aqua.yaml

---
# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/main/json-schema/aqua-yaml.json
#
# aqua (https://aquaproj.github.io) is the single source of truth for the
# versions of every CLI this repo builds, tests, lints, and runs e2e with.
# It replaces the per-tool `go install ... @version` targets that used to live
# in the Makefile: tools are now resolved from $PATH (aqua's bin dir) and
# lazily installed at the exact pinned version on first use.
#
# To work on this repo locally:
#   1. Install aqua            -> https://aquaproj.github.io/docs/install
#   2. Put aqua's bin on $PATH -> e.g. `export PATH="$(aqua root-dir)/bin:$PATH"`
# `make build/test/lint`, the e2e harness, and CI all then pick the tools up
# automatically. Bump a version here (and run `aqua update-checksum` if the
# checksum lock is later enabled) — never reintroduce a free-floating install.
registries:
  - type: standard
    ref: v4.539.0 # renovate: depName=aquaproj/aqua-registry
  # Local registry for tools the standard registry does not carry (controller-gen).
  # Trusted via aqua-policy.yaml (allowed by the Makefile aqua-tools target).
  - name: local
    type: local
    path: aqua/registry.yaml
packages:
  # --- Go toolchain ---
  # The Go toolchain itself is pinned here so local `make` and CI use the exact
  # same compiler (no actions/setup-go). MUST stay in sync with the `go`
  # directive in go.mod — bump both together (the check-go-toolchain-sync.sh CI
  # guard enforces this), or Go's GOTOOLCHAIN=auto will silently download a
  # newer toolchain and bypass this pin.
  - name: golang/go@go1.26.5
  # --- Go test / lint / language-server tooling (was `go install` in Makefile) ---
  # setup-envtest only fetches the envtest control-plane binaries; `make test`
  # still downloads the matching Kubernetes assets on first run (ENVTEST_K8S_VERSION).
  - name: kubernetes-sigs/controller-runtime/setup-envtest@v0.24.1
  # gopls is a go_install package: aqua builds it from source with the pinned
  # Go toolchain above.
  - name: golang.org/x/tools/gopls@v0.23.0
  - name: golangci/golangci-lint@v2.12.2
  # controller-gen generates the RotationPolicy CRD manifests and zz_generated
  # deepcopy from the api/ kubebuilder markers (`make manifests` / `make generate`,
  # issue #122). Not in the standard registry, so it comes from the local registry
  # (aqua/registry.yaml) as a go_install package built with the pinned Go toolchain.
  - name: sigs.k8s.io/controller-tools/cmd/controller-gen
    registry: local
    version: v0.21.0
  # --- KWOK e2e harness tooling (test/e2e/kwok, issue #92) ---
  - name: kubernetes-sigs/kind@v0.32.0
  - name: ko-build/ko@v0.19.1
  # kustomize releases carry a `kustomize/` tag prefix; pin the full tag (aqua
  # only auto-applies version_prefix when resolving "latest", not an exact pin).
  - name: kubernetes-sigs/kustomize@kustomize/v5.8.1
  # helm is pinned to the v4 line — the version CI already used de-facto
  # (azure/setup-helm installed latest). The chart, values.schema.json, and the
  # helm-unittest v1.1.1 plugin all render/pass under it.
  - name: helm/helm@v4.2.3
  # kubectl tracks the controller's Kubernetes client minor (k8s.io/api v0.36 ->
  # 1.36), matching the kind node's Kubernetes minor (v1.36) — within skew policy.
  - name: kubernetes/kubernetes/kubectl@v1.36.2
  # --- Ephemeral EKS Auto Mode PoC tooling (test/e2e/eks-automode, issue #93) ---
  - name: hashicorp/terraform@v1.15.8
  # awscli authenticates to AWS, logs Docker in to ECR, and writes the cluster
  # kubeconfig for the PoC (issue #106). v2 line.
  - name: aws/aws-cli@2.36.4