sync master branch with upstream

.github/workflows/buildtest.yml

@@ -9,7 +9,7 @@ jobs:
   build-test:
     strategy:
       matrix:
-        go-version: [1.19.x]
+        go-version: [1.21.x]
         os: [ubuntu-latest]
         goos: [linux]
         goarch: [amd64, arm64, ppc64le]
@@ -18,12 +18,12 @@ jobs:
       GO111MODULE: on
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@v4
         with:
           go-version: ${{ matrix.go-version }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Build test for ${{ matrix.goarch }}
         env:
@@ -33,17 +33,17 @@ jobs:
 
       - name: Go test
         if: ${{ matrix.goarch }} == "amd64"
-        run: sudo go test ./... # sudo needed for netns change in test
+        run: sudo go test -race ./... # sudo needed for netns change in test
 
   coverage:
     runs-on: ubuntu-latest
     needs: build-test
     name: coverage
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.19.x
+          go-version: 1.21.x
 
       - name: Check out code into the Go module directory
         uses: actions/checkout@v2
@@ -52,7 +52,38 @@ jobs:
         run: sudo make test-coverage # sudo needed for netns change in test
 
       - name: Coveralls
-        uses: coverallsapp/github-action@1.1.3
+        uses: coverallsapp/github-action@v2
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
-          path-to-lcov: test/coverage/lcov.info
+          file: test/coverage/lcov.info
+
+  sriov-operator-e2e-test:
+    name: SR-IOV operator e2e tests
+    needs: [ build-test ]
+    runs-on: [ sriov ]
+    env:
+      TEST_REPORT_PATH: k8s-artifacts
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: build sriov-cni image
+        run: podman build -t ghaction-sriov-cni:pr-${{github.event.pull_request.number}} .
+
+      - name: Check out sriov operator's code
+        uses: actions/checkout@v2
+        with:
+          repository: k8snetworkplumbingwg/sriov-network-operator
+          path: sriov-network-operator-wc
+
+      - name: run test
+        run: make test-e2e-conformance-virtual-k8s-cluster-ci
+        working-directory: sriov-network-operator-wc
+        env:
+          LOCAL_SRIOV_CNI_IMAGE: ghaction-sriov-cni:pr-${{github.event.pull_request.number}}
+
+      - uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: ${{ env.TEST_REPORT_PATH }}
+          path: ./sriov-network-operator-wc/${{ env.TEST_REPORT_PATH }}

.github/workflows/codeql.yml

@@ -0,0 +1,41 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "37 4 * * 0"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ go ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/image-push-master.yml

@@ -13,51 +13,51 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to Docker
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push sriov-cni
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           push: true
           platforms: linux/amd64
           tags: |
             ${{ env.IMAGE_NAME }}:latest-amd64
-            ${{ steps.docker_meta.outputs.tags }}:${{ github.sha }}
+            ${{ env.IMAGE_NAME }}:${{ github.sha }}
           file: ./Dockerfile
 
   build-and-push-arm64-sriov-cni:
     name: Image Push ARM64
     runs-on: ubuntu-20.04
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to Docker
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push sriov-cni
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           push: true
@@ -71,23 +71,23 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Check out the repo
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
+        uses: docker/setup-qemu-action@v2
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@v2
 
       - name: Login to Docker
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push sriov-cni
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@v4
         with:
           context: .
           push: true
@@ -98,29 +98,21 @@ jobs:
 
   push-manifest:
     runs-on: ubuntu-20.04
-    needs: [build-and-push-amd64-sriov-cni,build-and-push-amr64-sriov-cni,build-and-push-ppc64le-sriov-cni]
+    needs: [build-and-push-amd64-sriov-cni,build-and-push-arm64-sriov-cni,build-and-push-ppc64le-sriov-cni]
     steps:
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
+      uses: docker/setup-buildx-action@v2
 
     - name: Login to GitHub Container Registry
-      uses: docker/login-action@v1
+      uses: docker/login-action@v2
       with:
         registry: ghcr.io
         username: ${{ github.repository_owner }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Create manifest for multi-arch images
       run: |
-        # pull
-        docker pull ${{ env.IMAGE_NAME }}:latest-amd64
-        docker pull ${{ env.IMAGE_NAME }}:latest-arm64
-        docker pull ${{ env.IMAGE_NAME }}:latest-ppc64le
-        # create
-        docker manifest create ${{ env.IMAGE_NAME }}:latest ${{ env.IMAGE_NAME }}:latest-amd64 ${{ env.IMAGE_NAME }}:latest-arm64 ${{ env.IMAGE_NAME }}:latest-ppc64le
-        # annotate
-        docker manifest annotate ${{ env.IMAGE_NAME }}:latest ${{ env.IMAGE_NAME }}:latest-amd64 --arch amd64
-        docker manifest annotate ${{ env.IMAGE_NAME }}:latest ${{ env.IMAGE_NAME }}:latest-arm64 --arch arm64
-        docker manifest annotate ${{ env.IMAGE_NAME }}:latest ${{ env.IMAGE_NAME }}:latest-ppc64le --arch ppc64le
-        # push
-        docker manifest push ${{ env.IMAGE_NAME }}:latest
+        docker buildx imagetools create -t ${{ env.IMAGE_NAME }}:latest \
+        ${{ env.IMAGE_NAME }}:latest-amd64 \
+        ${{ env.IMAGE_NAME }}:latest-arm64 \
+        ${{ env.IMAGE_NAME }}:latest-ppc64le