Skip to content

Commit 8461590

Browse files
vardhaman22vardhaman22
authored
Merge pull request #796 from vardhaman22/v1.4/sync-changes
[release/v1.4] sync changes from main
2 parents df8c4f4 + 2da72d0 commit 8461590

File tree

16 files changed

+306
-288
lines changed

16 files changed

+306
-288
lines changed

‎.github/renovate.json‎

Lines changed: 13 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,135 +1,30 @@
11
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
23
"extends": [
3-
"github>rancher/renovate-config#release"
4+
"github>rancher/renovate-config//rancher-main#main"
45
],
56
"baseBranches": [
6-
"main",
7-
"release/v1.1",
8-
"release/v1.2",
9-
"release/v1.3",
10-
"release/v1.4"
7+
"main"
118
],
129
"ignoreDeps":[
1310
"github.com/rancher/lasso"
1411
],
15-
"prHourlyLimit": 4,
1612
"packageRules": [
1713
{
18-
"matchBaseBranches": [
19-
"main",
20-
"release/v1.4"
21-
],
22-
"matchDepNames": [
23-
"k8s.io/api",
24-
"k8s.io/apiextensions-apiserver",
25-
"k8s.io/apimachinery",
26-
"k8s.io/client-go"
27-
],
28-
"allowedVersions": "<0.33.0"
29-
},
30-
{
31-
"matchBaseBranches": [
32-
"release/v1.3"
33-
],
34-
"matchDepNames": [
35-
"k8s.io/api",
36-
"k8s.io/apiextensions-apiserver",
37-
"k8s.io/apimachinery",
38-
"k8s.io/client-go"
39-
],
40-
"allowedVersions": "<0.32.0"
41-
},
42-
{
43-
"matchBaseBranches": [
44-
"release/v1.4"
45-
],
46-
"matchDepNames": [
47-
"github.com/rancher/security-scan"
48-
],
49-
"allowedVersions": "<v0.7.0"
50-
},
51-
{
52-
"matchBaseBranches": [
53-
"release/v1.3"
54-
],
55-
"matchDepNames": [
56-
"github.com/rancher/security-scan"
57-
],
58-
"allowedVersions": "<v0.6.0"
59-
},
60-
{
61-
"matchBaseBranches": ["release/v1.2"],
62-
"matchDepNames": [
63-
"k8s.io/api",
64-
"k8s.io/apiextensions-apiserver",
65-
"k8s.io/apimachinery",
66-
"k8s.io/client-go"
67-
],
68-
"allowedVersions": "<0.31.0"
69-
},
70-
{
71-
"matchBaseBranches": ["release/v1.2"],
72-
"matchDepNames": [
73-
"github.com/rancher/security-scan"
74-
],
75-
"allowedVersions": "<v0.5.0"
76-
},
77-
{
78-
"matchBaseBranches": ["release/v1.1"],
79-
"matchDepNames": [
80-
"k8s.io/api",
81-
"k8s.io/apiextensions-apiserver",
82-
"k8s.io/apimachinery",
83-
"k8s.io/client-go"
84-
],
85-
"allowedVersions": "<0.31.0"
86-
},
87-
{
88-
"matchBaseBranches": ["release/v1.1"],
89-
"matchDepNames": [
90-
"github.com/rancher/security-scan"
91-
],
92-
"allowedVersions": "<v0.4.0"
14+
"matchBaseBranches": ["release/v1.4"],
15+
"extends": ["github>rancher/renovate-config//rancher-2.11#main"]
9316
},
9417
{
9518
"matchBaseBranches": ["release/v1.3"],
96-
"matchDepNames": [
97-
"github.com/prometheus-operator/prometheus-operator/pkg/client",
98-
"github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring"
99-
],
100-
"allowedVersions": "<v0.79.0"
19+
"extends": ["github>rancher/renovate-config//rancher-2.10#main"]
10120
},
10221
{
103-
"matchBaseBranches": [
104-
"release/v1.1",
105-
"release/v1.2"
106-
],
107-
"matchDepNames": [
108-
"github.com/prometheus-operator/prometheus-operator/pkg/client",
109-
"github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring"
110-
],
111-
"allowedVersions": "<v0.75.0"
112-
},
113-
{
114-
"matchBaseBranches": [
115-
"release/v1.1",
116-
"release/v1.2",
117-
"release/v1.3"
118-
],
119-
"matchDepNames": [
120-
"github.com/urfave/cli"
121-
],
122-
"allowedVersions": "<v2.0.0"
123-
},
124-
{
125-
"matchBaseBranches": [
126-
"release/v1.1",
127-
"release/v1.2"
128-
],
129-
"matchDepNames": [
130-
"github.com/rancher/wrangler"
131-
],
132-
"allowedVersions": "<v3.0.1"
22+
"matchBaseBranches": ["release/v1.2"],
23+
"extends": ["github>rancher/renovate-config//rancher-2.9#main"]
13324
}
134-
]
25+
],
26+
"vulnerabilityAlerts": {
27+
"enabled": true
28+
},
29+
"osvVulnerabilityAlerts": true
13530
}

‎.github/workflows/codeql.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
name: CodeQL
2+
on:
3+
workflow_call:
4+
pull_request:
5+
6+
push:
7+
branches:
8+
- main
9+
10+
schedule:
11+
- cron: '00 9 * * 2'
12+
13+
permissions: {}
14+
15+
jobs:
16+
analyze:
17+
name: Analyze
18+
runs-on: ubuntu-latest
19+
20+
permissions:
21+
actions: read
22+
contents: read
23+
security-events: write
24+
25+
strategy:
26+
fail-fast: false
27+
matrix:
28+
language: [ 'go', 'actions' ]
29+
30+
steps:
31+
- name: Checkout code
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
34+
- name: Initialize CodeQL
35+
uses: github/codeql-action/init@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
36+
with:
37+
languages: ${{ matrix.language }}
38+
# xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
39+
# xref: https://codeql.github.com/codeql-query-help/go/
40+
queries: security-and-quality
41+
42+
- name: Manual Build
43+
run: go build ./...
44+
45+
- name: Perform CodeQL Analysis
46+
uses: github/codeql-action/analyze@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
47+
with:
48+
category: "/language:${{matrix.language}}"

‎.github/workflows/label-all-new-issues.yml‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,13 @@ on:
55
- opened
66
- reopened
77

8-
permissions:
9-
issues: write
8+
permissions: {}
109

1110
jobs:
1211
label_issues:
1312
runs-on: ubuntu-latest
13+
permissions:
14+
issues: write
1415
steps:
1516
- name: Label issue
1617
id: run

‎.github/workflows/release.yml‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ on:
55
tags:
66
- 'v*'
77

8+
permissions: {}
9+
810
jobs:
911

1012
publish:
@@ -32,7 +34,7 @@ jobs:
3234

3335
steps:
3436
- name: Checkout code
35-
uses: actions/checkout@v4
37+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3638

3739
- name: Load Secrets from Vault
3840
uses: rancher-eio/read-vault-secrets@main
@@ -68,7 +70,7 @@ jobs:
6870

6971
steps:
7072
- name: Checkout code
71-
uses: actions/checkout@v4
73+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
7274

7375
- run: make upload
7476
env:

‎.github/workflows/renovate-vault.yml‎

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,35 @@ on:
55
logLevel:
66
description: "Override default log level"
77
required: false
8-
default: "info"
9-
type: string
8+
default: info
9+
type: choice
10+
options:
11+
- info
12+
- debug
1013
overrideSchedule:
1114
description: "Override all schedules"
1215
required: false
1316
default: "false"
17+
type: choice
18+
options:
19+
- "false"
20+
- "true"
21+
configMigration:
22+
description: "Toggle PRs for config migration"
23+
required: false
24+
default: "true"
25+
type: choice
26+
options:
27+
- "false"
28+
- "true"
29+
renovateConfig:
30+
description: "Define a custom renovate config file"
31+
required: false
32+
default: ".github/renovate.json"
1433
type: string
15-
# Run twice in the early morning (UTC) for initial and follow up steps (create pull request and merge)
34+
1635
schedule:
17-
- cron: '30 4,6 * * *'
36+
- cron: '30 4,6 * * 2-4'
1837

1938
permissions:
2039
contents: read
@@ -24,6 +43,9 @@ jobs:
2443
call-workflow:
2544
uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@release
2645
with:
46+
configMigration: ${{ inputs.configMigration || 'true' }}
2747
logLevel: ${{ inputs.logLevel || 'info' }}
2848
overrideSchedule: ${{ github.event.inputs.overrideSchedule == 'true' && '{''schedule'':null}' || '' }}
29-
secrets: inherit
49+
renovateConfig: ${{ inputs.renovateConfig || '.github/renovate.json' }}
50+
secrets:
51+
override-token: "${{ secrets.RENOVATE_FORK_GH_TOKEN || '' }}"

‎.github/workflows/scorecard.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
# For Branch-Protection check. Only the default branch is supported. See
4+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
5+
branch_protection_rule:
6+
# To guarantee Maintained check is occasionally updated. See
7+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
8+
schedule:
9+
- cron: '20 5 * * 0'
10+
push:
11+
branches: [ "main" ]
12+
13+
# Declare default permissions as read only.
14+
permissions: read-all
15+
16+
jobs:
17+
analysis:
18+
name: Scorecard analysis
19+
runs-on: ubuntu-latest
20+
permissions:
21+
# Needed to upload the results to code-scanning dashboard.
22+
security-events: write
23+
# Needed to publish results and get a badge (see publish_results below).
24+
id-token: write
25+
26+
steps:
27+
- name: "Checkout code"
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
29+
with:
30+
persist-credentials: false
31+
32+
- name: "Run analysis"
33+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
34+
with:
35+
results_file: results.sarif
36+
results_format: sarif
37+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
38+
# - you want to enable the Branch-Protection check on a *public* repository
39+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
40+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
41+
42+
# Public repositories:
43+
# - Publish results to OpenSSF REST API for easy access by consumers
44+
# - Allows the repository to include the Scorecard badge.
45+
# - See https://github.com/ossf/scorecard-action#publishing-results.
46+
publish_results: true
47+
48+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
49+
# format to the repository Actions tab.
50+
- name: "Upload artifact"
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
52+
with:
53+
name: SARIF file
54+
path: results.sarif
55+
retention-days: 5
56+
57+
# Upload the results to GitHub's code scanning dashboard (optional).
58+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
59+
- name: "Upload to code-scanning"
60+
uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3.28.13
61+
with:
62+
sarif_file: results.sarif

‎.github/workflows/tests.yml‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@v4
15+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1616

1717
- name: Install Go
18-
uses: actions/setup-go@v5
18+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
1919
with:
2020
go-version: 'stable'
2121
- run: make validate
@@ -33,10 +33,10 @@ jobs:
3333

3434
steps:
3535
- name: Checkout code
36-
uses: actions/checkout@v4
36+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3737

3838
- name: Install Go
39-
uses: actions/setup-go@v5
39+
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
4040
with:
4141
go-version: 'stable'
4242

@@ -60,11 +60,11 @@ jobs:
6060
brew install docker
6161
colima start
6262
- name: Setup QEMU
63-
uses: docker/setup-qemu-action@v3
63+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
6464
- name: Setup Docker Buildx
65-
uses: docker/setup-buildx-action@v3
65+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
6666
- name: Checkout code
67-
uses: actions/checkout@v4
67+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
6868

6969
- name: Test building images
7070
run: make test-image

0 commit comments

Comments
 (0)