[Feat]: Support for AWS ECR Authentication with Temporary Tokens

.github/workflows/benchmark.yaml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       # Run benchmark with `go test -bench` and stores the output to a file
       - name: Run benchmark
         run: make BENCH_OUTPUT=ci-cd run-bench
@@ -30,7 +30,7 @@ jobs:
           key: ${{ runner.os }}-gen1-benchmark
       # Run `github-action-benchmark` action
       - name: Store benchmark result
-        uses: benchmark-action/[email protected].3
+        uses: benchmark-action/[email protected].4
         with:
           # What benchmark tool the output.txt came from
           tool: 'customBiggerIsBetter'

.github/workflows/branch-cov.yaml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE

.github/workflows/build.yaml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Cache go dependencies
         id: cache-go-dependencies
         uses: actions/cache@v4

.github/workflows/cloc.yaml

@@ -21,7 +21,7 @@ jobs:
         uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Check out source code
         uses: actions/checkout@v4
       - name: Install dependencies

.github/workflows/cluster.yaml

@@ -31,7 +31,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
@@ -50,6 +50,7 @@ jobs:
           cd $GITHUB_WORKSPACE
           make binary
           make bench
+          make $PWD/hack/tools/bin/oras
 
       - name: Setup minio service
         run: |
@@ -130,6 +131,7 @@ jobs:
             skopeo --debug copy --src-tls-verify=false docker://localhost:8080/golang:1.20 oci:golang:1.20
             echo "{\"name\":\"foo\",\"value\":\"bar\"}" > config.json
             echo "hello world" > artifact.txt
+            export PATH=$PATH:$PWD/hack/tools/bin
             oras push --plain-http localhost:8080/hello-artifact:v2 \
                 --config config.json:application/vnd.acme.rocket.config.v1+json \
                     artifact.txt:text/plain -d -v
@@ -185,7 +187,7 @@ jobs:
           key: ${{ runner.os }}-gen1-benchmark-stateless-cluster
       # Run `github-action-benchmark` action
       - name: Store benchmark result
-        uses: benchmark-action/[email protected].3
+        uses: benchmark-action/[email protected].4
         with:
           # What benchmark tool the output.txt came from
           tool: 'customBiggerIsBetter'

.github/workflows/codeql-analysis.yml

@@ -49,11 +49,11 @@ jobs:
       uses: actions/setup-go@v5
       with:
         cache: false
-        go-version: 1.22.x
+        go-version: 1.23.x
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3.26.10
+      uses: github/codeql-action/init@v3.28.0
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -64,7 +64,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3.26.10
+      uses: github/codeql-action/autobuild@v3.28.0
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -77,4 +77,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3.26.10
+      uses: github/codeql-action/analyze@v3.28.0

.github/workflows/compare-binary-size.yaml

@@ -14,7 +14,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Checkout zot (main branch)
         run: |
           mkdir -p $GITHUB_WORKSPACE/zot_main

.github/workflows/ecosystem-tools.yaml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
@@ -37,15 +37,23 @@ jobs:
           # install cri-o (for crictl)
           OS=xUbuntu_22.04
           CRIO_VERSION=1.26
-          echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/ /"|sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list
-          echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$CRIO_VERSION/$OS/ /"|sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable:cri-o:$CRIO_VERSION.list
-          curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable:/cri-o:/$CRIO_VERSION/$OS/Release.key | sudo apt-key add -
-          curl -L https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/$OS/Release.key | sudo apt-key add -
+          curl -fsSL https://download.opensuse.org/repositories/isv:/kubernetes:/addons:/cri-o:/prerelease:/main:/build/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/cri-o-apt-keyring.gpg
+          echo "deb [signed-by=/etc/apt/keyrings/cri-o-apt-keyring.gpg] https://download.opensuse.org/repositories/isv:/kubernetes:/addons:/cri-o:/prerelease:/main:/build/deb/ /" | sudo tee /etc/apt/sources.list.d/cri-o.list
           sudo apt update
-          sudo apt install -y cri-o cri-o-runc
+          sudo apt install -y cri-o runc
           sudo systemctl enable crio.service
           sudo systemctl start crio.service
           sudo chmod 0777 /var/run/crio/crio.sock
+          # install docker
+          # Add Docker's official GPG key:
+          sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
+          sudo chmod a+r /etc/apt/keyrings/docker.asc
+          echo \
+          "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
+           $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
+          sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+          sudo apt update
+          sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
           # install dex
           git clone https://github.com/dexidp/dex.git
           cd dex/

.github/workflows/gc-stress-test.yaml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
 
       - name: Run zb
         id: bench
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
 
       - name: Run zb
         id: bench
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - uses: ./.github/actions/setup-localstack
       - name: Setup minio service
         run: |
@@ -157,7 +157,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - uses: ./.github/actions/setup-localstack
       - name: Setup minio service
         run: |

.github/workflows/golangci-lint.yaml

@@ -18,13 +18,13 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: '1.22'
+          go-version: '1.23'
       - uses: actions/checkout@v4
       - name: Run linter with GH action
         uses: golangci/golangci-lint-action@v6
         with:
           # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: v1.59.1
+          version: v1.61.0
 
           # Optional: working directory, useful for monorepos
           # working-directory: somedir

.github/workflows/gqlgen.yaml

@@ -25,7 +25,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE

.github/workflows/license.yaml

@@ -22,7 +22,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install go-licenses
         run: go install github.com/google/go-licenses@latest
       - name: Check for forbidden licenses

.github/workflows/nightly.yaml

@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
@@ -72,7 +72,7 @@ jobs:
         uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
@@ -90,7 +90,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - uses: ./.github/actions/setup-localstack
 
       - name: Run zb
@@ -127,7 +127,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - uses: ./.github/actions/setup-localstack
 
       - name: Run zb
@@ -175,7 +175,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE
@@ -206,7 +206,7 @@ jobs:
       - uses: actions/setup-go@v5
         with:
           cache: false
-          go-version: 1.22.x
+          go-version: 1.23.x
       - name: Install dependencies
         run: |
           cd $GITHUB_WORKSPACE

.github/workflows/oci-conformance-action.yaml

@@ -20,11 +20,11 @@ jobs:
     runs-on: ubuntu-latest
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-    - name: Install go 1.22
+    - name: Install go 1.23
       uses: actions/setup-go@v5
       with:
         cache: false
-        go-version: 1.22.x
+        go-version: 1.23.x
     - name: Checkout this PR
       uses: actions/checkout@v4
     - name: Start zot server

.github/workflows/publish.yaml

@@ -9,7 +9,7 @@ permissions: read-all
 jobs:
   push-singlearch-image:
     name: Push single arch OCI images to GitHub Packages
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
@@ -87,7 +87,7 @@ jobs:
   push-multiarch-image:
     name: Push multiarch OCI images to GitHub Packages
     needs: push-singlearch-image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       contents: read
       packages: write
@@ -117,7 +117,7 @@ jobs:
   test-image:
     name: Test OCI images published to GitHub Packages
     needs: push-multiarch-image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       packages: read
     steps:
@@ -203,7 +203,7 @@ jobs:
   scan-image:
     name: Run Trivy scan on OCI images published to GitHub Packages
     needs: push-singlearch-image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       security-events: write
       packages: read
@@ -237,14 +237,14 @@ jobs:
           TRIVY_USERNAME: ${{ github.actor }}
           TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3.26.10
+        uses: github/codeql-action/upload-sarif@v3.28.0
         with:
           sarif_file: 'trivy-results.sarif'
 
   scan-multiarch-image:
     name: Run Trivy scan on OCI multiarch images published to GitHub Packages
     needs: push-multiarch-image
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     permissions:
       security-events: write
       packages: read
@@ -274,18 +274,18 @@ jobs:
           TRIVY_USERNAME: ${{ github.actor }}
           TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3.26.10
+        uses: github/codeql-action/upload-sarif@v3.28.0
         with:
           sarif_file: 'trivy-results.sarif'
 
   update-helm-chart:
-    if: github.event_name == 'release' && github.event.action== 'published'
+    if: ${{ github.event_name == 'release' && github.event.action == 'published' && !contains(github.event.release.tag_name, 'rc') }}
     needs: push-multiarch-image
     name: Update Helm Chart
     permissions:
       contents: write
       packages: write
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:

.github/workflows/scorecards.yaml

@@ -57,6 +57,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3.26.10
+        uses: github/codeql-action/upload-sarif@v3.28.0
         with:
           sarif_file: results.sarif