Merge branch 'kubernetes-sigs:main' into master

.github/dependabot.yml

@@ -1,3 +1,4 @@
+---
 version: 2
 updates:
   - package-ecosystem: gomod
@@ -17,6 +18,11 @@ updates:
       # Ignore k8s and its transitives modules as they are upgraded manually
       # together with controller-runtime.
       - dependency-name: "k8s.io/*"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "docker"
     directory: "/"
@@ -26,3 +32,23 @@ updates:
       - "area/dependency"
       - "release-note-none"
       - "ok-to-test"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "area/dependency"
+      - "release-note-none"
+      - "ok-to-test"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/codespell.yml

@@ -1,15 +1,18 @@
 # Helps catch spelling errors
 name: Codespell
-on: [ pull_request ]
+
+on:
+  pull_request:
 
 jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v2.5.0
-      - uses: codespell-project/actions-codespell@22ff5a2e4b591290baf82d47c9feadac31c65441 # v1.0
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
+      - uses: codespell-project/actions-codespell@94259cd8be02ad2903ba34a22d9c13de21a74461 # v2.0
         with:
-          skip: .git,_artifacts,*.sum
+          skip: .git,_artifacts,*.sum,.golangci.yml
           ignore_words_file: .codespellignore
           check_filenames: true
           check_hidden: true

.github/workflows/cover.yaml

@@ -1,15 +1,20 @@
 # add public code coverage reports
+name: coverage
+
 on:
   push:
     branches:
     - main
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
     - run: "make test-cover"
-    - uses: codecov/codecov-action@v2
-    with:
-      file: ./coverage.out
-      fail_ci_if_error: true
+
+    - uses: codecov/codecov-action@125fc84a9a348dbcf27191600683ec096ec9021c # v4.4.1
+      with:
+        file: ./coverage.out
+        fail_ci_if_error: true

.github/workflows/link-check.yml

@@ -1,5 +1,6 @@
 # Check for broken links
 name: Link-check
+
 on:
   push:
     paths:
@@ -8,13 +9,16 @@ on:
       - main
   pull_request:
     paths: "docs/**"
+
 jobs:
   lint_docs:
     name: Broken Links
     runs-on: ubuntu-latest
+
     steps:
-    - uses: actions/checkout@v2
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
+    - uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1.0.15
       with:
         use-quiet-mode: 'yes'
         config-file: ".markdownlinkcheck.json"

.github/workflows/lint.yml

@@ -1,17 +1,26 @@
 name: Lint
-on: [ pull_request ]
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
+      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
-          go-version: 1.19
+          go-version: "1.21"
           check-latest: true
+          cache: false
+
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3.2.0
+        uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1
         with:
-          version: v1.50.1
+          version: v1.58

.github/workflows/pr-gh-workflow-approve.yaml

@@ -0,0 +1,44 @@
+name: PR approve GH Workflows
+
+on:
+  pull_request_target:
+    types:
+      - edited
+      - labeled
+      - reopened
+      - synchronize
+
+jobs:
+  approve:
+    name: Approve ok-to-test
+
+    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: write
+
+    steps:
+      - name: Update PR
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const result = await github.rest.actions.listWorkflowRunsForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: "pull_request",
+              status: "action_required",
+              head_sha: context.payload.pull_request.head.sha,
+              per_page: 100
+            });
+
+            for (var run of result.data.workflow_runs) {
+              await github.rest.actions.approveWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: run.id
+              });
+            }

.gitignore

@@ -15,6 +15,7 @@ test/e2e/config/gcp-ci-envsubst.yaml
 # Output of the go coverage tool, specifically when used with LiteIDE
 *.out
 coverage.*
+!**/coverage.go
 
 # Ansible
 *.retry
@@ -31,6 +32,8 @@ envfile
 kind.kubeconfig
 minikube.kubeconfig
 kubeconfig
+# keep directories named kubeconfig
+!**/kubeconfig/
 
 # Example and binary output directory
 /out