Skip to content

Commit 3978b8c

Browse files
TechassiTechassi
authored
chore: Pre-release updates for Stackable Release 25.3.0 (#485)
* chore: Bump pre-commit hooks * chore: Use local cargo-clippy pre-commit hook * ci: Bump workflow actions * template(ci): Bump workflow actions * ci: Harden workflows * template(ci): Harden workflows * template(ci): Use templated Python version * chore: Bump Rust toolchain to 1.84.1 * chore: Update issue template
1 parent 9001281 commit 3978b8c

9 files changed

+62
-32
lines changed

‎.github/ISSUE_TEMPLATE/pre-release.md

+1
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ Part of <https://github.com/stackabletech/issues/TRACKING_ISSUE>
4646
```[tasklist]
4747
### Tasks in this Repository
4848
- [ ] Update Rust toolchain in the `config/versions.yaml` file.
49+
- [ ] Update Rust toolchain in UBI8, UBI9, and stackable-base images
4950
- [ ] Generate downstream PRs using the ["Generate Downstream PRs"](https://github.com/stackabletech/operator-templating/actions/workflows/generate_prs.yml) action.
5051
- [ ] [Search for PRs](https://github.com/search?q=org%3Astackabletech%20sort%3Aupdated-desc%20is%3Apr%20is%3Aopen%20Update%20templated%20files&type=pullrequests) and add them to the task list below.
5152
- [ ] Merge downstream PRs, see below for more details.

‎.github/workflows/generate_prs.yml

+10-3
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ on:
1414
type: boolean
1515
default: true
1616

17+
permissions: {}
18+
1719
jobs:
1820
create-prs:
1921
runs-on: ubuntu-latest
@@ -101,7 +103,9 @@ jobs:
101103
url: stackabletech/zookeeper-operator.git
102104
steps:
103105
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
104-
- uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # tag=v26
106+
with:
107+
persist-credentials: false
108+
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
105109
- name: Install Ansible
106110
env:
107111
DEBIAN_FRONTEND: noninteractive
@@ -129,9 +133,12 @@ jobs:
129133
# Create commit message depending on whether this is run manually or due to a scheduled run
130134
- name: Set commit message for manual dispatch
131135
if: ${{ github.event_name == 'workflow_dispatch' }}
136+
env:
137+
REASON: ${{ github.event.inputs.message }}
138+
AUTHOR: ${{ github.event.sender.login }}
132139
run: |
133-
echo "AUTHOR=${{ github.event.sender.login }}" >> "$GITHUB_ENV"
134-
echo "REASON=${{ github.event.inputs.message }}" >> "$GITHUB_ENV"
140+
echo "AUTHOR=$AUTHOR" >> "$GITHUB_ENV"
141+
echo "REASON=$REASON" >> "$GITHUB_ENV"
135142
- name: Set commit message for schedule
136143
if: ${{ github.event_name == 'schedule' }}
137144
run: |

‎.github/workflows/pr_pre-commit.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,17 @@ env:
88
HADOLINT_VERSION: "v2.12.0"
99
PYTHON_VERSION: "3.12"
1010

11+
permissions: {}
12+
1113
jobs:
1214
pre-commit:
1315
runs-on: ubuntu-latest
1416
steps:
1517
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1618
with:
19+
persist-credentials: false
1720
fetch-depth: 0
18-
- uses: stackabletech/actions/run-pre-commit@e8781161bc1eb037198098334cec6061fe24b6c3 # v0.0.2
21+
- uses: stackabletech/actions/run-pre-commit@2d3d7ddad981ae09901d45a0f6bf30c2658b1b78 # v0.7.0
1922
with:
2023
python-version: ${{ env.PYTHON_VERSION }}
2124
hadolint: ${{ env.HADOLINT_VERSION }}

‎.pre-commit-config.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ repos:
2222
files: \.(yml|yaml)(\.j2)*$
2323

2424
- repo: https://github.com/igorshubovych/markdownlint-cli
25-
rev: aa975a18c9a869648007d33864034dbc7481fe5e # 0.42.0
25+
rev: 586c3ea3f51230da42bab657c6a32e9e66c364f0 # 0.44.0
2626
hooks:
2727
- id: markdownlint
2828
types: [text]
@@ -38,15 +38,15 @@ repos:
3838
# If you do not, you will need to delete the cached ruff binary shown in the
3939
# error message
4040
- repo: https://github.com/astral-sh/ruff-pre-commit
41-
rev: 8983acb92ee4b01924893632cf90af926fa608f0 # 0.7.0
41+
rev: 2c8dce6094fa2b4b668e74f694ca63ceffd38614 # 0.9.9
4242
hooks:
4343
# Run the linter.
4444
- id: ruff
4545
# Run the formatter.
4646
- id: ruff-format
4747

4848
- repo: https://github.com/rhysd/actionlint
49-
rev: 4e683ab8014a63fafa117492a0c6053758e6d593 # 1.7.3
49+
rev: 03d0035246f3e81f36aed592ffb4bebf33a03106 # 1.7.7
5050
hooks:
5151
- id: actionlint
5252
types: [text]

‎config/versions.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# IMPORTANT
33
# If you change the Rust toolchain version here, make sure to also change
44
# docker-images/ubi8-rust-builder/Dockerfile & docker-images/ubi9-rust-builder/Dockerfile
5-
rust_version: 1.82.0
5+
rust_version: 1.84.1
66

77
# This nightly version is only used for cargo fmt invocations, because we use nightly-only
88
# rustfmt config options in rustfmt.toml. The version should be kept in line with the version

‎template/.github/workflows/build.yml.j2

+23-13
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ env:
2727
CARGO_INCREMENTAL: '0'
2828
CARGO_PROFILE_DEV_DEBUG: '0'
2929
RUST_TOOLCHAIN_VERSION: "{[ rust_version }]"
30+
PYTHON_VERSION: "{[ python_version }]"
3031
RUSTFLAGS: "-D warnings"
3132
RUSTDOCFLAGS: "-D warnings"
3233
RUST_LOG: "info"
@@ -49,8 +50,9 @@ jobs:
4950
version: ubuntu-latest
5051
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5152
with:
53+
persist-credentials: false
5254
submodules: recursive
53-
- uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
55+
- uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
5456
with:
5557
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
5658
- uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
@@ -118,8 +120,9 @@ jobs:
118120
steps:
119121
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
120122
with:
123+
persist-credentials: false
121124
submodules: recursive
122-
- uses: EmbarkStudios/cargo-deny-action@8371184bd11e21dcf8ac82ebf8c9c9f74ebf7268 # v2.0.1
125+
- uses: EmbarkStudios/cargo-deny-action@0484eedcba649433ebd03d9b7c9c002746bbc4b9 # v2.0.6
123126
with:
124127
command: check ${{ matrix.checks }}
125128

@@ -129,8 +132,9 @@ jobs:
129132
steps:
130133
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
131134
with:
135+
persist-credentials: false
132136
submodules: recursive
133-
- uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
137+
- uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
134138
with:
135139
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
136140
components: rustfmt
@@ -147,8 +151,9 @@ jobs:
147151
version: ubuntu-latest
148152
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
149153
with:
154+
persist-credentials: false
150155
submodules: recursive
151-
- uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
156+
- uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
152157
with:
153158
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
154159
components: clippy
@@ -183,7 +188,7 @@ jobs:
183188
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
184189
with:
185190
submodules: recursive
186-
- uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
191+
- uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
187192
with:
188193
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
189194
components: rustfmt
@@ -204,8 +209,9 @@ jobs:
204209
version: ubuntu-latest
205210
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
206211
with:
212+
persist-credentials: false
207213
submodules: recursive
208-
- uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
214+
- uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
209215
with:
210216
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
211217
- uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
@@ -224,10 +230,11 @@ jobs:
224230
steps:
225231
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
226232
with:
233+
persist-credentials: false
227234
submodules: recursive
228235
- uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
229236
with:
230-
python-version: '3.12'
237+
python-version: ${{ env.PYTHON_VERSION }}
231238
- name: Install jinja2-cli
232239
run: pip install jinja2-cli==0.8.2
233240
- name: Regenerate charts
@@ -262,13 +269,14 @@ jobs:
262269
version: ubuntu-latest
263270
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
264271
with:
272+
persist-credentials: false
265273
submodules: recursive
266274
- name: Set up Helm
267275
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
268276
with:
269277
version: v3.16.1
270278
- name: Set up cargo
271-
uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
279+
uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
272280
with:
273281
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
274282
- uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
@@ -332,9 +340,10 @@ jobs:
332340
version: ${{ matrix.runner }}
333341
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
334342
with:
343+
persist-credentials: false
335344
submodules: recursive
336-
- uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
337-
- uses: dtolnay/rust-toolchain@a54c7afa936fefeb4456b2dd8068152669aa8203
345+
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
346+
- uses: dtolnay/rust-toolchain@c5a29ddb4d9d194e7c84ec8c3fba61b1c31fee8c
338347
with:
339348
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
340349
components: rustfmt
@@ -371,9 +380,9 @@ jobs:
371380
# default value in the makefile if called from this action, but not otherwise (i.e. when called locally).
372381
# This is needed for the HELM_REPO variable.
373382
- name: Install cosign
374-
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
383+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
375384
- name: Install syft
376-
uses: anchore/sbom-action/download-syft@61119d458adab75f756bc0b9e4bde25725f86a7a # v0.17.2
385+
uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
377386
- name: Build Docker image and Helm chart
378387
run: |
379388
# Installing helm and yq on ubicloud-standard-8-arm only
@@ -417,10 +426,11 @@ jobs:
417426
OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build"
418427
steps:
419428
- name: Install cosign
420-
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
429+
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
421430
- name: Checkout
422431
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
423432
with:
433+
persist-credentials: false
424434
submodules: recursive
425435
# This step checks if the current run was triggered by a push to a pr (or a pr being created).
426436
# If this is the case it changes the version of this project in all Cargo.toml files to include the suffix

‎template/.github/workflows/general_daily_security.yml

+4
Original file line numberDiff line numberDiff line change
@@ -10,11 +10,15 @@ on:
1010
- cron: '15 4 * * *'
1111
workflow_dispatch:
1212

13+
permissions: {}
14+
1315
jobs:
1416
audit:
1517
runs-on: ubuntu-latest
1618
steps:
1719
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
20+
with:
21+
persist-credentials: false
1822
- uses: rustsec/audit-check@dd51754d4e59da7395a4cd9b593f0ff2d61a9b95 # v1.4.1
1923
with:
2024
token: ${{ secrets.GITHUB_TOKEN }}

‎template/.github/workflows/pr_pre-commit.yaml.j2

+3-2
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,10 @@ jobs:
2121
version: ubuntu-latest
2222
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2323
with:
24-
fetch-depth: 0
24+
persist-credentials: false
2525
submodules: recursive
26-
- uses: stackabletech/actions/run-pre-commit@5b66858af3597c4ea34f9b33664b8034a1d28427 # v0.3.0
26+
fetch-depth: 0
27+
- uses: stackabletech/actions/run-pre-commit@2d3d7ddad981ae09901d45a0f6bf30c2658b1b78 # v0.7.0
2728
with:
2829
python-version: ${{ env.PYTHON_VERSION }}
2930
rust: ${{ env.RUST_TOOLCHAIN_VERSION }}

‎template/.pre-commit-config.yaml.j2

+13-9
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,13 @@ repos:
1414
args: ["--allow-missing-credentials"]
1515
- id: detect-private-key
1616

17-
- repo: https://github.com/doublify/pre-commit-rust
18-
rev: eeee35a89e69d5772bdee97db1a6a898467b686e # 1.0
19-
hooks:
20-
- id: clippy
21-
args: ["--all-targets", "--", "-D", "warnings"]
22-
2317
- repo: https://github.com/adrienverge/yamllint
2418
rev: 81e9f98ffd059efe8aa9c1b1a42e5cce61b640c6 # 1.35.1
2519
hooks:
2620
- id: yamllint
2721

2822
- repo: https://github.com/igorshubovych/markdownlint-cli
29-
rev: aa975a18c9a869648007d33864034dbc7481fe5e # 0.42.0
23+
rev: 586c3ea3f51230da42bab657c6a32e9e66c364f0 # 0.44.0
3024
hooks:
3125
- id: markdownlint
3226
types: [text]
@@ -42,15 +36,15 @@ repos:
4236
# If you do not, you will need to delete the cached ruff binary shown in the
4337
# error message
4438
- repo: https://github.com/astral-sh/ruff-pre-commit
45-
rev: 8983acb92ee4b01924893632cf90af926fa608f0 # 0.7.0
39+
rev: 2c8dce6094fa2b4b668e74f694ca63ceffd38614 # 0.9.9
4640
hooks:
4741
# Run the linter.
4842
- id: ruff
4943
# Run the formatter.
5044
- id: ruff-format
5145

5246
- repo: https://github.com/rhysd/actionlint
53-
rev: 4e683ab8014a63fafa117492a0c6053758e6d593 # 1.7.3
47+
rev: 03d0035246f3e81f36aed592ffb4bebf33a03106 # 1.7.7
5448
hooks:
5549
- id: actionlint
5650

@@ -74,10 +68,20 @@ repos:
7468
entry: cargo test
7569
stages: [pre-commit, pre-merge-commit, manual]
7670
pass_filenames: false
71+
files: \.rs$|Cargo\.(toml|lock)
7772

7873
- id: cargo-rustfmt
7974
name: cargo-rustfmt
8075
language: system
8176
entry: cargo +{[rust_nightly_version}] fmt --all -- --check
8277
stages: [pre-commit]
8378
pass_filenames: false
79+
files: \.rs$
80+
81+
- id: cargo-clippy
82+
name: cargo-clippy
83+
language: system
84+
entry: cargo clippy --all-targets -- -D warnings
85+
stages: [pre-commit]
86+
pass_filenames: false
87+
files: \.rs$

0 commit comments

Comments
 (0)