Merge pull request #636 from devanshuVmware/cve-fixes

[v0.19.x] Bump golang and fix workflows

Author: joaopapereira

.github/workflows/golangci-lint.yml

@@ -18,13 +18,13 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v3
+      - uses: actions/checkout@v4
         with:
-          go-version: 1.23.6
-      - uses: actions/checkout@v3.3.0
+          fetch-depth: 0
+      - name: Set up Go 1.x
+        uses: actions/setup-go@v5
         with:
-          fetch-depth: '0'
+          go-version-file: go.mod
       - name: golangci-lint
         uses: golangci/golangci-lint-action@v3.4.0
         with:

.github/workflows/kind-action.yml

@@ -19,17 +19,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1.2.0
+        uses: helm/kind-action@v1
         with:
-          version: v0.13.0
-          kubectl_version: v1.24.0
           cluster_name: kinder
-      - uses: actions/checkout@v2
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v3 # default version of go is 1.10
+      - name: Set up go
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.23.6
+          go-version-file: go.mod
       - name: Install Carvel Tools
         uses: carvel-dev/setup-action@v2
         with:
@@ -42,7 +42,7 @@ jobs:
       - name: Install sg and run e2e tests on kind
         run: |
           set -e -x
-          kubectl version --short
+          kubectl version
 
           ytt -f config/package-bundle/config -f config/dev | kbld -f- > kbld.out 2> kbldmeta.out
           cat kbldmeta.out | tail -n 1 | sed 's/.*final: secretgen-controller -> \(.*\)$/\1/p'  | tail -n 1 | xargs kind load docker-image --name kinder

.github/workflows/release.yml

@@ -14,13 +14,13 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.23.6
+          go-version-file: go.mod
       - name: Set up Cosign
         uses: sigstore/cosign-installer@v3
       - name: Install Carvel Tools

.github/workflows/test-gh.yml

@@ -14,17 +14,44 @@ name: test-gh
 
 jobs:
   test-all:
-    name: Test GH
+    name: Run all tests
     runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 2
+      matrix:
+        k8s-version: [v1.27.0, latest]
     steps:
-    - name: Set up Go 1.x
-      uses: actions/setup-go@v3
-      with:
-        go-version: 1.23.6
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+    - name: Set up Go
+      uses: actions/setup-go@v5
       with:
-          fetch-depth: 0
+        go-version-file: go.mod
+    - name: Resolve Kubernetes version
+      id: resolve-k8s-version
+      run: |
+        k8s_version=${{ matrix.k8s-version }}
+        if [ "${k8s_version}" = "latest" ]; then
+          k8s_version=$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/kubernetes/kubernetes/releases/latest | grep -oE 'tag/v[0-9]+\.[0-9]+\.[0-9]+' | cut -d'/' -f2)
+          echo "Resolved latest k8s version to: $k8s_version"
+        fi
+        echo "k8s_version=$k8s_version" >> $GITHUB_ENV
+    - name: start minikube(k8s version ${{ env.k8s_version }})
+      uses: medyagh/setup-minikube@latest
+      with:
+        kubernetes-version: ${{ env.k8s_version }}
+        driver: docker
+        start: true
+        cpus: 3
+        memory: 8192m
+    - name: Verify env
+      run: |
+        kind version
+        kubectl version
+        go version
     - name: Install Carvel Tools
       uses: carvel-dev/setup-action@v2
       with:
@@ -42,9 +69,8 @@ jobs:
 
         ./hack/verify-no-dirty-files.sh
 
-        minikube start --driver=docker
         eval $(minikube docker-env --shell=bash)
 
         export SECRETGEN_E2E_NAMESPACE=secretgen-test
 
-        ./hack/test-all.sh
+        ./hack/test-all.sh

.github/workflows/trivy-scan.yml

@@ -63,13 +63,13 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Set up Go 1.x
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v5
         with:
-          go-version: 1.23.6
+          go-version-file: go.mod
       - name: Build the secretgen-controller artifacts
         run: |
           curl -L https://carvel.dev/install.sh | bash

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.23.6 AS deps
+FROM --platform=$BUILDPLATFORM golang:1.23.8 AS deps
 
 ARG TARGETOS TARGETARCH SGCTRL_VER=development
 WORKDIR /workspace

go.mod

@@ -1,6 +1,6 @@
 module carvel.dev/secretgen-controller
 
-go 1.23.6
+go 1.23.8
 
 require (
 	github.com/cloudfoundry/bosh-utils v0.0.538 // indirect