55
],
6-
"ignorePaths": [".github/workflows/build.yaml", ".github/workflows/general_daily_security.yml", ".github/workflows/integration-test.yml", ".github/workflows/pr_pre-commit.yaml"]
6+
"ignorePaths": [".github/workflows/build.yaml", ".github/workflows/general_daily_security.yml", ".github/workflows/integration-test.yml", ".github/workflows/pr_prek.yaml"]
77
}

‎scripts/docs_templating.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,7 @@ do
3838
jinja2 "$file" "$templating_vars_file" -o "$new_file_name"
3939
done
4040

41+
# Ensure this script is executable
42+
chmod +x docs/modules/opensearch/examples/getting_started/getting_started.sh
43+
4144
echo "done"

0 commit comments

Comments
 (0)