Merge remote-tracking branch 'upstream/stable'

Author: moulalis

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
   "appPort": 8080,
   "features": {
     "ghcr.io/devcontainers/features/go:1": {
-      "version": "1.24"
+      "version": "1.26"
     },
     "ghcr.io/devcontainers/features/node:1": {
       "version": "20"

.github/actions/setup-go/action.yml

@@ -0,0 +1,30 @@
+name: "Set up Go"
+description: "Installs Go from Red Hat go-toolset image (includes FIPS support)"
+runs:
+  using: composite
+  steps:
+    - name: Extract Go from go-toolset
+      shell: bash
+      env:
+        GO_TOOLSET_IMAGE: "registry.access.redhat.com/ubi9/go-toolset:1.26.3@sha256:d36470d5258da00f618b7aca9bdaab8e05134aa938bd6c42d9bd17d50ed45e76"
+      run: |
+        set -euo pipefail
+        docker rm -f go-toolset 2>/dev/null || true
+        docker create --name go-toolset "$GO_TOOLSET_IMAGE"
+        docker cp go-toolset:/usr/lib/golang $HOME/go-toolset
+        docker rm go-toolset
+        echo "GOROOT=$HOME/go-toolset" >> $GITHUB_ENV
+        echo "$HOME/go-toolset/bin" >> $GITHUB_PATH
+        echo "$HOME/go/bin" >> $GITHUB_PATH
+    - name: Verify Go installation
+      shell: bash
+      run: go version
+    - name: Cache Go modules and build cache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830  # v4
+      with:
+        path: |
+          ~/go/pkg/mod
+          ~/.cache/go-build
+        key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          go-${{ runner.os }}-

.github/workflows/changelog.yaml

@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: write  # for peter-evans/create-pull-request to create branch
       pull-requests: write  # for peter-evans/create-pull-request to create a PR
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:

.github/workflows/ci-build.yaml

@@ -41,7 +41,7 @@ jobs:
       codegen: ${{ steps.changed-files.outputs.codegen_any_modified == 'true' }}
       lint: ${{ steps.changed-files.outputs.lint_any_modified == 'true' }}
       ui: ${{ steps.changed-files.outputs.ui_any_modified == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
@@ -126,14 +126,11 @@ jobs:
     name: Unit Tests
     needs: [ changed-files ]
     if: ${{ needs.changed-files.outputs.tests == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          go-version: "1.24"
-          cache: true
+      - uses: ./.github/actions/setup-go
       - run: make test STATIC_FILES=false GOTEST='go test -p 20 -covermode=atomic -coverprofile=coverage.out'
       - name: Upload coverage report
         # engineers just ignore this in PRs, so lets not even run it
@@ -147,14 +144,14 @@ jobs:
   tests-windows:
     name: Windows Unit Tests
     needs: [ changed-files ]
-    if: ${{ needs.changed-files.outputs.tests == 'true' }}
+    if: false # Disabled: godebug fips140=auto requires Red Hat go-toolset, which is not available on Windows
     runs-on: windows-2022
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
           cache: true
       # windows run does not use makefile target because it does a lot more than just testing and is not cross-platform compatible
       - run: go test -p 20 -covermode=atomic -coverprofile='coverage.out' $(go list ./... | select-string -Pattern 'github.com/argoproj/argo-workflows/v3/workflow/controller' , 'github.com/argoproj/argo-workflows/v3/server' -NotMatch)
@@ -172,7 +169,7 @@ jobs:
   argo-images:
     name: argo-images
     # needs: [ lint ]
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     strategy:
       fail-fast: false
@@ -203,7 +200,7 @@ jobs:
     name: E2E Tests
     needs: [ changed-files, argo-images ]
     if: ${{ needs.changed-files.outputs.e2e-tests == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     # These tests usually finish in ~25m, but occasionally they take much longer due to resource
     # contention on the runner, which we have no control over.
     timeout-minutes: 60
@@ -268,10 +265,7 @@ jobs:
       - name: Install socat (needed by Kubernetes)
         run: sudo apt-get -y install socat
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          go-version: "1.24"
-          cache: true
+      - uses: ./.github/actions/setup-go
       - name: Install Java for the SDK
         if: ${{matrix.test == 'test-java-sdk'}}
         uses: actions/setup-java@387ac29b308b003ca37ba93a6cab5eb57c8f5f93 # v4.0.0
@@ -386,7 +380,7 @@ jobs:
     name: E2E Tests - Composite result
     needs: [ e2e-tests ]
     if: ${{ always() }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - run: |
           result="${{ needs.e2e-tests.result }}"
@@ -401,16 +395,13 @@ jobs:
     name: Codegen
     needs: [ changed-files ]
     if: ${{ needs.changed-files.outputs.codegen == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     env:
       GOPATH: /home/runner/go
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          go-version: "1.24"
-          cache: true
+      - uses: ./.github/actions/setup-go
       - name: Install protoc
         run: |
           set -eux -o pipefail
@@ -438,16 +429,13 @@ jobs:
     name: Lint
     needs: [ changed-files ]
     if: ${{ needs.changed-files.outputs.lint == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 15 # must be strictly greater than the timeout in .golangci.yml
     env:
       GOPATH: /home/runner/go
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
-        with:
-          go-version: "1.24"
-          cache: true
+      - uses: ./.github/actions/setup-go
       - run: make lint STATIC_FILES=false
       # if lint makes changes that are not in the PR, fail the build
       - name: Check if lint made changes not present in the PR
@@ -460,7 +448,7 @@ jobs:
     name: UI
     needs: [ changed-files ]
     if: ${{ needs.changed-files.outputs.ui == 'true' }}
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 6
     env:
       NODE_OPTIONS: --max-old-space-size=4096

.github/workflows/dependabot-reviewer.yml

@@ -11,7 +11,7 @@ jobs:
     permissions:
       pull-requests: write # for approving a PR
       contents: write # for enabling auto-merge on a PR
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - name: Dependabot metadata
         id: metadata

.github/workflows/docs.yaml

@@ -20,7 +20,7 @@ permissions:
 
 jobs:
   docs:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     if: >
       (
         github.event_name == 'issue_comment' &&
@@ -37,7 +37,7 @@ jobs:
           python-version: 3.9
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: "19"

.github/workflows/pr.yaml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   title-check:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - name: Check PR Title's semantic conformance
         uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3

.github/workflows/release.yaml

@@ -23,7 +23,7 @@ jobs:
   build-linux:
     name: Build & push linux
     if: github.repository == 'argoproj/argo-workflows'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         platform: [ linux/amd64, linux/arm64 ]
@@ -150,7 +150,7 @@ jobs:
   push-images:
     name: Push manifest with all images
     if: github.repository == 'argoproj/argo-workflows'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: [ build-linux, build-windows ]
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
@@ -215,7 +215,7 @@ jobs:
   test-images-linux-amd64:
     name: Try pulling linux/amd64
     if: github.repository == 'argoproj/argo-workflows'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: [ push-images ]
     strategy:
       matrix:
@@ -292,7 +292,7 @@ jobs:
   publish-release:
     permissions:
       contents: write  # for softprops/action-gh-release to create GitHub release
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     if: github.repository == 'argoproj/argo-workflows'
     needs: [ push-images, test-images-linux-amd64, test-images-windows ]
     env:
@@ -306,7 +306,7 @@ jobs:
           node-version: "20" # change in all GH Workflows
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version-file: go.mod
       - name: Restore node packages cache
         uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:

.github/workflows/retest.yaml

@@ -12,7 +12,7 @@ jobs:
     if: github.event.issue.pull_request && github.event.comment.author_association == 'MEMBER' && github.event.comment.body == '/retest'
     permissions:
       actions: write # for re-running failed jobs: https://docs.github.com/en/rest/actions/workflow-runs?apiVersion=2022-11-28#re-run-a-job-from-a-workflow-run
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
       - name: Re-run failed jobs for this PR
         env:

.github/workflows/sdks.yaml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       packages: write # for publishing packages
       contents: write  # for creating releases
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         name: