diff --git a/.github/workflows/checkov.yml b/.github/workflows/checkov.yml index 8112c5bf3..8c98adfaa 100644 --- a/.github/workflows/checkov.yml +++ b/.github/workflows/checkov.yml @@ -12,10 +12,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v7 - name: Set up Python - uses: actions/setup-python@v4 + uses: actions/setup-python@v7 with: python-version: '3.12' @@ -32,6 +32,6 @@ jobs: continue-on-error: true - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 + uses: github/codeql-action/upload-sarif@v4 with: sarif_file: results.sarif diff --git a/.github/workflows/gcs_chart_publish_insiders.yml b/.github/workflows/gcs_chart_publish_insiders.yml index d59c2c5b9..8d82da5d9 100644 --- a/.github/workflows/gcs_chart_publish_insiders.yml +++ b/.github/workflows/gcs_chart_publish_insiders.yml @@ -9,8 +9,8 @@ on: - 'charts/**' env: - HELM_VERSION: v3.4.0 - HELM_GCS_VERSION: 0.3.20 # https://github.com/hayorov/helm-gcs + HELM_VERSION: v3.22.1 + HELM_GCS_VERSION: 0.7.0 # https://github.com/hayorov/helm-gcs BUCKET_NAME: helm.sourcegraph.com BUCKET_PATH: insiders @@ -20,17 +20,17 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Install Helm - uses: azure/setup-helm@v1 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} - name: Configure gcloud - uses: google-github-actions/auth@v0 + uses: google-github-actions/auth@v3 with: credentials_json: ${{ secrets.GOOGLE_CLOUD_CREDENTIALS }} service_account: 'github-bot@sourcegraph-helm.iam.gserviceaccount.com' diff --git a/.github/workflows/gcs_chart_publish_release.yml b/.github/workflows/gcs_chart_publish_release.yml index 50164ef18..825043311 100644 --- a/.github/workflows/gcs_chart_publish_release.yml +++ b/.github/workflows/gcs_chart_publish_release.yml @@ -17,8 +17,8 @@ on: required: false env: - HELM_VERSION: v3.4.0 - HELM_GCS_VERSION: 0.3.20 # https://github.com/hayorov/helm-gcs + HELM_VERSION: v3.22.1 + HELM_GCS_VERSION: 0.7.0 # https://github.com/hayorov/helm-gcs BUCKET_NAME: helm.sourcegraph.com BUCKET_PATH: release @@ -29,24 +29,24 @@ jobs: steps: - name: Checkout if: ${{ inputs.ref == '' }} - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Checkout (break glass) if: ${{ inputs.ref != '' }} - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 ref: ${{ inputs.ref }} - name: Install Helm - uses: azure/setup-helm@v1 + uses: azure/setup-helm@v5 with: version: ${{ env.HELM_VERSION }} - name: Configure gcloud - uses: google-github-actions/auth@v0 + uses: google-github-actions/auth@v3 with: credentials_json: ${{ secrets.GOOGLE_CLOUD_CREDENTIALS }} service_account: 'github-bot@sourcegraph-helm.iam.gserviceaccount.com' diff --git a/.github/workflows/helm_lint_test.yml b/.github/workflows/helm_lint_test.yml index 137bf19e3..c08524c9e 100644 --- a/.github/workflows/helm_lint_test.yml +++ b/.github/workflows/helm_lint_test.yml @@ -10,21 +10,21 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@v7 with: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v3 + uses: azure/setup-helm@v5 with: - version: v3.9.1 - - uses: actions/setup-python@v5 + version: v4.3.1 + - uses: actions/setup-python@v7 with: - python-version: '3.13' - - uses: azure/setup-kubectl@v2.0 + python-version: '3.14' + - uses: azure/setup-kubectl@v5 id: install - name: Set up chart-testing - uses: helm/chart-testing-action@v2.2.1 + uses: helm/chart-testing-action@v2.9.0 - name: Run chart-testing (list-changed) id: list-changed @@ -39,7 +39,7 @@ jobs: echo $changed | xargs helm lint if: steps.list-changed.outputs.changed == 'true' - name: Create kind cluster - uses: helm/kind-action@v1.3.0 + uses: helm/kind-action@v1.15.1 if: steps.list-changed.outputs.changed == 'true' - name: Install Helm charts run: helm install --debug -f ./ci/override.yaml test-sg ./charts/sourcegraph/ diff --git a/.tool-versions b/.tool-versions index deffea200..7e8f4153c 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1 +1 @@ -github-cli 2.46.0 +github-cli 2.102.0 diff --git a/charts/sourcegraph-executor/dind/README.md b/charts/sourcegraph-executor/dind/README.md index 3cbe5b396..18bd249c4 100644 --- a/charts/sourcegraph-executor/dind/README.md +++ b/charts/sourcegraph-executor/dind/README.md @@ -66,7 +66,7 @@ In addition to the documented values, the `executor` and `private-docker-registr | dind.gVisor.securityContext | object | `{"capabilities":{"add":["NET_ADMIN","SYS_ADMIN","AUDIT_WRITE","CHOWN","DAC_OVERRIDE","FOWNER","FSETID","KILL","MKNOD","NET_BIND_SERVICE","NET_RAW","SETFCAP","SETGID","SETPCAP","SETUID","SYS_CHROOT","SYS_PTRACE"]}}` | securityContext for the dind container when gVisor is enabled. Replaces privileged: true — gVisor intercepts these capabilities in-sandbox and never grants them to the host kernel. | | dind.image.registry | string | `"index.docker.io"` | | | dind.image.repository | string | `"docker"` | | -| dind.image.tag | string | `"29.5.3-dind"` | | +| dind.image.tag | string | `"29.9.1-dind"` | | | executor.env | object | `{}` | Extra environment variables to set on the executor container. | | executor.frontendExistingSecret | string | `""` | Name of existing k8s Secret to use for frontend password. The k8s Secret must contain the key EXECUTOR_FRONTEND_PASSWORD matching the site config executors.accessToken value. frontendPassword is ignored if this is set. | | executor.frontendPassword | string | `""` | The shared secret configured in the Sourcegraph instance site config under executors.accessToken. Required if frontendExistingSecret is not configured. | diff --git a/charts/sourcegraph-executor/dind/values.yaml b/charts/sourcegraph-executor/dind/values.yaml index 9390c29cf..b84f92cfa 100644 --- a/charts/sourcegraph-executor/dind/values.yaml +++ b/charts/sourcegraph-executor/dind/values.yaml @@ -138,7 +138,7 @@ dind: image: registry: index.docker.io repository: docker - tag: 29.5.3-dind + tag: 29.9.1-dind # -- Command for the dind container. command: - dockerd diff --git a/dev/TODO.md b/dev/TODO.md new file mode 100644 index 000000000..07241b464 --- /dev/null +++ b/dev/TODO.md @@ -0,0 +1,7 @@ +# TODO + +- Move the chart publish workflows + (`.github/workflows/gcs_chart_publish_*.yml`) from Helm v3.22.1 to + Helm 4. helm-gcs 0.7.0 supports Helm 4 but installs a different + plugin layout and needs `--verify=false` on `helm plugin install`. + Buildkite CI and `helm_lint_test.yml` already run Helm 4. diff --git a/scripts/ci/helm-unittest.sh b/scripts/ci/helm-unittest.sh index 3ec626947..b8f984dbf 100755 --- a/scripts/ci/helm-unittest.sh +++ b/scripts/ci/helm-unittest.sh @@ -2,9 +2,7 @@ set -euf -o pipefail -# 1.0.3 is broken now -# https://github.com/helm-unittest/helm-unittest/issues/790 -HELM_UNITTEST_VERSION="v1.0.2" +HELM_UNITTEST_VERSION="v1.2.1" ### Install the helm-unittest plugin helm plugin install https://github.com/helm-unittest/helm-unittest --version "$HELM_UNITTEST_VERSION" --verify=false diff --git a/scripts/ci/validate-schema.sh b/scripts/ci/validate-schema.sh index 62913a250..9d7acfa9a 100755 --- a/scripts/ci/validate-schema.sh +++ b/scripts/ci/validate-schema.sh @@ -3,7 +3,7 @@ set -euf -o pipefail ### Install kubeval -wget https://github.com/yannh/kubeconform/releases/download/v0.4.12/kubeconform-linux-amd64.tar.gz +wget https://github.com/yannh/kubeconform/releases/download/v0.8.0/kubeconform-linux-amd64.tar.gz tar xf kubeconform-linux-amd64.tar.gz chmod +x kubeconform sudo cp kubeconform /usr/local/bin