Merge branch 'open-component-model:main' into main

.dockerignore

@@ -0,0 +1,37 @@
+.github
+.reuse
+.vscode
+.idea
+.project
+.settings
+
+bin
+
+/cmds/demoplugin
+/cmds/ecrplugin
+/cmds/helminstaller
+/cmds/test
+/components/demoplugin
+/components/ecrplugin
+/components/helmdemo
+/components/helminstaller
+/components/subchartsdemo
+
+/docs
+/examples
+/hack
+/LICENSES
+/local
+
+/pkg/test*
+
+/testdata
+/tmp
+
+.*
+*.exe
+*.md
+**/Dockerfile
+
+!go.*
+!**/*.go

.github/dependabot.yml

@@ -10,7 +10,7 @@ updates:
           - "*"
     schedule:
       interval: "weekly"
-      day: "sunday"
+      day: "friday"
   - package-ecosystem: "gomod"
     directory: "/"
     groups:

.github/pull_request_template.md

@@ -11,6 +11,7 @@ Please include a summary of the changes and the related issue. Please also inclu
 ## What type of PR is this? (check all applicable)
 
 - [ ] 🍕 Feature
+- [ ] 🎇 Restructuring
 - [ ] 🐛 Bug Fix
 - [ ] 📝 Documentation Update
 - [ ] 🎨 Style

.github/workflows/blackduck_scan_scheduled.yaml

@@ -18,9 +18,14 @@ jobs:
         with:
           java-version: '17'
           distribution: 'temurin'
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: '${{ github.workspace }}/go.mod'
 
       - name: Blackduck Full Scan
-        uses: mercedesbenzio/detect-action@v1
+        uses: mercedesbenzio/detect-action@v2
         env:
           DETECT_PROJECT_USER_GROUPS: opencomponentmodel
           DETECT_PROJECT_VERSION_DISTRIBUTION: SAAS

.github/workflows/buildcomponents.yaml

@@ -24,6 +24,9 @@ jobs:
       packages: write
       repository-projects: read
     steps:
+      - name: Self Hosted Runner Post Job Cleanup Action
+        uses: TooMuch4U/[email protected]
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -63,4 +66,4 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: ocm.ctf
-          path: gen/ctf
+          path: gen/ctf

.github/workflows/codeql.yml

@@ -0,0 +1,95 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '26 14 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: go
+          build-mode: autobuild
+        # CodeQL supports the following values keywords for 'language': 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Self Hosted Runner Post Job Cleanup Action
+      uses: TooMuch4U/[email protected]
+
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/components.yaml

@@ -39,6 +39,7 @@ jobs:
         run: |
           cd components/ocmcli
           PATH=$PATH:$(go env GOPATH)/bin make ctf
+
   build-helminstaller:
     name: Build HelmInstaller
     runs-on: large_runner
@@ -65,6 +66,7 @@ jobs:
         run: |
           cd components/helminstaller
           PATH=$PATH:$(go env GOPATH)/bin make ctf
+
   build-helmdemo:
     name: Build HelmDemo
     runs-on: large_runner
@@ -91,6 +93,7 @@ jobs:
         run: |
           cd components/helmdemo
           PATH=$PATH:$(go env GOPATH)/bin make ctf
+
   build-subchartsdemo:
     name: Build Helm SubChartsDemo
     runs-on: large_runner
@@ -117,10 +120,14 @@ jobs:
         run: |
           cd components/subchartsdemo
           PATH=$PATH:$(go env GOPATH)/bin make ctf
+
   build-ecrplugin:
     name: Build ECR Plugin
     runs-on: large_runner
     steps:
+      - name: Self Hosted Runner Post Job Cleanup Action
+        uses: TooMuch4U/[email protected]
+
       - name: Checkout
         uses: actions/checkout@v4
         with:

.github/workflows/lint_and_test.yaml

@@ -38,7 +38,8 @@ jobs:
       - name: Unit test
         run: |
           PATH=$PATH:$(go env GOPATH)/bin make build
-          PATH=$PATH:$(go env GOPATH)/bin make test
+          PATH=$PATH:$(go env GOPATH)/bin make test-all
+
   lint:
     name: Lint
     runs-on: large_runner
@@ -71,10 +72,14 @@ jobs:
       - name: Lint
         run: |
           PATH=$PATH:$(go env GOPATH)/bin make check
+
   generate:
     name: DeepCopy verification
     runs-on: large_runner
     steps:
+      - name: Self Hosted Runner Post Job Cleanup Action
+        uses: TooMuch4U/[email protected]
+
       - name: Checkout
         uses: actions/checkout@v4
         with:
@@ -99,3 +104,4 @@ jobs:
       - name: Check for diff
         run: |
           git diff --exit-code --shortstat
+  

.github/workflows/pr_run_inttest.yaml

@@ -29,7 +29,7 @@ jobs:
         private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
     - name: Repository Dispatch
       if: github.event.pull_request.head.repo.fork == false
-      uses: myrotvorets/[email protected].0
+      uses: myrotvorets/[email protected].2
       with:
         token: ${{ steps.generate_token.outputs.token }} # metadata:read and contents:read&write
         repo: open-component-model/ocm-integrationtest

.github/workflows/push_ocm.yaml

@@ -0,0 +1,73 @@
+name: publish as latest
+on:
+  # publish on pushes to the main branch (image tagged as "latest")
+  # https://github.com/open-component-model/ocm/pkgs/container/ocm
+  push:
+    branches:
+      - main
+
+jobs:
+  docker_publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      packages: write
+
+    steps:
+      - name: Generate token
+        id: generate_token
+        uses: tibdex/github-app-token@v2
+        with:
+          app_id: ${{ secrets.OCMBOT_APP_ID }}
+          private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ steps.generate_token.outputs.token }}
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Docker Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |            
+            ghcr.io/${{ github.repository }}
+
+      - name: Go Build Cache for Docker
+        uses: actions/cache@v4
+        with:
+          path: go-build-cache
+          key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
+
+      - name: inject go-build-cache into docker
+        uses: reproducible-containers/buildkit-cache-dance@v3
+        with:
+          cache-source: go-build-cache
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          # supported platforms of https://hub.docker.com/_/golang/tags?page=1&name=1.22-alpine3.19
+          # platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
+          push: true
+          tags: |
+            ghcr.io/open-component-model/ocm:latest
+            ghcr.io/open-component-model/ocm/ocm.software/ocmcli/ocmcli-image:latest
+            ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/release.yaml

@@ -122,6 +122,8 @@ jobs:
       id-token: write
       packages: write
     steps:
+    - name: Self Hosted Runner Post Job Cleanup Action
+      uses: TooMuch4U/[email protected]
     - name: Generate token
       id: generate_token
       uses: tibdex/github-app-token@v2
@@ -140,10 +142,10 @@ jobs:
         go-version-file: '${{ github.workspace }}/go.mod'
 
     - name: Setup Syft
-      uses: anchore/sbom-action/download-syft@b6a39da80722a2cb0ef5d197531764a89b5d48c3 # v0.15.8
+      uses: anchore/sbom-action/download-syft@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0
 
     - name: Setup Cosign
-      uses: sigstore/cosign-installer@v3.4.0
+      uses: sigstore/cosign-installer@v3.5.0
 
     - name: Setup git config
       run: |
@@ -191,6 +193,7 @@ jobs:
     - name: Update Release Notes File
       env:
         RELEASE_NOTES: ${{ steps.release-notes.outputs.body }}
+        GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
       run: |
         if git ls-remote --exit-code origin refs/tags/${{ env.RELEASE_VERSION }}; then
           >&2 echo "tag ${{ env.RELEASE_VERSION }} already exists"
@@ -210,8 +213,10 @@ jobs:
         fi
 
     - name: Create and Push Release
+      env:
+        GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
       run: |
-        git checkout --detach HEAD
+        # git checkout --detach HEAD
         echo -n "${RELEASE_VERSION#v}" > VERSION
         git add VERSION
         git commit -m "Release $RELEASE_VERSION"

.gitignore

@@ -19,3 +19,4 @@ bin/
 go.mod.bak
 dist/
 .cache_ggshield
+.DS_Store

.golangci.yaml

@@ -134,6 +134,9 @@ linters-settings:
     line-length: 120
   gosec:
     exclude-generated: true
+  gocritic:
+    disabled-checks:
+      - elseif
 
 issues:
   exclude: