diff --git a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml b/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml deleted file mode 100644 index 310ca5ca..00000000 --- a/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml +++ /dev/null @@ -1,10 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/chainguard/make-self-upgrade.sts.yaml instead. - -issuer: https://token.actions.githubusercontent.com -subject_pattern: ^repo:{{REPLACE:GH-REPOSITORY}}:ref:refs/heads/(main|master)$ - -permissions: - contents: write - pull_requests: write - workflows: write diff --git a/modules/repository-base/base/.github/renovate.json5 b/modules/repository-base/base/.github/renovate.json5 deleted file mode 100644 index d0dc1c0c..00000000 --- a/modules/repository-base/base/.github/renovate.json5 +++ /dev/null @@ -1,166 +0,0 @@ -// THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -// Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/renovate.json5 instead. - -{ - $schema: 'https://docs.renovatebot.com/renovate-schema.json', - enabled: true, - gitAuthor: 'Renovate Bot ', - gitIgnoredAuthors: [ - 'Renovate Bot ', - 'cert-manager-bot ', - ], - enabledManagers: [ - 'github-actions', - 'gomod', - ], - extends: [ - 'config:best-practices', - ':gitSignOff', - ':semanticCommits', - ':disableVulnerabilityAlerts', - ':rebaseStalePrs', - ':prConcurrentLimit10', // Set a limit to avoid too many PRs, at least on the first run - ':prHourlyLimitNone', - ], - timezone: 'Europe/London', - labels: [ - 'dependencies', - 'kind/cleanup', - 'ok-to-test', - 'release-note-none', - ], - // packageRules uses globs for matchPackageNames. Some packages have a separate major version i.e. /v on them which is when we would need package**/**. - packageRules: [ - { - groupName: 'Misc GitHub actions', - matchManagers: [ - 'github-actions', - ], - }, - { - matchManagers: [ - 'gomod', - ], - postUpgradeTasks: { - commands: [ - 'make vendor-go generate', - ], - executionMode: 'branch', - } - }, - { - groupName: 'Misc Go deps', - matchManagers: [ - 'gomod', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ], - }, - { - groupName: 'Testing Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/onsi/ginkgo/**', - 'github.com/onsi/gomega', - 'github.com/stretchr/testify', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Cloud Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/akamai/**', - 'github.com/aws/**', - 'github.com/Azure/**', - 'github.com/AzureAD/**', - 'github.com/cloudflare/**', - 'github.com/digitalocean/**', - 'google.golang.org/api', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Kubernetes Go deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'sigs.k8s.io/**', - 'k8s.io/**', - ], - matchUpdateTypes: [ - 'minor', - 'patch', - ] - }, - { - groupName: 'Kubernetes Go patches', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'k8s.io/**', - ], - matchUpdateTypes: [ - 'patch', - ], - addLabels: [ - 'skip-review', // Adding label to allow PRs to automerge - ] - }, - { - groupName: 'golang.org/x deps', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'golang.org/x/**', - ], - addLabels: [ - 'skip-review', // Adding label to allow PRs to automerge - ], - }, - { - matchManagers: [ - 'gomod', - ], - matchUpdateTypes: [ - 'major', - 'digest', - ], - dependencyDashboardApproval: true - }, - { - description: 'Disable (internal) cert-manager pseudo-version updates', - matchManagers: [ - 'gomod', - ], - matchPackageNames: [ - 'github.com/cert-manager/**', - ], - matchCurrentValue: 'v0.0.0*', - enabled: false, - }, - ], - ignorePaths: [ - '**/vendor/**', - // Exclude files that are mastered from makefile-modules and shouldn't be upgraded in projects using makefile-modules. - 'make/_shared/**', - '.github/workflows/govulncheck.yaml', - '.github/workflows/make-self-upgrade.yaml', - '.github/workflows/renovate.yaml', - ], -} diff --git a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml b/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml deleted file mode 100644 index 3be95541..00000000 --- a/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml +++ /dev/null @@ -1,114 +0,0 @@ -# THIS FILE IS AUTOMATICALLY GENERATED. DO NOT EDIT. -# Edit https://github.com/cert-manager/makefile-modules/blob/main/modules/repository-base/base/.github/workflows/make-self-upgrade.yaml instead. - -name: make-self-upgrade -concurrency: make-self-upgrade -on: - workflow_dispatch: {} - schedule: - - cron: '0 0 * * *' - -permissions: - contents: read - -jobs: - self_upgrade: - runs-on: ubuntu-latest - - if: github.repository == '{{REPLACE:GH-REPOSITORY}}' - - permissions: - id-token: write - - env: - SOURCE_BRANCH: "${{ github.ref_name }}" - SELF_UPGRADE_BRANCH: "self-upgrade-${{ github.ref_name }}" - - steps: - - name: Fail if branch is not head of branch. - if: ${{ !startsWith(github.ref, 'refs/heads/') && env.SOURCE_BRANCH != '' && env.SELF_UPGRADE_BRANCH != '' }} - run: | - echo "This workflow should not be run on a non-branch-head." - exit 1 - - - name: Octo STS Token Exchange - uses: octo-sts/action@e480437973a6f6ac2e9caa40ecabedc870d76395 # v1.0.1 - id: octo-sts - with: - scope: '{{REPLACE:GH-REPOSITORY}}' - identity: make-self-upgrade - - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - # Adding `fetch-depth: 0` makes sure tags are also fetched. We need - # the tags so `git describe` returns a valid version. - # see https://github.com/actions/checkout/issues/701 for extra info about this option - with: - fetch-depth: 0 - token: ${{ steps.octo-sts.outputs.token }} - - - id: go-version - run: | - make print-go-version >> "$GITHUB_OUTPUT" - - - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 - with: - go-version: ${{ steps.go-version.outputs.result }} - - - run: | - git checkout -B "$SELF_UPGRADE_BRANCH" - - - run: | - make -j upgrade-klone - make -j generate - - - id: is-up-to-date - shell: bash - run: | - git_status=$(git status -s) - is_up_to_date="true" - if [ -n "$git_status" ]; then - is_up_to_date="false" - echo "The following changes will be committed:" - echo "$git_status" - fi - echo "result=$is_up_to_date" >> "$GITHUB_OUTPUT" - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - run: | - git config --global user.name "cert-manager-bot" - git config --global user.email "cert-manager-bot@users.noreply.github.com" - git add -A && git commit -m "BOT: run 'make upgrade-klone' and 'make generate'" --signoff - git push -f origin "$SELF_UPGRADE_BRANCH" - - - if: ${{ steps.is-up-to-date.outputs.result != 'true' }} - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 - with: - github-token: ${{ steps.octo-sts.outputs.token }} - script: | - const { repo, owner } = context.repo; - const pulls = await github.rest.pulls.list({ - owner: owner, - repo: repo, - head: owner + ':' + process.env.SELF_UPGRADE_BRANCH, - base: process.env.SOURCE_BRANCH, - state: 'open', - }); - - if (pulls.data.length < 1) { - const result = await github.rest.pulls.create({ - title: '[CI] Merge ' + process.env.SELF_UPGRADE_BRANCH + ' into ' + process.env.SOURCE_BRANCH, - owner: owner, - repo: repo, - head: process.env.SELF_UPGRADE_BRANCH, - base: process.env.SOURCE_BRANCH, - body: [ - 'This PR is auto-generated to bump the Makefile modules.', - ].join('\n'), - }); - await github.rest.issues.addLabels({ - owner, - repo, - issue_number: result.data.number, - labels: ['ok-to-test', 'skip-review', 'release-note-none', 'kind/cleanup'] - }); - }