.ci-scripts/yamlconfig.yaml

@@ -5,11 +5,13 @@ extends: default
 ignore: |
   bundle/**
   config/**
-  controllers/test/scc-crd.yml
-  controllers/test/populator.storage.k8s.io_volumepopulators.yaml
+  internal/controller/test/scc-crd.yml
+  internal/controller/test/populator.storage.k8s.io_volumepopulators.yaml
   custom-scorecard-tests/**
   hack/crds/*
   helm/volsync/**
+  .krew.yaml
+  .tekton/*
 rules:
   comments:  # renovate-bot dosen't put 2 spaces before the version number
     ignore: |

.github/workflows/operator.yml

@@ -13,12 +13,13 @@ on:  # yamllint disable-line rule:truthy
   workflow_dispatch:
 
 env:
-  GO_VERSION: "1.22"
-  KIND_VERSION: "0.25.0"
+  GO_VERSION: "1.23"
+  KIND_VERSION: "0.27.0"
   GO111MODULE: "on"
   OPERATOR_IMAGE: "quay.io/backube/volsync"
   CUSTOM_SCORECARD_IMAGE: "quay.io/backube/volsync-custom-scorecard-tests"
   DOCKER_BUILDKIT: "1"
+  FFWD_RELEASE_BRANCH: "" # set to "" to skip ffwding from main to this branch
 
 jobs:
   lint:
@@ -30,9 +31,9 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.10'
+          python-version: '3.13'
           cache: 'pip'
 
       - name: Setup Ruby
@@ -51,7 +52,7 @@ jobs:
           echo "ImageVersion=${ImageVersion}" >> $GITHUB_ENV
 
       - name: Enable cache for pre-commit hooks
-        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.ImageOS }}|${{ env.ImageVersion }}|${{ env.PYHASH }}|${{ hashFiles('.pre-commit-config.yaml') }}
@@ -73,7 +74,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -88,8 +89,8 @@ jobs:
           echo "DEF_BRANCH_NAME: $DEF_BRANCH_NAME"
 
           CUST_IMG_TAG=$TGT_BRANCH_NAME
-          # For main use "latest"
-          if [ "$TGT_BRANCH_NAME" == "$DEF_BRANCH_NAME" ]; then
+          # For main or the ffwing branch (will match main), use "latest"
+          if [ "$TGT_BRANCH_NAME" == "$DEF_BRANCH_NAME" ] || [ "$TGT_BRANCH_NAME" == "$FFWD_RELEASE_BRANCH" ]; then
             CUST_IMG_TAG="latest"
           fi
 
@@ -155,7 +156,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -174,7 +175,7 @@ jobs:
         run: make test
 
       - name: Upload test coverage
-        uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           file: ./cover.out
@@ -185,22 +186,32 @@ jobs:
 
   build-operator:
     name: Build-operator
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
 
     steps:
       - name: Checkout source
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: Determine architecture
+        id: arch
+        run: |
+          ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')"
+          echo "ARCH=$ARCH" >> $GITHUB_ENV
+
       - name: Build operator container
         run: make docker-build IMG=${OPERATOR_IMAGE}
 
       - name: Export container image
         run: docker save -o /tmp/image.tar ${OPERATOR_IMAGE}
 
       - name: Save container as artifact
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: volsync-operator
+          name: volsync-operator-${{ env.ARCH }}
           path: /tmp/image.tar
 
   build-scorecard:
@@ -212,7 +223,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Install Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
@@ -235,17 +246,22 @@ jobs:
         run: docker save -o /tmp/image.tar ${CUSTOM_SCORECARD_IMAGE}
 
       - name: Save container as artifact
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: volsync-custom-scorecard-tests-container
           path: /tmp/image.tar
 
   kubectl-plugin:
     name: kubectl-plugin
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.os }}
+
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+
     env:
       KUBECONFIG: /tmp/kubeconfig
-      KUBERNETES_VERSION: "1.25.0"
+      KUBECTL_VERSION: "1.32.2"
 
     steps:
       - name: Checkout source
@@ -255,25 +271,30 @@ jobs:
           # (required by krew validation)
           fetch-depth: 0
 
+      - name: Determine architecture
+        id: arch
+        run: |
+          ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')"
+          echo "ARCH=$ARCH" >> $GITHUB_ENV
+
       - name: Install Go
-        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
         with:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Install kubectl
         run: |
-          curl -fsSLO "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl"
+          curl -fsSLO "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/linux/${{ env.ARCH }}/kubectl"
           sudo install ./kubectl /usr/local/bin/
-          kubectl version --short --client
-          kubectl version --short --client | grep -q ${KUBERNETES_VERSION}
+          kubectl version --client
+          kubectl version --client | grep -q ${KUBECTL_VERSION}
 
       - name: Install krew
         # https://krew.sigs.k8s.io/docs/user-guide/setup/install/
         run: |
           cd "$(mktemp -d)"
           OS="$(uname | tr '[:upper:]' '[:lower:]')"
-          ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')"
-          KREW="krew-${OS}_${ARCH}"
+          KREW="krew-${OS}_${{ env.ARCH }}"
           curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz"
           tar zxvf "${KREW}.tar.gz"
           ./"${KREW}" install krew
@@ -283,18 +304,20 @@ jobs:
         run: make test-krew
 
       - name: Save cli as artifact
-        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
-          name: kubectl-volsync
+          name: kubectl-volsync-${{ env.ARCH }}
           path: bin/kubectl-volsync
 
   e2e:
     name: End-to-end
     needs: [build-operator, kubectl-plugin]
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.os }}
+
     strategy:
       fail-fast: false
       matrix:
+        os: [ubuntu-24.04]
         # There must be kindest/node images for these versions
         # See: https://hub.docker.com/r/kindest/node/tags?page=1&ordering=name
         # Or: skopeo list-tags docker://kindest/node
@@ -311,6 +334,10 @@ jobs:
           - "1.29.0"   # OCP 4.16
           - "1.30.0"   # OCP 4.17
           - "1.31.0"   # OCP 4.18
+          - "1.32.2"   # OCP 4.19
+        include:
+          - os: ubuntu-24.04-arm
+            KUBERNETES_VERSIONS: "1.32.2"   # OCP 4.19
     env:
       KUBECONFIG: /tmp/kubeconfig
       KUBERNETES_VERSION: ${{ matrix.KUBERNETES_VERSIONS }}
@@ -333,9 +360,15 @@ jobs:
           sudo ln -s bash /bin/sh.bash && sudo mv /bin/sh.bash /bin/sh
           sudo ln -s bash /usr/bin/sh.bash && sudo mv /usr/bin/sh.bash /usr/bin/sh
 
-      - name: Install kubectl
+      - name: Determine architecture
+        id: arch
         run: |
-          curl -fsSLO "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl"
+          ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')"
+          echo "ARCH=$ARCH" >> $GITHUB_ENV
+
+      - name: Install kubectl at same version as cluster
+        run: |
+          curl -fsSLO "https://dl.k8s.io/release/v${KUBERNETES_VERSION}/bin/linux/${{ env.ARCH }}/kubectl"
           sudo install ./kubectl /usr/local/bin/
           kubectl version --client
           kubectl version --client | grep -q ${KUBERNETES_VERSION}
@@ -345,7 +378,7 @@ jobs:
 
       - name: Install kind
         run: |
-          curl -fsSL -o kind https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-amd64
+          curl -fsSL -o kind https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-${{ env.ARCH }}
           sudo install ./kind /usr/local/bin && rm kind
           kind version
           kind version | grep -q ${KIND_VERSION}
@@ -363,9 +396,9 @@ jobs:
           MINIO_NAMESPACE=minio-tls MINIO_USE_TLS=1 ./hack/run-minio.sh
 
       - name: Load operator container artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          name: volsync-operator
+          name: volsync-operator-${{ env.ARCH }}
           path: /tmp
 
       - name: Import container image into cluster
@@ -388,9 +421,9 @@ jobs:
               volsync-ghaction ./helm/volsync
 
       - name: Load cli artifact
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
-          name: kubectl-volsync
+          name: kubectl-volsync-${{ env.ARCH }}
           path: bin
 
       - name: Make cli executable
@@ -400,9 +433,9 @@ jobs:
         run: kubectl -n minio wait --for=condition=Available --timeout=300s deploy/minio
 
       - name: Setup Python
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.10'
+          python-version: '3.13'
           cache: 'pipenv'
 
       - name: Install e2e prereqs
@@ -425,6 +458,42 @@ jobs:
       - name: Success
         run: echo "Previous steps were successful"
 
+  # This job is to optionally ffwd the main branch to a release branch
+  ffwd-to-release-br:
+    name: Fast forward release branch
+    needs: e2e-success
+    if: >
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
+      (github.ref == 'refs/heads/main')
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+    steps:
+      - name: Skip ffwd job check
+        if: ${{ env.FFWD_RELEASE_BRANCH == '' }}
+        run: |
+          echo "Skipping ffwding, no FFWD_RELEASE_BRANCH specified"
+
+      - name: Checkout source
+        if: ${{ env.FFWD_RELEASE_BRANCH != '' }}
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # Fetch whole history so we can see all commits
+          fetch-depth: 0
+
+      - name: ffwd
+        if: ${{ env.FFWD_RELEASE_BRANCH != '' }}
+        run: |
+          echo "ffwding $FFWD_RELEASE_BRANCH to latest from main ..."
+          git config user.name "ffwd workflow"
+          git config user.email ""
+          git fetch origin $FFWD_RELEASE_BRANCH
+          git checkout $FFWD_RELEASE_BRANCH
+          git merge origin/main --ff-only
+          git push origin $FFWD_RELEASE_BRANCH
+          echo "ffwding complete."
+
   # This is a dummy job that gates whether the container image artifacts should
   # be pushed to the registry. It is only here so that the "if" clause doesn't
   # need to be repeated for each push job.
@@ -451,6 +520,7 @@ jobs:
     with:
       artifact-name: volsync-operator
       image-name: quay.io/backube/volsync
+      multiarch: true
     secrets:
       registry-username: ${{ secrets.REGISTRY_USERNAME }}
       registry-password: ${{ secrets.REGISTRY_PASSWORD }}