UPSTREAM-SYNC: Sync release-5.0 with upstream release-0.15

.github/dependabot.yml

@@ -12,10 +12,12 @@ updates:
   target-branch: main
   groups:
     all-github-actions:
-      patterns: [ "*" ]
+      patterns: ["*"]
   commit-message:
     prefix: ":seedling:"
     include: scope
+  cooldown:
+    default-days: 7
   labels:
   - "area/dependency"
   - "ok-to-test"
@@ -30,38 +32,42 @@ updates:
   target-branch: main
   groups:
     all-go-mod-patch-and-minor:
-      patterns: [ "*" ]
-      update-types: [ "patch", "minor" ]
+      patterns: ["*"]
+      update-types: ["patch", "minor"]
   commit-message:
     prefix: ":seedling:"
     include: scope
   ignore:
   # Ignore controller-runtime major and minor bumps as its upgraded manually.
   - dependency-name: "sigs.k8s.io/controller-runtime"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   # Ignore k8s major and minor bumps and its transitives modules
   - dependency-name: "k8s.io/*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   - dependency-name: "sigs.k8s.io/controller-tools"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  cooldown:
+    default-days: 7
   labels:
   - "area/dependency"
   - "ok-to-test"
 ## main branch config ends here
-## release-0.13 branch config starts here
+## release-0.14 branch config starts here
 # github-actions
 - directory: "/"
   package-ecosystem: "github-actions"
   schedule:
     interval: "weekly"
     day: "monday"
-  target-branch: release-0.13
+  target-branch: release-0.14
   groups:
     all-github-actions:
-      patterns: [ "*" ]
+      patterns: ["*"]
   commit-message:
     prefix: ":seedling:"
     include: scope
+  cooldown:
+    default-days: 7
   labels:
   - "area/dependency"
   - "ok-to-test"
@@ -73,47 +79,69 @@ updates:
   schedule:
     interval: "weekly"
     day: "monday"
-  target-branch: release-0.13
+  target-branch: release-0.14
   groups:
     all-go-mod-patch-and-minor:
-      patterns: [ "*" ]
-      update-types: [ "patch", "minor" ]
+      patterns: ["*"]
+      update-types: ["patch", "minor"]
   commit-message:
     prefix: ":seedling:"
     include: scope
   ignore:
   # Ignore CAPI major and minor bumps
   - dependency-name: "sigs.k8s.io/cluster-api*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   # Ignore controller-runtime major and minor bumps as its upgraded manually.
   - dependency-name: "sigs.k8s.io/controller-runtime"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   # Ignore k8s major and minor bumps and its transitives modules
   - dependency-name: "k8s.io/*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   - dependency-name: "sigs.k8s.io/controller-tools"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-  # Ignore ORC major and minor bumps to prevent cascading k8s.io and controller-runtime updates
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore ORC major and minor bumps to prevent cascading Go version requirements
   - dependency-name: "github.com/k-orc/openstack-resource-controller*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore golang.org/x minor and major bumps to prevent cascading Go version requirements
+  - dependency-name: "golang.org/x/*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore all golang.org/x/crypto and golang.org/x/text bumps to prevent cascading Go version requirements
+  # Not sure why the above golang.org/x/* ignore doesn't catch these.
+  - dependency-name: "golang.org/x/crypto"
+  - dependency-name: "golang.org/x/text"
+  # Ignore all github.com/prometheus/client_golang bumps to prevent cascading Go version requirements.
+  - dependency-name: "github.com/prometheus/client_golang"
+  # Ignore setup-envtest major and minor bumps to prevent cascading Go version requirements
+  - dependency-name: "sigs.k8s.io/controller-runtime/tools/setup-envtest"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore ginkgo and gomega to prevent cascading Go version requirements
+  - dependency-name: "github.com/onsi/ginkgo/v2"
+  - dependency-name: "github.com/onsi/gomega"
+  # Ignore gophercloud minor and major bumps to prevent cascading Go version requirements
+  - dependency-name: "github.com/gophercloud/gophercloud/v2"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  cooldown:
+    default-days: 7
   labels:
   - "area/dependency"
   - "ok-to-test"
-## release-0.13 branch config ends here
-## release-0.12 branch config starts here
+## release-0.14 branch config ends here
+## release-0.13 branch config starts here
 # github-actions
 - directory: "/"
   package-ecosystem: "github-actions"
   schedule:
     interval: "weekly"
     day: "monday"
-  target-branch: release-0.12
+  target-branch: release-0.13
   groups:
     all-github-actions:
-      patterns: [ "*" ]
+      patterns: ["*"]
   commit-message:
     prefix: ":seedling:"
     include: scope
+  cooldown:
+    default-days: 7
   labels:
   - "area/dependency"
   - "ok-to-test"
@@ -125,41 +153,50 @@ updates:
   schedule:
     interval: "weekly"
     day: "monday"
-  target-branch: release-0.12
+  target-branch: release-0.13
   groups:
     all-go-mod-patch-and-minor:
-      patterns: [ "*" ]
-      update-types: [ "patch", "minor" ]
+      patterns: ["*"]
+      update-types: ["patch", "minor"]
   commit-message:
     prefix: ":seedling:"
     include: scope
   ignore:
   # Ignore CAPI major and minor bumps
   - dependency-name: "sigs.k8s.io/cluster-api*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   # Ignore controller-runtime major and minor bumps as its upgraded manually.
   - dependency-name: "sigs.k8s.io/controller-runtime"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   # Ignore k8s major and minor bumps and its transitives modules
   - dependency-name: "k8s.io/*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   - dependency-name: "sigs.k8s.io/controller-tools"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
   # Ignore ORC major and minor bumps to prevent cascading k8s.io and controller-runtime updates
   - dependency-name: "github.com/k-orc/openstack-resource-controller*"
-    update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
-  # We will need k8s v0.31.3 to bump structured-merge-diff to v4.4.2 (check git history for details).
-  - dependency-name: "sigs.k8s.io/structured-merge-diff/*"
-  # These dependencies are skipped because they require a newer version of go:
-  - dependency-name: "github.com/a8m/envsubst"
-  - dependency-name: "github.com/onsi/gomega"
-  - dependency-name: "github.com/itchyny/gojq"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore golang.org/x minor and major bumps to prevent cascading Go version requirements
+  - dependency-name: "golang.org/x/*"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore all golang.org/x/crypto and golang.org/x/text bumps to prevent cascading Go version requirements
+  # Not sure why the above /* doesn't catch these.
   - dependency-name: "golang.org/x/crypto"
   - dependency-name: "golang.org/x/text"
-  # Newer kustomize requires a bump to kube-openapi, which has some incompatibility with gengo.
-  - dependency-name: "sigs.k8s.io/kustomize/kustomize/*"
+  # Ignore all github.com/prometheus/client_golang bumps to prevent cascading Go version requirements.
+  - dependency-name: "github.com/prometheus/client_golang"
+  # Ignore setup-envtest major and minor bumps to prevent cascading Go version requirements
+  - dependency-name: "sigs.k8s.io/controller-runtime/tools/setup-envtest"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  # Ignore ginkgo and gomega to prevent cascading Go version requirements
+  - dependency-name: "github.com/onsi/ginkgo/v2"
+  - dependency-name: "github.com/onsi/gomega"
+  # Ignore gophercloud minor and major bumps to prevent cascading Go version requirements
+  - dependency-name: "github.com/gophercloud/gophercloud/v2"
+    update-types: ["version-update:semver-major", "version-update:semver-minor"]
+  cooldown:
+    default-days: 7
   labels:
   - "area/dependency"
   - "ok-to-test"
-
-## release-0.12 branch config ends here
+## release-0.13 branch config ends here

.github/workflows/pr-dependabot.yaml

@@ -20,15 +20,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code into the Go module directory
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
+      with:
+        persist-credentials: true # We need this for commit and push later
     - name: Calculate go version
       id: vars
       run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
     - name: Set up Go
-      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
         go-version: ${{ steps.vars.outputs.go_version }}
-    - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # tag=v5.0.5
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # tag=v6.1.0
       name: Restore go cache
       with:
         path: |
@@ -41,7 +43,7 @@ jobs:
       run: make modules
     - name: Update generated code
       run: make generate
-    - uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # tag=v10.0.0
+    - uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # tag=v11.1.1
       name: Commit changes
       with:
         author_name: dependabot[bot]

.github/workflows/pr-gh-workflow-approve.yaml

@@ -5,15 +5,15 @@
 name: Approve GH Workflows
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [ opened, edited, reopened, synchronize, ready_for_review ]
 
 permissions: {}
 
 jobs:
   approve:
     name: Approve on ok-to-test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
 
     permissions:
       actions: write

.github/workflows/pr-link-check.yaml

@@ -12,15 +12,16 @@ concurrency:
 
 jobs:
   check-links-pr:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
 
     steps:
     - name: Clone repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
         ref: ${{github.event.pull_request.head.ref}}
         repository: ${{github.event.pull_request.head.repo.full_name}}
+        persist-credentials: false
 
     - name: Add upstream remote
       run: |
@@ -29,24 +30,31 @@ jobs:
         git fetch upstream
 
     - name: Checkout base branch
-      run: git checkout "upstream/${{ github.event.pull_request.base.ref }}"
+      env:
+        BASE_REF: ${{ github.event.pull_request.base.ref }}
+      run: git checkout "upstream/${BASE_REF}"
 
     - name: Get list of changed Markdown files
       id: changed-files
+      env:
+        BASE_REF: ${{ github.event.pull_request.base.ref }}
+        HEAD_REF: ${{ github.head_ref }}
       run: |
-        git diff --name-only "upstream/${{ github.event.pull_request.base.ref }}...${{ github.head_ref }}" -- "*.md" > changed-files.txt
+        git diff --name-only "upstream/${BASE_REF}...${HEAD_REF}" -- "*.md" > changed-files.txt
         cat changed-files.txt
         if [[ -s "changed-files.txt" ]]; then
           echo "Changed md files found"
           echo "foundFiles=true" >> "${GITHUB_ENV}"
         fi
 
     - name: Switch to PR branch
-      run: git checkout ${{ github.head_ref }}
+      env:
+        HEAD_REF: ${{ github.head_ref }}
+      run: git checkout "${HEAD_REF}"
 
     - name: Check links in changed files
       if: env.foundFiles == 'true'
-      uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+      uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
       with:
         failIfEmpty: false
         args: |
@@ -55,6 +63,8 @@ jobs:
           --fallback-extensions "md"
           --github-token "${GITHUB_TOKEN}"
           --insecure
+          --max-retries 3
+          --retry-wait-time 5
           --exclude-all-private
           --no-progress
           $(cat changed-files.txt | tr '\n' ' ')

.github/workflows/pr-verifer.yml

@@ -2,15 +2,17 @@ name: Check PR Title
 permissions: {}
 
 on:
-  pull_request_target:
+  pull_request:
     types: [ opened, edited, reopened, synchronize, ready_for_review ]
 
 jobs:
   check-title:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
     - name: Check out repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Validate PR Title
       env: