Skip to content

Commit 473cfdf

Browse files
kitsunoffkitsunoff
committed
Merge branch 'main' into feat/observability-proxy-exported-namespace
Assisted-by: LLM Signed-off-by: Maxim Belyy <[email protected]>
2 parents 8351e23 + b6f5a4f commit 473cfdf

321 files changed

Lines changed: 44115 additions & 5717 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gemini/styleguide.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Similarly, never propose edits to:
3535

3636
Each commit must follow [Conventional Commits](https://www.conventionalcommits.org/) format: `type(scope): brief description`.
3737

38-
Valid types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`.
38+
Valid types: `feat`, `fix`, `security` (a fix that comes through a security advisory), `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`.
3939

4040
Valid scopes:
4141

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
<!-- Thank you for making a contribution! Here are some tips for you:
22
- Use Conventional Commits for the PR title: `type(scope): description`
3-
- Types: feat, fix, docs, style, refactor, perf, test, build, ci, chore
3+
- Types: feat, fix, security (a fix that comes through a security advisory), docs, style, refactor, perf, test, build, ci, chore
44
- Scopes are not an exhaustive list — pick the most specific scope for the change and extend the list when a genuinely new area appears. Examples:
55
- System components: dashboard, platform, operator, cilium, kube-ovn, linstor, fluxcd, cluster-api
66
- Managed apps: postgres, mariadb, redis, kafka, clickhouse, virtual-machine, kubernetes
77
- Development and maintenance: api, hack, tests, ci, docs, maintenance
88
- Breaking changes: append `!` after type/scope (`feat(api)!: ...`) or add a `BREAKING CHANGE:` footer
99
- If it's a work in progress, consider creating this PR as a draft.
1010
- Don't hesistate to ask for opinion and review in the community chats, even if it's still a draft.
11-
- Add the label `kind/backport` if it's a bugfix that needs to be backported to a previous version.
11+
- Fixes merged to `main` reach the release lines the backport batch runs for automatically, so do not open backport PRs by hand: https://github.com/cozystack/cozystack/blob/main/docs/release/backports.md
1212
-->
1313

1414
## What this PR does

‎.github/labels.yml‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
# do-not-merge/ PR merge blockers
2323
# security/ security-finding severity and status (Cozystack-specific)
2424
# size/ PR size (auto-applied)
25+
# backport/ maintainer overrides of the backport batch rules (Cozystack-specific)
2526
#
2627
# `aliases:` lets EndBug/label-sync rename existing labels without losing
2728
# references on already-tagged issues and PRs.
@@ -78,18 +79,6 @@
7879
color: 'e11d21'
7980
description: Indicates the change introduces a breaking API or behaviour change
8081

81-
# kind/backport-previous has no upstream Kubernetes equivalent (k8s has no
82-
# two-release-line model); it stays under kind/ per the file convention.
83-
- name: kind/backport
84-
color: 'fbca04'
85-
description: Categorizes issue or PR as requiring a backport to the current release line
86-
aliases: ['backport']
87-
88-
- name: kind/backport-previous
89-
color: 'fbd876'
90-
description: Categorizes issue or PR as requiring a backport to the previous release line
91-
aliases: ['backport-previous']
92-
9382
# ──────────────────────────────────────────────
9483
# priority/ — urgency
9584
# ──────────────────────────────────────────────
@@ -411,3 +400,17 @@
411400
- name: security/fixed
412401
color: '0e8a16'
413402
description: Fix released
403+
404+
# ──────────────────────────────────────────────
405+
# backport/ — maintainer overrides of the backport batch rules
406+
# ──────────────────────────────────────────────
407+
408+
# Read by cmd/backport-batch from the merged pull request on main;
409+
# docs/release/backports.md describes both.
410+
- name: backport/include
411+
color: 'c2e0c6'
412+
description: The backport batch takes this PR though rules 2-4 keep it out; it must still pick and pass CI
413+
414+
- name: backport/skip
415+
color: 'f9d0c4'
416+
description: The backport batch keeps this PR out although the rules take it

‎.github/workflows/backport-batch.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
name: Backport batch
2+
3+
# Builds the backport batch for each line `backport-batch lines` names, the
4+
# newest released lines and any line in its rc window, newest line first, as
5+
# docs/release/backports.md describes. The steps live in
6+
# hack/backport-batch-scheduled.sh, which a maintainer can also run by hand.
7+
#
8+
# The batch runs as the cozystack-ci App, with a token minted for this
9+
# repository alone with Contents and Pull requests write. It has no
10+
# workflows permission, so an original that changes .github/workflows/
11+
# waits on the batch for a maintainer (--no-workflow-files). Its pushes,
12+
# unlike GITHUB_TOKEN's, start CI on the batch pull request.
13+
#
14+
# Repository settings it reads; none is created here:
15+
# secret COZYSTACK_CI_APP_ID, COZYSTACK_CI_PRIVATE_KEY
16+
# the cozystack-ci App, shared with the
17+
# release workflows. Required.
18+
# variable BACKPORT_ALERT_TEAM the team or person the batch's comment
19+
# mentions, org/team or a login.
20+
#
21+
# A batch open since the previous run, deferred conflicts and originals that
22+
# change workflows wait for a maintainer: the batch's comment lists them. A
23+
# failed batch CI waits too, and shows on the batch pull request's checks.
24+
25+
on:
26+
schedule:
27+
# Monday and Thursday: each run leaves working days to cut an rc, run its
28+
# e2e and promote it before the weekend. 06:23 UTC is after the nightly
29+
# and the daily sweeps.
30+
- cron: '23 6 * * 1,4'
31+
workflow_dispatch: {}
32+
33+
permissions: {}
34+
35+
concurrency:
36+
group: backport-batch
37+
cancel-in-progress: false
38+
39+
jobs:
40+
batch:
41+
name: Backport batch
42+
if: github.repository == 'cozystack/cozystack'
43+
runs-on: ubuntu-latest
44+
# The App token lives an hour from its mint, a few minutes in; a run takes
45+
# minutes, so the job ends well before the token does.
46+
timeout-minutes: 30
47+
permissions:
48+
contents: read
49+
env:
50+
# The pipe falls back to direct on any proxy error (hack/common-envs.mk).
51+
GOPROXY: "https://proxy.golang.org|direct"
52+
steps:
53+
- name: Require the cozystack-ci App
54+
env:
55+
APP_ID: ${{ secrets.COZYSTACK_CI_APP_ID }}
56+
APP_KEY: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
57+
run: |
58+
if [ -z "$APP_ID" ] || [ -z "$APP_KEY" ]; then
59+
echo "::error::COZYSTACK_CI_APP_ID or COZYSTACK_CI_PRIVATE_KEY is not set. The batch pushes and opens pull requests as the cozystack-ci App only; see docs/release/backports.md#the-scheduled-run."
60+
exit 1
61+
fi
62+
63+
- name: Checkout
64+
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
65+
with:
66+
fetch-depth: 0
67+
persist-credentials: false
68+
69+
- name: Set up Go
70+
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
71+
with:
72+
go-version-file: go.mod
73+
cache: false
74+
75+
- name: Build backport-batch
76+
run: go build -o "$RUNNER_TEMP/backport-batch" ./cmd/backport-batch
77+
78+
- name: Generate GitHub App token
79+
id: app-token
80+
uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
81+
with:
82+
app-id: ${{ secrets.COZYSTACK_CI_APP_ID }}
83+
private-key: ${{ secrets.COZYSTACK_CI_PRIVATE_KEY }}
84+
owner: cozystack
85+
repositories: cozystack
86+
permission-contents: write
87+
permission-pull-requests: write
88+
89+
# git pushes through gh, which reads the token from the environment of
90+
# each call, so the token is never written into the checkout.
91+
- name: Use the App's bot as git identity and credential
92+
env:
93+
GH_TOKEN: ${{ steps.app-token.outputs.token }}
94+
APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
95+
run: |
96+
gh auth setup-git
97+
id=$(gh api "/users/${APP_SLUG}[bot]" --jq .id)
98+
git config --global user.name "${APP_SLUG}[bot]"
99+
git config --global user.email "${id}+${APP_SLUG}[bot]@users.noreply.github.com"
100+
101+
- name: Run the batch
102+
env:
103+
BACKPORT_BATCH: ${{ runner.temp }}/backport-batch
104+
BACKPORT_BATCH_TOKEN: ${{ steps.app-token.outputs.token }}
105+
BACKPORT_BATCH_BOT: ${{ steps.app-token.outputs.app-slug }}[bot]
106+
BACKPORT_ALERT_TEAM: ${{ vars.BACKPORT_ALERT_TEAM }}
107+
run: hack/backport-batch-scheduled.sh --no-workflow-files

0 commit comments

Comments
 (0)