diff --git a/.github/chainguard/make-self-upgrade.sts.yaml b/.github/chainguard/make-self-upgrade.sts.yaml new file mode 100644 index 0000000..113d7bd --- /dev/null +++ b/.github/chainguard/make-self-upgrade.sts.yaml @@ -0,0 +1,10 @@ +# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead. + +issuer: https://token.actions.githubusercontent.com +subject_pattern: ^repo:cert-manager/helm-tool:ref:refs/heads/(main|master)$ + +permissions: + contents: write + pull_requests: write + workflows: write diff --git a/.github/workflows/make-self-upgrade.yaml b/.github/workflows/make-self-upgrade.yaml new file mode 100644 index 0000000..c376864 --- /dev/null +++ b/.github/workflows/make-self-upgrade.yaml @@ -0,0 +1,114 @@ +# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml instead. + +name: make-self-upgrade +concurrency: make-self-upgrade +on: + workflow_dispatch: {} + schedule: + - cron: '0 0 * * *' + +permissions: + contents: read + +jobs: + self_upgrade: + runs-on: ubuntu-latest + + if: github.repository == 'cert-manager/helm-tool' + + permissions: + id-token: write + + env: + SOURCE_BRANCH: "${{ github.ref_name }}" + SELF_UPGRADE_BRANCH: "self-upgrade-${{ github.ref_name }}" + + steps: + - name: Fail if branch is not head of branch. + if: ${{ !startsWith(github.ref, 'refs/heads/') && env.SOURCE_BRANCH != '' && env.SELF_UPGRADE_BRANCH != '' }} + run: | + echo "This workflow should not be run on a non-branch-head." + exit 1 + + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # v1.0.1 + id: octo-sts + with: + scope: 'cert-manager/helm-tool' + identity: make-self-upgrade + + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + # Adding `fetch-depth: 0` makes sure tags are also fetched. We need + # the tags so `git describe` returns a valid version. + # see https://github.com/actions/checkout/issues/701 for extra info about this option + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} + + - id: go-version + run: | + make print-go-version >> "$GITHUB_OUTPUT" + + - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 + with: + go-version: ${{ steps.go-version.outputs.result }} + + - run: | + git checkout -B "$SELF_UPGRADE_BRANCH" + + - run: | + make -j upgrade-klone + make -j generate + + - id: is-up-to-date + shell: bash + run: | + git_status=$(git status -s) + is_up_to_date="true" + if [ -n "$git_status" ]; then + is_up_to_date="false" + echo "The following changes will be committed:" + echo "$git_status" + fi + echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" + + - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} + run: | + git config --global user.name "cert-manager-bot" + git config --global user.email "cert-manager-bot@users.noreply.github.com" + git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff + git push -f origin "$SELF_UPGRADE_BRANCH" + + - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + github-token: ${{ steps.octo-sts.outputs.token }} + script: | + const { repo, owner } = context.repo; + const pulls = await github.rest.pulls.list({ + owner: owner, + repo: repo, + head: owner + ':' + process.env.SELF_UPGRADE_BRANCH, + base: process.env.SOURCE_BRANCH, + state: 'open', + }); + + if (pulls.data.length < 1) { + const result = await github.rest.pulls.create({ + title: '[CI] Merge ' + process.env.SELF_UPGRADE_BRANCH + ' into ' + process.env.SOURCE_BRANCH, + owner: owner, + repo: repo, + head: process.env.SELF_UPGRADE_BRANCH, + base: process.env.SOURCE_BRANCH, + body: [ + 'This PR is auto-generated to bump the Makefile modules.', + ].join('\n'), + }); + await github.rest.issues.addLabels({ + owner, + repo, + issue_number: result.data.number, + labels: ['ok-to-test', 'skip-review', 'release-note-none', 'kind/cleanup'] + }); + } diff --git a/klone.yaml b/klone.yaml index 4015108..b3f784f 100644 --- a/klone.yaml +++ b/klone.yaml @@ -10,45 +10,45 @@ targets: - folder_name: boilerplate repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/boilerplate - folder_name: cert-manager repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/cert-manager - folder_name: executable repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/executable - folder_name: generate-verify repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/generate-verify - folder_name: go repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/go - folder_name: help repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/help - folder_name: klone repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/klone - folder_name: repository-base repo_url: https://github.com/cert-manager/makefile-modules.git - repo_ref: renovate-preset - repo_hash: b89fe0aee778669f651fc5cbe667de3fc32a7d44 + repo_ref: main + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/repository-base - folder_name: tools repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 6fc870c9c2a1bef827834ee66fca9dfce748c518 + repo_hash: bbb99406df3c48021577890e2b8f1d9948358bfe repo_path: modules/tools diff --git a/make/_shared/repository-base/01_mod.mk b/make/_shared/repository-base/01_mod.mk index 0d094c2..5b7831e 100644 --- a/make/_shared/repository-base/01_mod.mk +++ b/make/_shared/repository-base/01_mod.mk @@ -16,7 +16,8 @@ ifndef repo_name $(error repo_name is not set) endif -repository_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/ +_repository_base_module_dir := $(dir $(lastword $(MAKEFILE_LIST))) +repository_base_dir := $(_repository_base_module_dir)base/ .PHONY: generate-base ## Generate base files in the repository @@ -27,5 +28,9 @@ generate-base: find . -type f | while read file; do \ sed "s|{{REPLACE:GH-REPOSITORY}}|$(repo_name:github.com/%=%)|g" "$$file" > "$(CURDIR)/$$file"; \ done + if [ ! -e ./.github/renovate.json5 ]; then \ + mkdir -p ./.github; \ + cp $(_repository_base_module_dir)/renovate-bootstrap-config.json5 ./.github/renovate.json5; \ + fi shared_generate_targets += generate-base diff --git a/make/_shared/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/make/_shared/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml new file mode 100644 index 0000000..310ca5c --- /dev/null +++ b/make/_shared/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml @@ -0,0 +1,10 @@ +# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead. + +issuer: https://token.actions.githubusercontent.com +subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ + +permissions: + contents: write + pull_requests: write + workflows: write diff --git a/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml b/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml new file mode 100644 index 0000000..3be9554 --- /dev/null +++ b/make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml @@ -0,0 +1,114 @@ +# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. +# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml instead. + +name: make-self-upgrade +concurrency: make-self-upgrade +on: + workflow_dispatch: {} + schedule: + - cron: '0 0 * * *' + +permissions: + contents: read + +jobs: + self_upgrade: + runs-on: ubuntu-latest + + if: github.repository == '{{REPLACE:GH-REPOSITORY}}' + + permissions: + id-token: write + + env: + SOURCE_BRANCH: "${{ github.ref_name }}" + SELF_UPGRADE_BRANCH: "self-upgrade-${{ github.ref_name }}" + + steps: + - name: Fail if branch is not head of branch. + if: ${{ !startsWith(github.ref, 'refs/heads/') && env.SOURCE_BRANCH != '' && env.SELF_UPGRADE_BRANCH != '' }} + run: | + echo "This workflow should not be run on a non-branch-head." + exit 1 + + - name: Octo STS Token Exchange + uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # v1.0.1 + id: octo-sts + with: + scope: '{{REPLACE:GH-REPOSITORY}}' + identity: make-self-upgrade + + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + # Adding `fetch-depth: 0` makes sure tags are also fetched. We need + # the tags so `git describe` returns a valid version. + # see https://github.com/actions/checkout/issues/701 for extra info about this option + with: + fetch-depth: 0 + token: ${{ steps.octo-sts.outputs.token }} + + - id: go-version + run: | + make print-go-version >> "$GITHUB_OUTPUT" + + - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 + with: + go-version: ${{ steps.go-version.outputs.result }} + + - run: | + git checkout -B "$SELF_UPGRADE_BRANCH" + + - run: | + make -j upgrade-klone + make -j generate + + - id: is-up-to-date + shell: bash + run: | + git_status=$(git status -s) + is_up_to_date="true" + if [ -n "$git_status" ]; then + is_up_to_date="false" + echo "The following changes will be committed:" + echo "$git_status" + fi + echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" + + - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} + run: | + git config --global user.name "cert-manager-bot" + git config --global user.email "cert-manager-bot@users.noreply.github.com" + git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff + git push -f origin "$SELF_UPGRADE_BRANCH" + + - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} + uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + with: + github-token: ${{ steps.octo-sts.outputs.token }} + script: | + const { repo, owner } = context.repo; + const pulls = await github.rest.pulls.list({ + owner: owner, + repo: repo, + head: owner + ':' + process.env.SELF_UPGRADE_BRANCH, + base: process.env.SOURCE_BRANCH, + state: 'open', + }); + + if (pulls.data.length < 1) { + const result = await github.rest.pulls.create({ + title: '[CI] Merge ' + process.env.SELF_UPGRADE_BRANCH + ' into ' + process.env.SOURCE_BRANCH, + owner: owner, + repo: repo, + head: process.env.SELF_UPGRADE_BRANCH, + base: process.env.SOURCE_BRANCH, + body: [ + 'This PR is auto-generated to bump the Makefile modules.', + ].join('\n'), + }); + await github.rest.issues.addLabels({ + owner, + repo, + issue_number: result.data.number, + labels: ['ok-to-test', 'skip-review', 'release-note-none', 'kind/cleanup'] + }); + } diff --git a/make/_shared/repository-base/renovate-bootstrap-config.json5 b/make/_shared/repository-base/renovate-bootstrap-config.json5 new file mode 100644 index 0000000..ce9d622 --- /dev/null +++ b/make/_shared/repository-base/renovate-bootstrap-config.json5 @@ -0,0 +1,6 @@ +{ + $schema: 'https://docs.renovatebot.com/renovate-schema.json', + extends: [ + 'github>cert-manager/renovate-config:default.json5', + ], +} diff --git a/make/_shared/tools/00_mod.mk b/make/_shared/tools/00_mod.mk index ae5ee97..a21180c 100644 --- a/make/_shared/tools/00_mod.mk +++ b/make/_shared/tools/00_mod.mk @@ -80,7 +80,7 @@ tools += azwi=v1.5.1 tools += kyverno=v1.15.1 # https://github.com/mikefarah/yq/releases # renovate: datasource=github-releases packageName=mikefarah/yq -tools += yq=v4.47.1 +tools += yq=v4.47.2 # https://github.com/ko-build/ko/releases # renovate: datasource=github-releases packageName=ko-build/ko tools += ko=0.18.0 @@ -92,7 +92,7 @@ tools += protoc=32.0 tools += trivy=v0.66.0 # https://github.com/vmware-tanzu/carvel-ytt/releases # renovate: datasource=github-releases packageName=vmware-tanzu/carvel-ytt -tools += ytt=v0.52.0 +tools += ytt=v0.52.1 # https://github.com/rclone/rclone/releases # renovate: datasource=github-releases packageName=rclone/rclone tools += rclone=v1.71.0 @@ -124,7 +124,7 @@ tools += gojq=v0.12.17 tools += crane=v0.20.6 # https://pkg.go.dev/google.golang.org/protobuf/cmd/protoc-gen-go?tab=versions # renovate: datasource=go packageName=google.golang.org/protobuf -tools += protoc-gen-go=v1.36.8 +tools += protoc-gen-go=v1.36.9 # https://pkg.go.dev/github.com/sigstore/cosign/v2/cmd/cosign?tab=versions # renovate: datasource=go packageName=github.com/sigstore/cosign/v2 tools += cosign=v2.5.3 @@ -136,7 +136,7 @@ tools += boilersuite=v0.1.0 tools += gomarkdoc=v1.1.0 # https://pkg.go.dev/oras.land/oras/cmd/oras?tab=versions # renovate: datasource=go packageName=oras.land/oras -tools += oras=v1.2.3 +tools += oras=v1.3.0 # https://pkg.go.dev/github.com/onsi/ginkgo/v2/ginkgo?tab=versions # The gingko version should be kept in sync with the version used in code. # If there is no go.mod file (which is only the case for the makefile-modules @@ -207,7 +207,7 @@ tools += openapi-gen=v0.0.0-20250905212525-66792eed8611 # https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/master/envtest-releases.yaml # FIXME: Find a way to configure Renovate to suggest upgrades -KUBEBUILDER_ASSETS_VERSION := v1.33.0 +KUBEBUILDER_ASSETS_VERSION := v1.34.0 tools += etcd=$(KUBEBUILDER_ASSETS_VERSION) tools += kube-apiserver=$(KUBEBUILDER_ASSETS_VERSION) @@ -516,10 +516,10 @@ $(DOWNLOAD_DIR)/tools/azwi@$(AZWI_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD tar xfO $(outfile).tar.gz azwi > $(outfile) && chmod 775 $(outfile); \ rm -f $(outfile).tar.gz -kubebuilder_tools_linux_amd64_SHA256SUM=3fb446463d20a6c4e093cb6a0facaae8bab966192a387624190fb15b34ce6abb -kubebuilder_tools_linux_arm64_SHA256SUM=56c0ab934591543b3decdf4e80a27dccccbfeeb59a1e6103ad0e935aacb34e74 -kubebuilder_tools_darwin_amd64_SHA256SUM=c63643447f9a2ee23191a0b1f32d503a8bca6df7013dd4beb9eaae7088a1bea1 -kubebuilder_tools_darwin_arm64_SHA256SUM=36a413216c7a2a11c2164eb8553a009a2997c383a6bf768cb5e3709bf36e4596 +kubebuilder_tools_linux_amd64_SHA256SUM=9c45e40aa56971b105e596ebb3e84af6742e8709cc0523733baf8d9bb725e69c +kubebuilder_tools_linux_arm64_SHA256SUM=602183b102e8871b109e426d115574375f41d67f4a41e06ad04dc1632db76485 +kubebuilder_tools_darwin_amd64_SHA256SUM=a1c7304a304f70cbdbff982ccf22c3b22710c6dfa1a7722d45297a834f178b43 +kubebuilder_tools_darwin_arm64_SHA256SUM=8afaf69ebd14177d8af37c044c28acafde016552517f42dfe732f42d2ecc52c7 .PRECIOUS: $(DOWNLOAD_DIR)/tools/kubebuilder_tools_$(KUBEBUILDER_ASSETS_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz $(DOWNLOAD_DIR)/tools/kubebuilder_tools_$(KUBEBUILDER_ASSETS_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz: | $(DOWNLOAD_DIR)/tools @@ -551,10 +551,10 @@ $(DOWNLOAD_DIR)/tools/kyverno@$(KYVERNO_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DO chmod +x $(outfile); \ rm -f $(outfile).tar.gz -yq_linux_amd64_SHA256SUM=0fb28c6680193c41b364193d0c0fc4a03177aecde51cfc04d506b1517158c2fb -yq_linux_arm64_SHA256SUM=b7f7c991abe262b0c6f96bbcb362f8b35429cefd59c8b4c2daa4811f1e9df599 -yq_darwin_amd64_SHA256SUM=a9b5ca36f7750576c6ace3cc7193349cd676b3a6bf30193fb2773ff45f5af5c2 -yq_darwin_arm64_SHA256SUM=99aae3a7c9ddfe76bb339f0e7acd8224324b6527436fb6a5d890079bf5fcc590 +yq_linux_amd64_SHA256SUM=1bb99e1019e23de33c7e6afc23e93dad72aad6cf2cb03c797f068ea79814ddb0 +yq_linux_arm64_SHA256SUM=05df1f6aed334f223bb3e6a967db259f7185e33650c3b6447625e16fea0ed31f +yq_darwin_amd64_SHA256SUM=b945c250a308f0dfcd3f034688e5e4a5275df95788b597f81a4ab450e74175d5 +yq_darwin_arm64_SHA256SUM=4ccc7f2f5f6f37804d70ad211a287b1b589f67024ecb77586c77106030424b9f .PRECIOUS: $(DOWNLOAD_DIR)/tools/yq@$(YQ_VERSION)_$(HOST_OS)_$(HOST_ARCH) $(DOWNLOAD_DIR)/tools/yq@$(YQ_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD_DIR)/tools @@ -614,10 +614,10 @@ $(DOWNLOAD_DIR)/tools/trivy@$(TRIVY_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLO chmod +x $(outfile); \ rm $(outfile).tar.gz -ytt_linux_amd64_SHA256SUM=4c222403a9a2d54d8bb0e0ca46f699ee4040a2bddd5ab3b6354efd2c85d3209f -ytt_linux_arm64_SHA256SUM=781f8950da84b2d2928b139eb38567584d9ddebc7e5a34fd97209ad61ae9cc65 -ytt_darwin_amd64_SHA256SUM=924eb899bdbb4b3652d941c7662acc434a7a35c07537e7cf48a7645b960a7ab5 -ytt_darwin_arm64_SHA256SUM=f77bcbcd71802fcb55cb0333ed7e640e6cc6e9164b757af01a6ac69f6b503b47 +ytt_linux_amd64_SHA256SUM=490f138ae5b6864071d3c20a5a231e378cee7487cd4aeffc79dbf66718e65408 +ytt_linux_arm64_SHA256SUM=7d86bd3299e43d1455201fc213d698bae7482cd88f3e05de2f935e6eab842db9 +ytt_darwin_amd64_SHA256SUM=1975e52b3b97bd9be72f4efb714562da6a80cf181f036ae1f86eec215e208498 +ytt_darwin_arm64_SHA256SUM=a205f49267a44cd495e4c8b245754d8a216931a28ef29c78ae161c370a9b6117 .PRECIOUS: $(DOWNLOAD_DIR)/tools/ytt@$(YTT_VERSION)_$(HOST_OS)_$(HOST_ARCH) $(DOWNLOAD_DIR)/tools/ytt@$(YTT_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD_DIR)/tools