Merge upstream Kargo 2026-04-09

.github/workflows/backport.yaml

@@ -16,14 +16,14 @@ jobs:
     if: github.repository_owner == 'akuity' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport/', github.event.label.name))
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
     - name: Checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Create backport PRs
-      uses: korthout/backport-action@4aaf0e03a94ff0a619c9a511b61aeb42adea5b02 # v4.2.0
+      uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
       # xref: https://github.com/korthout/backport-action#inputs
       with:
         # Use token to allow workflows to be triggered for the created PR

.github/workflows/ci.yaml

@@ -24,7 +24,7 @@ jobs:
     # "stable" is updated to >= 2.42.0 (which supports `--orphan` for `git
     # worktree add`).
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -50,15 +50,15 @@ jobs:
           mv $tmp_file $report
         done
     - name: Upload coverage reports
-      uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
 
   lint-and-typecheck-ui:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -94,7 +94,7 @@ jobs:
       image: *golangImage
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -122,7 +122,7 @@ jobs:
       image: *golangImage
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -152,7 +152,7 @@ jobs:
       image: *golangImage
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -180,7 +180,7 @@ jobs:
       image: *golangImage
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -232,7 +232,7 @@ jobs:
         - 5000:5000
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -266,7 +266,7 @@ jobs:
       image: *golangImage
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 

.github/workflows/governance.yaml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 

.github/workflows/lint-pr.yaml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 

.github/workflows/release.yaml

@@ -29,7 +29,7 @@ jobs:
       unstable-version: ${{ steps.unstable-version.outputs.unstable-version }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -44,7 +44,7 @@ jobs:
         echo "Repository is set to: $REPO"
         echo "repo=$REPO" >> $GITHUB_OUTPUT
     - name: Setup Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version: '1.26.0'
     - name: Set version for unstable builds
@@ -62,11 +62,11 @@ jobs:
       with:
         driver-opts: network=host
     - name: Install Cosign
-      uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+      uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
       with:
         cosign-release: 'v2.2.1' # optional
     - name: Login to GHCR
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -141,7 +141,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -166,11 +166,11 @@ jobs:
         echo "VERSION is set to: $VERSION"
         echo "version=$VERSION" >> $GITHUB_OUTPUT
     - name: Set up Helm
-      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+      uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
       with:
         version: '3.19.4'
     - name: Login to GHCR
-      uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -193,7 +193,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -245,7 +245,7 @@ jobs:
       hash-windows-arm64: ${{ steps.hash.outputs.hash-windows-arm64 }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -283,7 +283,7 @@ jobs:
       run: |
         make sign-and-notarize-cli
     - name: Publish CLI
-      uses: svenstaro/upload-release-action@b98a3b12e86552593f3e4e577ca8a62aa2f3f22b # v2.11.4
+      uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # v2.11.5
       with:
         file: bin/*
         file_glob: true
@@ -308,7 +308,7 @@ jobs:
         arch: [amd64, arm64]
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -375,7 +375,7 @@ jobs:
       HASHES: ${{ toJSON(needs.publish-cli.outputs) }}
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -413,7 +413,7 @@ jobs:
       image: *golangImage
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 
@@ -424,11 +424,11 @@ jobs:
         mkdir _site
         go run ./hack/best-releases > _site/best-releases.json
     - name: Configure Pages
-      uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+      uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
     - name: Upload Pages artifact
       uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
       with:
         path: _site
     - name: Deploy to GitHub Pages
       id: deployment
-      uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+      uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/stale.yaml

@@ -12,7 +12,7 @@ jobs:
     timeout-minutes: 30  # Don't wait 6 hours to cancel workflow if it hangs.
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+      uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
       with:
         egress-policy: audit
 

.gitignore

@@ -11,4 +11,3 @@ vendor/
 internal/server/ui/
 .DS_Store
 docs/static/swagger.json
-docs/static/swagger.yaml

.swaggo

@@ -0,0 +1,65 @@
+// Override type aliases that go-swagger mishandles. Go-swagger wraps referenced
+// types in anonymous structs, which breaks JSON deserialization when the wire
+// format is a bare string or integer. Replacing them with primitives here
+// prevents that.
+
+replace k8s.io/apimachinery/pkg/apis/meta/v1.Duration string
+replace k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1.JSON object
+replace k8s.io/apimachinery/pkg/apis/meta/v1.ConditionStatus string
+replace k8s.io/apimachinery/pkg/apis/meta/v1.LabelSelectorOperator string
+replace k8s.io/apimachinery/pkg/apis/meta/v1.ManagedFieldsOperationType string
+replace k8s.io/apimachinery/pkg/util/intstr.Type integer
+
+replace k8s.io/api/core/v1.AppArmorProfileType string
+replace k8s.io/api/core/v1.AzureDataDiskCachingMode string
+replace k8s.io/api/core/v1.AzureDataDiskKind string
+replace k8s.io/api/core/v1.CompletionMode string
+replace k8s.io/api/core/v1.ConditionStatus string
+replace k8s.io/api/core/v1.ContainerRestartPolicy string
+replace k8s.io/api/core/v1.ContainerRestartRuleAction string
+replace k8s.io/api/core/v1.ContainerRestartRuleOnExitCodesOperator string
+replace k8s.io/api/core/v1.DNSPolicy string
+replace k8s.io/api/core/v1.HostPathType string
+replace k8s.io/api/core/v1.MountPropagationMode string
+replace k8s.io/api/core/v1.NodeInclusionPolicy string
+replace k8s.io/api/core/v1.NodeSelectorOperator string
+replace k8s.io/api/core/v1.OSName string
+replace k8s.io/api/core/v1.PersistentVolumeAccessMode string
+replace k8s.io/api/core/v1.PersistentVolumeMode string
+replace k8s.io/api/core/v1.PodConditionType string
+replace k8s.io/api/core/v1.PodFSGroupChangePolicy string
+replace k8s.io/api/core/v1.PodFailurePolicyAction string
+replace k8s.io/api/core/v1.PodFailurePolicyOnExitCodesOperator string
+replace k8s.io/api/core/v1.PodReplacementPolicy string
+replace k8s.io/api/core/v1.PodSELinuxChangePolicy string
+replace k8s.io/api/core/v1.PreemptionPolicy string
+replace k8s.io/api/core/v1.ProcMountType string
+replace k8s.io/api/core/v1.Protocol string
+replace k8s.io/api/core/v1.PullPolicy string
+replace k8s.io/api/core/v1.RecursiveReadOnlyMode string
+replace k8s.io/api/core/v1.ResourceName string
+replace k8s.io/api/core/v1.ResourceResizeRestartPolicy string
+replace k8s.io/api/core/v1.RestartPolicy string
+replace k8s.io/api/core/v1.SeccompProfileType string
+replace k8s.io/api/core/v1.SecretType string
+replace k8s.io/api/core/v1.Signal string
+replace k8s.io/api/core/v1.StorageMedium string
+replace k8s.io/api/core/v1.SupplementalGroupsPolicy string
+replace k8s.io/api/core/v1.TaintEffect string
+replace k8s.io/api/core/v1.TerminationMessagePolicy string
+replace k8s.io/api/core/v1.TolerationOperator string
+replace k8s.io/api/core/v1.URIScheme string
+replace k8s.io/api/core/v1.UnsatisfiableConstraintAction string
+
+replace github.com/akuity/kargo/api/v1alpha1.AutoPromotionSelectionPolicy string
+replace github.com/akuity/kargo/api/v1alpha1.FreightAvailabilityStrategy string
+replace github.com/akuity/kargo/api/v1alpha1.FreightCreationPolicy string
+replace github.com/akuity/kargo/api/v1alpha1.FreightOriginKind string
+replace github.com/akuity/kargo/api/v1alpha1.GenericWebhookActionType string
+replace github.com/akuity/kargo/api/v1alpha1.GenericWebhookTargetKind string
+replace github.com/akuity/kargo/api/v1alpha1.HealthState string
+replace github.com/akuity/kargo/api/v1alpha1.IndexSelectorOperator string
+replace github.com/akuity/kargo/api/v1alpha1.PromotionPhase string
+replace github.com/akuity/kargo/api/v1alpha1.PromotionStepStatus string
+replace github.com/akuity/kargo/api/v1alpha1.VerificationPhase string
+replace github.com/akuity/kargo/api/stubs/rollouts/v1alpha1.AnalysisPhase string

Dockerfile

@@ -11,11 +11,11 @@ RUN npm install --global pnpm@${PNPM_VERSION}
 WORKDIR /ui
 COPY ["ui/package.json", "ui/pnpm-lock.yaml", "./"]
 
-RUN pnpm install
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install
 COPY ["ui/", "."]
 
 ARG VERSION
-RUN NODE_ENV='production' VERSION=${VERSION} pnpm run build
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store NODE_ENV='production' VERSION=${VERSION} pnpm run build
 
 ####################################################################################################
 # back-end-builder
@@ -31,8 +31,9 @@ ARG CGO_ENABLED=0
 
 WORKDIR /kargo
 COPY ["api/go.mod", "api/go.sum", "api/"]
+COPY ["pkg/client/generated/go.mod", "pkg/client/generated/go.sum", "pkg/client/generated/"]
 COPY ["go.mod", "go.sum", "./"]
-RUN go mod download
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go mod download
 COPY api/ api/
 COPY pkg/ pkg/
 COPY cmd/ cmd/
@@ -42,13 +43,15 @@ ARG VERSION
 ARG GIT_COMMIT
 ARG GIT_TREE_STATE
 
-RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
       -trimpath \
       -ldflags "-w -s" \
       -o bin/credential-helper \
       ./cmd/credential-helper
 
-RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
       -trimpath \
       -ldflags "-w -X ${VERSION_PACKAGE}.version=${VERSION} -X ${VERSION_PACKAGE}.buildDate=$(date -u +'%Y-%m-%dT%H:%M:%SZ') -X ${VERSION_PACKAGE}.gitCommit=${GIT_COMMIT} -X ${VERSION_PACKAGE}.gitTreeState=${GIT_TREE_STATE}" \
       -o bin/kargo \
@@ -107,7 +110,7 @@ RUN npm install --global pnpm@${PNPM_VERSION}
 WORKDIR /ui
 COPY ["ui/package.json", "ui/pnpm-lock.yaml", "./"]
 
-RUN pnpm install
+RUN --mount=type=cache,target=/root/.local/share/pnpm/store pnpm install
 
 COPY ["ui/", "."]