Skip to content

Commit bb9a05b

Browse files
authored
Merge branch 'main' into fix/issue-2102
2 parents e5e65b9 + fb997de commit bb9a05b

48 files changed

Lines changed: 860 additions & 2599 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.envrc

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,10 @@ if ! which "$0" | grep -q nix; then
4343
fi
4444

4545
echo 'Installing Nix Profile...'
46-
if ! nf profile install . --profile "$profile"; then
47-
echo 'Failed to install new Nix profile! Reverting to previous profile...'
46+
if ! nf profile add . --profile "$profile"; then
47+
echo 'Failed to add new Nix profile! Reverting to previous profile...'
4848
git checkout flake.lock
49-
nf profile install . --profile "$profile"
49+
nf profile add . --profile "$profile"
5050
fi
5151

5252
nf profile list --profile "$profile"

.github/ISSUE_TEMPLATE/feature.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
name: Request a New Behavior
3+
about: Something is missing or outdated
4+
title: '[Feature] '
5+
labels: 'internal/user'
6+
assignees: ''
7+
8+
---
9+
10+
### Environment Information
11+
<!--Please add information on the same line in quotes. Eg. - Terraform version: "v1.13.0" -->
12+
- Rancher2 Provider version:
13+
- Rancher version:
14+
- Infrastructure Provider (AWS/GCP/vSphere/etc):
15+
16+
### Describe the Feature
17+
18+
<!---
19+
Please add relevant Terraform configs or examples so that we can fully understand what you would like.
20+
Please give us enough information to build an API or project plan.
21+
--->
Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
applyTo: "aspell_custom.txt"
3+
---
4+
5+
# Custom Words File
6+
7+
All words, acronyms, etc in the aspell_custom.txt file MUST be lower case.
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
applyTo: ".github/workflows/scripts/**/*.js"
3+
---
4+
5+
# GitHub-Script PR Review Standards
6+
7+
You are a strict CI/CD reviewer evaluating JavaScript executed via the `actions/github-script` runner. These files are NOT standard Node.js scripts; they are executed with pre-injected asynchronous contexts.
8+
9+
## 1. Execution Context & Exports (Critical)
10+
* **Module Export:** Every script MUST export an asynchronous function that accepts an object containing the `github-script` injected variables (e.g., `export default async ({ github, context, core, process }) => { ... }`). The exception to this is the backport-issues.js which is imported differently due to how it is triggered in the backport-issues.yml.
11+
* **No Manual Instantiation:** Never manually import or instantiate `@actions/github` or `@actions/core`. Rely strictly on the parameters passed into the exported function.
12+
13+
## 2. GitHub API (Octokit) Usage
14+
* **Pagination:** Use `github.paginate` for any REST API calls that return arrays (like listing pull requests or issues) to ensure all results are fetched.
15+
* **REST vs GraphQL:** Prefer `github.rest.[endpoint]` for standard operations. If using GraphQL via `github.graphql`, ensure the query string is well-formed and variables are passed securely.
16+
* **Await Everything:** Ensure every `github.rest.*` or `core.*` asynchronous method is properly prefixed with `await`.
17+
18+
## 3. Security & Input Handling
19+
* **Untrusted Payload Data:** Treat all data from `context.payload` (PR titles, issue bodies, author names) as untrusted user input. Sanitize inputs before using them in regex evaluations or logging.
20+
* **Graceful Failures:** Use `try/catch` blocks around API calls. On failure, use `core.setFailed(error.message)` to fail the workflow step gracefully and provide an actionable error message.
21+
22+
## 4. Actions UI Logging & Outputs
23+
* **Actions Logging:** Use `core.info()`, `core.notice()`, `core.warning()`, and `core.error()` instead of `console.log()`. This ensures logs are properly highlighted and annotated in the GitHub Actions UI.
24+
* **Step Outputs:** Set workflow outputs explicitly using `core.setOutput('name', value)` rather than relying on the return value of the script, unless specifically configured to do so.
25+
26+
## Review Constraints
27+
* Provide the exact refactored JavaScript code block in your recommendation.
Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
applyTo: "**/*.go"
3+
---
4+
5+
# Go PR Review Standards
6+
7+
You are a strict code reviewer. Enforce the following Go (Golang) standards on all code changes. Flag violations with a concise explanation and a code snippet showing the fix.
8+
9+
## 1. Error Handling (Critical)
10+
* **Check errors immediately:** Never ignore errors using `_` unless explicitly documented why it is safe.
11+
* **Wrap errors:** Always use `fmt.Errorf("...: %w", err)` to wrap errors and preserve the original error context.
12+
* **No Panics:** Never use `panic()` for normal control flow or error handling. Reserve `panic` only for truly unrecoverable initialization errors.
13+
* **Avoid nested `if` for errors:** Handle errors and return early to keep the \"happy path\" left-aligned.
14+
15+
## 2. Concurrency & Context
16+
* **Pass Context first:** The first parameter of any function making network calls, database queries, or blocking operations MUST be `ctx context.Context`.
17+
* **Never store Context:** Contexts should flow through functions, never be stored in structs.
18+
* **Prevent Goroutine leaks:** Ensure every launched goroutine has a clear exit path. Use `sync.WaitGroup` or `golang.org/x/sync/errgroup` to manage lifecycles.
19+
* **Channel safety:** Always close channels from the sender side, never the receiver side.
20+
21+
## 3. Naming Conventions
22+
* **Exported vs Unexported:** Use `PascalCase` for exported identifiers and `camelCase` for unexported ones. Never use `snake_case`.
23+
* **Keep locals short, globals descriptive:** Use short names for limited scopes (e.g., `i` for index, `r` for reader, `err` for error). Use descriptive names for package-level variables and functions.
24+
* **Interface names:** Interfaces with a single method should end in `-er` (e.g., `Reader`, `Writer`, `Formatter`).
25+
* **Getters:** Do not use `Get` in getter names. Use `User()` instead of `GetUser()`.
26+
27+
## 4. Architecture & State
28+
* **Dependency Injection:** Pass dependencies as interfaces rather than concrete structs to make code testable.
29+
* **Pointer vs Value:** Use pointers for structs when you need to mutate the state or when the struct is very large. Otherwise, pass by value to reduce GC pressure.
30+
* **Avoid global state:** Do not use package-level mutable variables (`var`). Use dependency injection instead.
31+
* **Naked Returns:** Never use naked returns (returning without explicitly naming the variables) in functions longer than 5 lines.
32+
33+
## 5. Standard Library & Tools
34+
* **HTTP Clients:** Never use the default `http.Client` in production code. Always specify explicit timeouts (`Timeout: 10 * time.Second`).
35+
* **Slices/Maps allocation:** If the final size of a slice or map is known, pre-allocate it using `make([]T, 0, capacity)` to avoid reallocation overhead.
36+
37+
## Review Constraints
38+
* Assume the codebase uses `gofmt` and `goimports`. DO NOT comment on spacing, bracket placement, or trailing commas.
39+
* Provide the exact refactored Go code block in your recommendation.
Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
---
2+
applyTo: "**/*.tf"
3+
---
4+
5+
# Terraform PR Review Standards
6+
7+
You are a strict infrastructure-as-code reviewer. Enforce the following Terraform (HCL) standards on all code changes. Flag violations with a concise explanation and provide the refactored code block.
8+
9+
## 1. Security & State (Critical)
10+
* **No Secrets in Code:** NEVER allow hardcoded secrets, passwords, or tokens in `.tf` files. All secrets must be passed via variables and marked with `sensitive = true`.
11+
* **State Protection:** Never allow the creation of local `terraform.tfstate` backends in production modules.
12+
* **Least Privilege:** Flag overly permissive IAM roles, overly broad security group ingress/egress rules (e.g., `0.0.0.0/0` unless explicitly intended), or disabled security features.
13+
14+
## 2. Variables and Outputs
15+
* **Strict Typing:** All `variable` blocks MUST have an explicit `type`. Do not use `type = any` unless strictly necessary for complex dynamic inputs.
16+
* **Descriptions:** Every `variable` and `output` MUST have a meaningful `description`. Do not just repeat the variable name.
17+
* **Defaults:** Do not use `null` as a default for collections. Use empty lists `[]` or maps `{}` instead.
18+
19+
## 3. Resource & Module Configuration
20+
* **Naming Conventions:** Use `snake_case` for all resources, data sources, variables, outputs, and locals. Keep names descriptive but concise.
21+
* **Attribute Ordering:** Group resource attributes logically: put required arguments first, followed by optional arguments, and finally `lifecycle` or `depends_on` blocks.
22+
* **Implicit vs Explicit Dependencies:** Avoid using explicit `depends_on` unless absolutely necessary (e.g., when a resource depends on another via a side effect, not an attribute reference). Rely on implicit dependencies via interpolation whenever possible.
23+
* **Count vs For_Each:** Prefer `for_each` with maps or sets over `count` for resource replication to prevent disruptive state shifts when list items are removed. Use `count` only for simple boolean toggles (e.g., `count = var.create_resource ? 1 : 0`).
24+
25+
## 4. Code Organization & Maintainability
26+
* **Locals:** Use `locals` blocks to centralize repeated expressions, complex logic, or string interpolations. Do not repeat complex logic across multiple resources.
27+
* **Data Sources:** Prefer `data` sources to fetch external infrastructure IDs dynamically rather than hardcoding ARNs or IDs.
28+
* **Dynamic Blocks:** Use `dynamic` blocks for nested configurations that need to be generated conditionally or iteratively based on variables.
29+
30+
## Review Constraints
31+
* Assume the code will be formatted using `terraform fmt`. DO NOT comment on standard indentation or spacing.
32+
* Provide the exact refactored HCL block in your recommendation.
Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
---
2+
applyTo: ".github/workflows/**/*.{yml,yaml}"
3+
---
4+
5+
# GitHub Actions Workflow PR Review Standards
6+
7+
As a strict DevSecOps CI/CD reviewer, enforce these standards on all workflow changes. Flag violations with a concise explanation and provide the refactored YAML.
8+
9+
## 1. Security (Critical)
10+
* **Least Privilege:** All workflows and jobs must define explicit `permissions:`. Default to `read-all` or `permissions: {}` at the top level. Set scopes to `none` as needed.
11+
* **Pin Actions by SHA:** Pin all actions (including `actions/*`, `github/*`, `rancher/*`) to a full 40-character commit SHA, not a tag. The `uses:` line MUST include the version and a repository link in a comment (e.g., `# v6.0.2 https://github.com/actions/checkout`). Exception: `rancher-eio/read-vault-secrets`.
12+
* **Prevent Script Injection:** Never inline untrusted context variables in `run` scripts. Use environment variables (e.g., `env: VAR: ${{...}}`).
13+
* **No `pull_request_target`:** This trigger is banned.
14+
15+
## 2. Reliability & Performance
16+
* **Explicit Timeouts:** Every `job` must have an explicit `timeout-minutes`. Don't use the 360-minute default.
17+
* **Concurrency:** Use `concurrency` blocks in PR workflows to cancel redundant runs (e.g., `group: ${{ github.workflow }}-${{ github.ref }}`).
18+
* **Caching:** Suggest `actions/cache` or action-specific caching to speed up dependency downloads.
19+
20+
## 3. Structure & Maintainability
21+
* **Descriptive Names:** All workflows, jobs, and steps need a descriptive `name`.
22+
* **Reusable Logic:** For `run` blocks over 30 lines, extract to a script or composite action. Exception: `pull_request.yaml` (runs on user fork).
23+
* **Environment Protection:** Jobs with production secrets must use an `environment:` block for manual approval.
24+
* **No Inline GitHub-Scripts:** Do not use inline JavaScript in `actions/github-script`. Import scripts from `.github/workflows/scripts/`. Exceptions: `pull_request.yaml` and `backport-issues.yml`.
25+
26+
## Review Constraints
27+
* Ignore basic YAML formatting unless it's a syntax error.
28+
* Provide the exact refactored YAML block in your recommendation.

.github/workflows/fossa.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY
2727
2828
- name: FOSSA scan
29-
uses: fossas/fossa-action@main
29+
uses: fossas/fossa-action@edcc58279d396837acb02a1317ffa24dabfb7cc9 # v1.8.0+ https://github.com/fossas/fossa-action
3030
with:
3131
api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
3232
# Only run the scan and don't provide/return any results back to the pipeline.

.github/workflows/manual-rc-release.yml

Lines changed: 25 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
name: Manually Create RC Release
2-
32
on:
43
workflow_dispatch:
54
inputs:
@@ -13,16 +12,21 @@ on:
1312
description: 'The rc tag to create, e.g. v1.2.3-rc.1'
1413
required: true
1514

16-
permissions:
17-
contents: write
18-
id-token: write
19-
issues: write
20-
pull-requests: write
21-
actions: read
15+
env:
16+
NIX_INSTALL_SHA: de490f61fcbaf9a5cabf2fa621ddb9ef93ad35d9a23a04e7d51b26e092b63691
17+
NIX_INSTALL_VERSION: 2.34.4
18+
19+
permissions: {}
2220

2321
jobs:
2422
rc-release:
2523
runs-on: ubuntu-latest
24+
permissions:
25+
contents: write
26+
id-token: write
27+
issues: write
28+
pull-requests: write
29+
actions: read
2630
steps:
2731
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script/commits/main
2832
id: check-user-in-maintainers
@@ -113,15 +117,25 @@ jobs:
113117
go-version-file: ${{ github.workspace }}/tags/${{ inputs.tag }}/go.mod
114118
cache-dependency-path: ${{ github.workspace }}/tags/${{ inputs.tag }}/go.sum
115119
cache: true
120+
- name: install-nix
121+
run: |
122+
curl -L -o nix_install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
123+
echo "${NIX_INSTALL_SHA} nix_install.sh" | sha256sum -c -
124+
chmod +x nix_install.sh
125+
./nix_install.sh
126+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
127+
nix --version
128+
rm -f ./nix_install.sh
116129
- name: Run GoReleaser
117-
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 https://github.com/goreleaser/goreleaser-action
118-
with:
119-
args: release --clean --skip=validate --config ../../.goreleaser_rc.yml
120-
workdir: ${{ github.workspace }}/tags/${{ inputs.tag }}
130+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep TAG --keep GPG_KEY_ID --keep GPG_PASSPHRASE --keep HOME --keep SSH_AUTH_SOCK --keep GITHUB_TOKEN --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
121131
env:
122132
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
123133
GPG_KEY_ID: ${{ env.GPG_KEY_ID }}
124134
GPG_PASSPHRASE: ${{ env.GPG_PASSPHRASE }}
135+
TAG: ${{ inputs.tag }}
136+
run: |-
137+
cd ${{ github.workspace }}/tags/$TAG
138+
goreleaser release --clean --skip=validate --config ../../.goreleaser_rc.yml
125139
- name: 'Find Issues and Create Comments'
126140
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script
127141
env:

.github/workflows/manual-release.yml

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
name: Manually Create Full Release
2-
32
on:
43
workflow_dispatch:
54
inputs:
@@ -10,14 +9,19 @@ on:
109
description: 'The commit SHA to create the tag from, defaults to HEAD of the selected branch.'
1110
required: false
1211

13-
permissions:
14-
contents: write
15-
id-token: write
16-
actions: read
12+
env:
13+
NIX_INSTALL_SHA: de490f61fcbaf9a5cabf2fa621ddb9ef93ad35d9a23a04e7d51b26e092b63691
14+
NIX_INSTALL_VERSION: 2.34.4
15+
16+
permissions: {}
1717

1818
jobs:
1919
release:
2020
runs-on: ubuntu-latest
21+
permissions:
22+
contents: write
23+
id-token: write
24+
actions: read
2125
steps:
2226
- uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 https://github.com/actions/github-script/commits/main
2327
id: check-user-in-maintainers
@@ -106,12 +110,22 @@ jobs:
106110
go-version-file: ${{ github.workspace }}/tags/${{ inputs.tag }}/go.mod
107111
cache-dependency-path: ${{ github.workspace }}/tags/${{ inputs.tag }}/go.sum
108112
cache: true
113+
- name: install-nix
114+
run: |
115+
curl -L -o nix_install.sh "https://releases.nixos.org/nix/nix-${NIX_INSTALL_VERSION}/install"
116+
echo "${NIX_INSTALL_SHA} nix_install.sh" | sha256sum -c -
117+
chmod +x nix_install.sh
118+
./nix_install.sh
119+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
120+
nix --version
121+
rm -f ./nix_install.sh
109122
- name: Run GoReleaser
110-
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 https://github.com/goreleaser/goreleaser-action
111-
with:
112-
args: release --clean --skip=validate --config ../../.goreleaser.yml
113-
workdir: ${{ github.workspace }}/tags/${{ inputs.tag }}
123+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep HOME --keep SSH_AUTH_SOCK --keep TAG --keep GPG_KEY_ID --keep GPG_PASSPHRASE --keep GITHUB_TOKEN --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
114124
env:
115125
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
116126
GPG_KEY_ID: ${{ env.GPG_KEY_ID }}
117127
GPG_PASSPHRASE: ${{ env.GPG_PASSPHRASE }}
128+
TAG: ${{ inputs.tag }}
129+
run: |-
130+
cd ${{ github.workspace }}/tags/$TAG
131+
goreleaser release --clean --skip=validate --config ../../.goreleaser.yml

0 commit comments

Comments
 (0)