The issue reporting step of the Markdown broken link check GitHub Action
is failing due to missing permissions.
> Error: Resource not accessible by integration
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
When releasing, since the job pushes to the git repository, it needs
to have write permission on "contents".
Signed-off-by: Stephen Kitt <skitt@redhat.com>
The release frequency of some GHAs means we end up with daily
dependabot PRs, which results in lots of not-particularly-useful
review work. Reducing the update cadence to weekly shouldn't expose us
to much risk and will reduce PR churn.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Set the GitHub Actions token permission to null in most workflows.
This results in:
GITHUB_TOKEN Permissions
Metadata: read
The default permissions, used without the null override, are either
GITHUB_TOKEN Permissions
Actions: write
Checks: write
Contents: write
Deployments: write
Discussions: write
Issues: write
Metadata: read
Packages: write
Pages: write
PullRequests: write
RepositoryProjects: write
SecurityEvents: write
Statuses: write
or
GITHUB_TOKEN Permissions
Actions: read
Checks: read
Contents: read
Deployments: read
Discussions: read
Issues: read
Metadata: read
Packages: read
Pages: read
PullRequests: read
RepositoryProjects: read
SecurityEvents: read
Statuses: read
Jobs triggered by PRs get read permissions, other jobs get write.
One job requires non-null permissions to function.
The dependent issues GHA needs PR/issues write permissions to add/remove
`dependent` labels. It needs status write permission to block/unblock
PRs when dependencies are missing/met. Fails with HttpError otherwise.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use Kubernetes 1.24 as the default version for end-to-end tests.
Remove Kubernetes 1.21 end-to-end tests as it's end of life.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Starting with Kubernetes 1.24, secrets are no longer automatically
created for SAs. This adds secrets to the relevant templates; creating
secrets in this way is supported in all Kubernetes versions.
This also enables testing with 1.24 in CI, to make sure that the fix
actually works.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Add Dependabot configuration to automatically update GitHub Actions on
the release-0.12 branch.
This will facilitate quick updates while using SHA-based versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
For quicker updates and easier, more consistent maintenance.
SHA-based versions should always be used to be sure the code we pull in
can't be changed without us, for security reasons at least. Dependabot
now supports SHA-based versions for GHAs. This patch should facilitate
their continued use.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Use the yamlint make target provided by Shipyard instead of a third
party GitHub action for running the same tool.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
This adds a feature, but nothing that seems relevant to us.
github.com/tim-actions/get-pr-commits/compare/v1.1.0...v1.2.0
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Bumps the version of markdown-link-check from 3.8.7 to 3.9.3.
Changes base image from node:alpine to node:lts-alpine.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Remove tests for Kubernetes 1.20, as it is End of Life and Submariner
supports all versions upstream-Kubernetes supports and no EOL versions.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Commits produced using "git commit --fix" are great for review, but
must be squashed before a PR is merged.
Signed-off-by: Stephen Kitt <skitt@redhat.com>
Update the versions of Kubernetes tested in the E2E CI. Add 1.23 as the
new default for most tests, remove 1.19 as it is now EOL.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Right now auto release logic updates `devel` to the stable branch name
when creating stable branches. This leads to this job "sharding" into
multiple jobs, and messes up branch protections.
To keep things simple, the main job name will remain the same so that
there's no "PR targets X" and "PR targets Y" jobs, just the one "PR
targets branch" job
Signed-off-by: Mike Kolesnik <mkolesni@redhat.com>
Per GitHub's security guidelines, GHAs should be pinned using full
length commit SHAs instead of tags.
The SHAs are of the commits currently resolved by the versions.
Even "trusted" GHAs from GitHub developers are pinned because it's
possible their repo rights could be compromised and a malicious GHA
published. These core repos are not frequently substantially updated.
Submariner-internal GHAs are left pinned at devel because we want
automatic updates from Shipyard's shared tooling.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
As we do with the Flake Finder and other periodic jobs, skip the checks
for PR dependencies on forks.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Submariner, k8s, OS and kernel information
are collected as part of `subctl gather`. Don't
ask for them explicitly in bug report.
Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>
This job marks a PR `dependent` whenever a dependent PR
is mentioned via `Depends on/ depends on` keyword.
The job fails until the dependent PR is not merged. This
helps in properly managing merging of dependent PRs.
Signed-off-by: Janki Chhatbar <jchhatba@redhat.com>
Add a linting job to verify that no commit message in a PR contains the
case insensitive string "Apply suggestions from code review". Commits
with exactly this title are generated by GitHub automatically when a
batch of proposed changes from code review are accepted from the GitHub
UI. A number of such commits have made it into various Submariner/*
repos.
Commits addressing code review feedback should typically be squashed
into the commits under review, or made into well-commented discrete
commits.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
Following the pattern from other repos, split the E2E test job into a
default job that runs a single default-only test always on PRs and a
full job that runs the full matrix when the ready-to-test label is
added.
Signed-off-by: Daniel Farrell <dfarrell@redhat.com>
