Skip to content

merge main into release/2.0 again - #558

Closed
zackbradys wants to merge 27 commits into
release/2.0from
main
Closed

merge main into release/2.0 again#558
zackbradys wants to merge 27 commits into
release/2.0from
main

Conversation

@zackbradys

@zackbradys zackbradys commented Apr 19, 2026

Copy link
Copy Markdown
Member

Please check below, if the PR fulfills these requirements:

  • Commit(s) and code follow the repositories guidelines.
  • Test(s) have been added or updated to support these change(s).
  • Doc(s) have been added or updated to support these change(s).

Associated Links:

  • N/A

Types of Changes:

  • N/A

Proposed Changes:

  • N/A

Verification/Testing of Changes:

  • N/A

Additional Context:

  • N/A

devLeitner and others added 27 commits March 2, 2026 00:40
@devLeitner devleitner
fix: handling of file referenced dependencies without repository field (
4ed7504 
#514)

co-authored-by: devleitner <devleitner@protonmail.com>
@dependabot
bump go.opentelemetry.io/otel/sdk (#520)
666d220 
bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go).

updates `go.opentelemetry.io/otel/sdk` from 1.39.0 to 1.40.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.39.0...v1.40.0)

---

updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.40.0
  dependency-type: indirect
  dependency-group: go_modules

...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@CamrynCarter
dev.md file (#521)
a4b16c7
@zackbradys
smaller changes and updates for v1.4.2 release (#524)
26b11d5 
* smaller changes and updates for v1.4.2 release
* removed unused env variable
@amartin120
over-"haul": replace oras v1 and cosign fork with native containerd-b…
e2a5950 
…ased implementation (#515)

* remove oras from hauler

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* remove cosign fork and use upstream cosign for verification

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* added support for oci referrers

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* updated README.md projects list

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* updates for copilot PR review

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix for unsafe type assertions

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix for http getter and dead code

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* fixes for more clarity and better error handling

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix for resource leaks and unchecked errors

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix for rewrite logic for docker.io images due to cosign removal

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix for sigs and referrers

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix for index.json missing mediatype

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* bug fix to make sure manifest.json doesnt include anything other than actual container images

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

---------

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@dependabot
bump github.com/docker/cli in the go_modules group across 1 directory (…
995e538 
…#526)

bumps the go_modules group with 1 update in the / directory: [github.com/docker/cli](https://github.com/docker/cli).


updates `github.com/docker/cli` from 29.0.3+incompatible to 29.2.0+incompatible
- [Commits](docker/cli@v29.0.3...v29.2.0)

---

updated-dependencies:
- dependency-name: github.com/docker/cli
  dependency-version: 29.2.0+incompatible
  dependency-type: indirect
  dependency-group: go_modules

...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@zackbradys
removed deprecated code (#528)
cc61239 
* removed deprecated code
* removed all supported for v1alpha1
@amartin120
fix extract for oci files (#529)
0dd1896 
* fix extract for oci files

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* have extract guard against path traversal

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

---------

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@amartin120
improved test coverage (#530)
bbde346 
* improved test coverage

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* adjusted mapper_test for oddball oci files

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

---------

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@amartin120
adjust extract to handle an image index appropriately (#531)
47479b1 
* adjust extract to handle images and image indices appropriately

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* updates for review feedback

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

---------

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@amartin120
fix dockerhub default host bug (#534)
268485f 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@amartin120
adjust hauler's kind annotation to not reflect cosign (#535)
3adb925 
Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@dependabot
bump google.golang.org/grpc in the go_modules group across 1 directory (
565b27d 
#536)

bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).

updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.78.0...v1.79.3)

---

updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
  dependency-group: go_modules

...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@CamrynCarter
add cherry-pick workflow for release branches (#533)
aa9b883 
this workflow automates cherry-picking changes from merged pull requests to specified release branches based on comments... it handles permission checks, version parsing, and conflict resolution during the cherry-pick process.

Signed-off-by: Camryn Carter <camryn.carter@ranchergovernment.com>
@CamrynCarter
images.txt testdata file (#539)
7fd03ea
@CamrynCarter
fix keep registry logic (#537)
e8046a1 
* fixed keep registry logic
* trim library/
* updated test
* test updates
@CamrynCarter
option to sync images.txt files natively (#538)
c68e72d 
* sync images.txt files
* test worklflow sync w image list
* images.txt
@CamrynCarter
chunk the haul (#519)
641b9db 
* chunk the haul
* validate numeric suffix on join
* enforce valid chunk size
* containerd warning
* updated test.go files
@dependabot
bump github.com/go-jose/go-jose/v4 (#542)
93938d1 
bumps the go_modules group with 1 update in the / directory: [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose).


updates `github.com/go-jose/go-jose/v4` from 4.1.3 to 4.1.4

- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.3...v4.1.4)

---

updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
  dependency-group: go_modules

...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@zackbradys
allow multiple prefix references (#532)
b3e2180 
* allow multiple prefix references
* fixed some duplications
@amartin120
add optional flag for excluding extra artifacts when pulling from a r…
f059a13 
…egistry (#541)

* add optional flag for excluding extra artifacts when pulling from a registry

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

* add optional flag to charts for excluding extra artifacts when pulling from a registry

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>

---------

Signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@dependabot
bump go.opentelemetry.io/otel/sdk (#548)
7319874 
bumps the go_modules group with 1 update in the / directory: [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go).

updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.43.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.40.0...v1.43.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.43.0
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@CamrynCarter
verified commits and better messges (#550)
a8d6e2e
@dependabot
bump helm.sh/helm/v3 in the go_modules group across 1 directory (#552)
8560d02 
bumps the go_modules group with 1 update in the / directory: [helm.sh/helm/v3](https://github.com/helm/helm).

updates `helm.sh/helm/v3` from 3.19.0 to 3.20.2
- [Release notes](https://github.com/helm/helm/releases)
- [Commits](helm/helm@v3.19.0...v3.20.2)

---
updated-dependencies:
- dependency-name: helm.sh/helm/v3
  dependency-version: 3.20.2
  dependency-type: direct:production
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@CamrynCarter
handle large diff passed to gh api (#553)
57d45f1
@amartin120
add dry-run flag for sync --products (#547)
b2d0f9f 
signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@amartin120
add ability to add images from local docker daemon (#551)
40c4fdd 
signed-off-by: Adam Martin <adam.martin@ranchergovernment.com>
@github-project-automation github-project-automation Bot moved this to To Triage in Hauler Apr 19, 2026
@zackbradys zackbradys closed this Apr 19, 2026
@github-project-automation github-project-automation Bot moved this from To Triage to Resolved in Hauler Apr 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

Hauler
Status: Resolved

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@zackbradys @devLeitner @CamrynCarter @amartin120