Merge branch 'SovereignCloudStack:main' into rke2

schmidax · web-flow · commit 319bd6f9b979 · 2025-12-19T08:57:14.000+01:00
diff --git a/.builder-image-version.txt b/.builder-image-version.txt
@@ -1 +1 @@
-0.2.2
+0.2.3
diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
@@ -4,7 +4,7 @@ runs:
   using: "composite"
   steps:
     - name: Install go
-      uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
+      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
       with:
         go-version-file: "go.mod"
         cache: true
@@ -15,14 +15,14 @@ runs:
         echo "go-build=$(go env GOCACHE)" >> $GITHUB_OUTPUT
         echo "go-mod=$(go env GOMODCACHE)" >> $GITHUB_OUTPUT
     - name: Go Mod Cache
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
+      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       with:
         path: ${{ steps.go-cache-paths.outputs.go-mod }}
         key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
         restore-keys: |
           ${{ runner.os }}-go-mod-
     - name: Go Build Cache
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
+      uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4
       with:
         path: ${{ steps.go-cache-paths.outputs.go-build }}
         key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
diff --git a/.github/workflows/builder-image.yml b/.github/workflows/builder-image.yml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
+        uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3
 
       - name: Login to Docker Hub
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
@@ -27,9 +27,9 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6
+        uses: docker/build-push-action@0adf9959216b96bec444f325f1e493d4aa344497 # v6
         with:
           file: ./images/builder/Dockerfile
           context: ./images/builder
           push: true
-          tags: ghcr.io/sovereigncloudstack/csctl-builder:0.2.2
+          tags: ghcr.io/sovereigncloudstack/csctl-builder:0.2.3
diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
@@ -19,7 +19,7 @@ jobs:
     if: github.event_name != 'pull_request_target' || !github.event.pull_request.draft
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/sovereigncloudstack/csctl-builder:0.2.2
+      image: ghcr.io/sovereigncloudstack/csctl-builder:0.2.3
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.github_token }}
diff --git a/.github/workflows/pr-verify.yml b/.github/workflows/pr-verify.yml
@@ -26,9 +26,9 @@ jobs:
       - name: Verify Shellcheck
         run: make verify-shellcheck
 
-      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
         with:
-          node-version: "18"
+          node-version: "22"
       - name: Install renovate
         run: npm i -g renovate@35.54.0 # TODO update this via renovatebot
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,11 +17,11 @@ jobs:
         with:
           fetch-depth: 0
       - run: git fetch --force --tags
-      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
         with:
           go-version: stable
 
-      - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6
+      - uses: goreleaser/goreleaser-action@90a3faa9d0182683851fbfa97ca1a2cb983bfca3 # v6
         with:
           distribution: goreleaser
           version: latest
diff --git a/.github/workflows/schedule-link-checker.yml b/.github/workflows/schedule-link-checker.yml
@@ -21,7 +21,7 @@ jobs:
           private_key: ${{ secrets.SCS_APP_PRIVATE_KEY }}
 
       - name: Link Checker
-        uses: lycheeverse/lychee-action@f81112d0d2814ded911bd23e3beaa9dda9093915 # v2.1.0
+        uses: lycheeverse/lychee-action@f613c4a64e50d792e0b31ec34bbcbba12263c6a6 # v2.3.0
         id: lychee
         env:
           GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
diff --git a/.github/workflows/schedule-update-bot.yaml b/.github/workflows/schedule-update-bot.yaml
@@ -45,7 +45,7 @@ jobs:
           echo "LOG_LEVEL=${{ github.event.inputs.logLevel || env.LOG_LEVEL }}" >> "$GITHUB_ENV"
 
       - name: Renovate
-        uses: renovatebot/github-action@02f4fdeb479bbb229caa7ad82cb5e691c07e80b3 # v41.0.14
+        uses: renovatebot/github-action@822441559e94f98b67b82d97ab89fe3003b0a247 # v44.2.0
         env:
           RENOVATE_HOST_RULES: '[{"hostType": "docker", "matchHost": "ghcr.io", "username": "${{ github.actor }}", "password": "${{ secrets.GITHUB_TOKEN }}" }]'
           RENOVATE_ALLOWED_POST_UPGRADE_COMMANDS: '[".*"]'
diff --git a/.golangci.yml b/.golangci.yml
@@ -7,12 +7,12 @@ linters:
     - bodyclose
     - containedctx
     - contextcheck
+    - copyloopvar
     - durationcheck
     - errchkjson
     - errname
     - errorlint
     - exhaustive
-    - exportloopref
     - forcetypeassert
     - gci
     - gocritic
diff --git a/images/builder/Dockerfile b/images/builder/Dockerfile
@@ -17,55 +17,55 @@
 # If you make changes to this Dockerfile run `make builder-image-push`.
 
 # Install Lychee
-FROM docker.io/library/alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c as lychee
+FROM docker.io/library/alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375 as lychee
 # update: datasource=github-tags depName=lycheeverse/lychee versioning=semver
 ENV LYCHEE_VERSION="v0.15.1"
 # hadolint ignore=DL3018
 RUN apk add --no-cache curl && \
-    curl -L -o /tmp/lychee-${LYCHEE_VERSION}.tgz https://github.com/lycheeverse/lychee/releases/download/${LYCHEE_VERSION}/lychee-${LYCHEE_VERSION}-x86_64-unknown-linux-gnu.tar.gz && \
-    tar -xz -C /tmp -f /tmp/lychee-${LYCHEE_VERSION}.tgz && \
-    mv /tmp/lychee /usr/bin/lychee && \
-    rm -rf /tmp/linux-amd64 /tmp/lychee-${LYCHEE_VERSION}.tgz
+  curl -L -o /tmp/lychee-${LYCHEE_VERSION}.tgz https://github.com/lycheeverse/lychee/releases/download/${LYCHEE_VERSION}/lychee-${LYCHEE_VERSION}-x86_64-unknown-linux-gnu.tar.gz && \
+  tar -xz -C /tmp -f /tmp/lychee-${LYCHEE_VERSION}.tgz && \
+  mv /tmp/lychee /usr/bin/lychee && \
+  rm -rf /tmp/linux-amd64 /tmp/lychee-${LYCHEE_VERSION}.tgz
 
 # Install Golang CI Lint
-FROM docker.io/library/alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c as golangci
+FROM docker.io/library/alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375 as golangci
 # update: datasource=github-tags depName=golangci/golangci-lint versioning=semver
-ENV GOLANGCI_VERSION="v1.64.5"
+ENV GOLANGCI_VERSION="v2.7.2"
 WORKDIR /
 # hadolint ignore=DL3018,DL4006
 RUN apk add --no-cache curl && \
-    curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s ${GOLANGCI_VERSION}
+  curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s ${GOLANGCI_VERSION}
 
 # Install Hadolint
-FROM docker.io/hadolint/hadolint:v2.12.0-alpine@sha256:3c206a451cec6d486367e758645269fd7d696c5ccb6ff59d8b03b0e45268a199 as hadolint
+FROM docker.io/hadolint/hadolint:v2.14.0-alpine@sha256:7aba693c1442eb31c0b015c129697cb3b6cb7da589d85c7562f9deb435a6657c as hadolint
 
 # Install Trivy
-FROM docker.io/aquasec/trivy:0.59.1@sha256:029e990b328d149bf0a9ffe355919041e1f86192db2df47e217f8a36dd42ceac as trivy
+FROM docker.io/aquasec/trivy:0.68.2@sha256:05d0126976bdedcd0782a0336f77832dbea1c81b9cc5e4b3a5ea5d2ec863aca7 as trivy
 
 ############################
 # csctl Build Image Base #
 ############################
-FROM docker.io/library/golang:1.21.6-bullseye@sha256:c62751ac12cad0c514d941e36f846c1c440ca9e8ec08dd87d022fb03f0887a9b
+FROM docker.io/library/golang:1.22-bullseye
 
 # update: datasource=repology depName=debian_11/skopeo versioning=loose
 ENV SKOPEO_VERSION="1.2.2+dfsg1-1+b6"
 # update: datasource=github-tags depName=adrienverge/yamllint versioning=semver
-ENV YAMLLINT_VERSION="v1.35.1"
+ENV YAMLLINT_VERSION="v1.37.1"
 # update: datasource=github-tags depName=opt-nc/yamlfixer versioning=semver
 ENV YAMLFIXER_VERSION="0.9.15"
 
 # hadolint ignore=DL3008
 RUN apt-get update && \
-    apt-get install -qy --no-install-recommends \
-    gnupg python3 python3-pip \
-    file zip unzip jq gettext \
-    skopeo=${SKOPEO_VERSION} \
-    protobuf-compiler libprotobuf-dev \
-    libsystemd-dev jq && \
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
-    pip install --no-cache-dir \
-    yamllint==${YAMLLINT_VERSION} \
-    yamlfixer-opt-nc==${YAMLFIXER_VERSION}
+  apt-get install -qy --no-install-recommends \
+  gnupg python3 python3-pip \
+  file zip unzip jq gettext \
+  skopeo=${SKOPEO_VERSION} \
+  protobuf-compiler libprotobuf-dev \
+  libsystemd-dev jq && \
+  rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* && \
+  pip install --no-cache-dir \
+  yamllint==${YAMLLINT_VERSION} \
+  yamlfixer-opt-nc==${YAMLFIXER_VERSION}
 
 COPY --from=lychee /usr/bin/lychee /usr/bin/lychee
 COPY --from=golangci /bin/golangci-lint /usr/local/bin
diff --git a/pkg/clusterstack/config.go b/pkg/clusterstack/config.go
@@ -18,6 +18,7 @@ limitations under the License.
 package clusterstack
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -58,11 +59,11 @@ func GetCsctlConfig(path string) (*CsctlConfig, error) {
 	}
 
 	if cs.Config.Provider.Type == "" {
-		return nil, fmt.Errorf("provider type must not be empty")
+		return nil, errors.New("provider type must not be empty")
 	}
 
 	if len(cs.Config.Provider.Type) > 253 {
-		return nil, fmt.Errorf("provider name must not be greater than 253")
+		return nil, errors.New("provider name must not be greater than 253")
 	}
 
 	match, err := regexp.MatchString(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`, cs.Config.Provider.Type)
@@ -74,7 +75,7 @@ func GetCsctlConfig(path string) (*CsctlConfig, error) {
 	}
 
 	if cs.Config.ClusterStackName == "" {
-		return nil, fmt.Errorf("cluster stack name must not be empty")
+		return nil, errors.New("cluster stack name must not be empty")
 	}
 
 	// Validate kubernetes version
diff --git a/pkg/clusterstack/version.go b/pkg/clusterstack/version.go
@@ -17,6 +17,7 @@ limitations under the License.
 package clusterstack
 
 import (
+	"errors"
 	"fmt"
 	"regexp"
 	"strconv"
@@ -30,7 +31,7 @@ func BumpVersion(version string) (string, error) {
 
 	// Check if a numeric part was found
 	if len(matches) < 2 {
-		return "", fmt.Errorf("invalid version format")
+		return "", errors.New("invalid version format")
 	}
 
 	// Extract and convert the numeric part to an integer
diff --git a/pkg/cmd/create.go b/pkg/cmd/create.go
@@ -19,6 +19,7 @@ package cmd
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -185,13 +186,13 @@ func GetCreateOptions(ctx context.Context, clusterStackPath string) (*CreateOpti
 		}
 	case customMode:
 		if clusterStackVersion == "" {
-			return nil, fmt.Errorf("please specify a semver for custom version with --cluster-stack-version flag")
+			return nil, errors.New("please specify a semver for custom version with --cluster-stack-version flag")
 		}
 		if clusterAddonVersion == "" {
-			return nil, fmt.Errorf("please specify a semver for custom version with --cluster-addon-version flag")
+			return nil, errors.New("please specify a semver for custom version with --cluster-addon-version flag")
 		}
 		if nodeImageVersion == "" {
-			return nil, fmt.Errorf("please specify a semver for custom version with --node-image-version flag")
+			return nil, errors.New("please specify a semver for custom version with --node-image-version flag")
 		}
 
 		createOption.Metadata, err = clusterstack.HandleCustomMode(createOption.Config.Config.KubernetesVersion, clusterStackVersion, clusterAddonVersion, nodeImageVersion)
@@ -222,7 +223,7 @@ func createAction(cmd *cobra.Command, args []string) error {
 	defer cleanTmpDirectory()
 
 	if len(args) != 1 {
-		return fmt.Errorf("please provide a valid command, create only accept one argument to path to the cluster stacks")
+		return errors.New("please provide a valid command, create only accept one argument to path to the cluster stacks")
 	}
 	clusterStackPath := args[0]
 
@@ -253,7 +254,7 @@ func (c *CreateOptions) validateHash() error {
 	if c.CurrentReleaseHash.ClusterAddonDir == c.LatestReleaseHash.ClusterAddonDir &&
 		c.CurrentReleaseHash.ClusterAddonValues == c.LatestReleaseHash.ClusterAddonValues &&
 		c.CurrentReleaseHash.NodeImageDir == c.LatestReleaseHash.NodeImageDir {
-		return fmt.Errorf("no change in the cluster stack")
+		return errors.New("no change in the cluster stack")
 	}
 
 	return nil
@@ -351,7 +352,7 @@ func (c *CreateOptions) generateRelease(ctx context.Context) error {
 
 	if publish {
 		if remote != "oci" {
-			return fmt.Errorf("not pushing assets. --publish is only implemented for remote OCI")
+			return errors.New("not pushing assets. --publish is only implemented for remote OCI")
 		}
 
 		ociClient, err := oci.NewClient()
@@ -410,7 +411,7 @@ func overwriteVersionInFile(chartYaml, newVersion string) error {
 	v := m["version"]
 	oldVersion, ok := v.(string)
 	if !ok {
-		return fmt.Errorf("failed to read version in yaml")
+		return errors.New("failed to read version in yaml")
 	}
 
 	m["version"] = newVersion
diff --git a/pkg/hash/hash.go b/pkg/hash/hash.go
@@ -21,6 +21,7 @@ import (
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -111,7 +112,7 @@ func (r ReleaseHash) ValidateWithLatestReleaseHash(latestReleaseHash ReleaseHash
 	if r.ClusterAddonDir == latestReleaseHash.ClusterAddonDir &&
 		r.ClusterAddonValues == latestReleaseHash.ClusterAddonValues &&
 		r.NodeImageDir == latestReleaseHash.NodeImageDir {
-		return fmt.Errorf("no change in the cluster stack")
+		return errors.New("no change in the cluster stack")
 	}
 
 	return nil
