* ci: add CodeQL analysis for Go
The Scorecard SAST check scores 0 because the repository only uses
github/codeql-action to upload SARIF from Scorecard and Trivy, and does
not run any static analysis. Add a CodeQL workflow for Go that runs on
pushes and pull requests to main and weekly, with actions pinned by
commit SHA. Skipped on forks.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-Authored-By: Claude Code (model: Claude Sonnet 5.5) <noreply@anthropic.com>
* ci: use autobuild for CodeQL Go analysis
The Go extractor does not support build-mode none. Set up Go from go.mod
and use autobuild.
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-Authored-By: Claude Code (model: Claude Sonnet 5.5) <noreply@anthropic.com>
---------
Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
Co-authored-by: Claude Code (model: Claude Sonnet 5.5) <noreply@anthropic.com>
* e2e: run the BSL deletion snapshot case on kind under CSI
The case was unskipped on kind by #10658 but left out of the matrix,
because nobody had checked whether it worked there. It does.
Run on kind with EnableCSI and Kibishii at the commit this workflow
pins:
BSL && Deletion && Snapshot Ran 1 of 70 Specs in 214.819 seconds
Kibishii installs from kubernetes/yaml/kind-csi, e2e-storage-class comes
from testdata/storage-class/kind-csi.yaml, and the snapshot checkpoint
reports EnableCSI with a real CSI snapshot handle rather than an empty
list, so the case verified a snapshot rather than passing with nothing to
check.
The row selects only the Snapshot variant. BSL && Deletion && FSBackup
is a separate case and stays out, since file system backup through a
deleted BackupStorageLocation has not been run here.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10747
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* e2e: run the Kibishii file system backup cases on kind under CSI
The two Basic FSBackup cases were unskipped on kind by #10658 but left
out of the matrix, because whether a PodVolumeBackup would pick up
Kibishii's volumes on a CSI-backed class had not been checked. It does.
isHostPathVolume in pkg/podvolume/backupper.go matches pv.Spec.HostPath,
and the kind-csi overlay provisions through hostpath.csi.k8s.io, so the
PV carries pv.Spec.CSI and the check stops matching. The driver's name
has nothing to do with the field, which is what made this worth running
rather than reasoning about.
Both cases pass on kind with EnableCSI, with a PodVolumeBackup per
Kibishii PVC rather than volumes skipped:
Basic && FSBackup && !RetainPV Ran 2 of 70 Specs in 529.790 seconds
Basic && FSBackup && RetainPV Ran 1 of 70 Specs in 303.670 seconds
The second resolves overlays/sc-reclaim-policy/kind-csi, so the reclaim
overlay is exercised on the file system backup path too.
The row is Basic && FSBackup, which selects exactly those two cases and
nothing else.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10680
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* e2e: give the namespace-mapping cases real volumes on kind under CSI
Init had two kind branches that are not skips. The first replaces
Kibishii's dataset with every dimension zero, so generate.sh and verify.sh
run over nothing. The second forces --snapshot-volumes=false and clears
UseVolumeSnapshots, which also skips the else branch that would add
--default-volumes-to-fs-backup.
Both were right while Kibishii's PVs on kind were hostPath, since neither
a CSI snapshot nor a PodVolumeBackup would pick them up. The effect is
that the two NamespaceMapping FSBackup cases in the kind matrix, which run
on every PR, assert the namespace mapping and nothing about the volumes
despite their label.
Gate both on the same predicate as the other Kibishii cases, so a run with
EnableCSI gets the real dataset and a real snapshot, and add a
NamespaceMapping && Snapshot row to the CSI matrix to select the two cases
that were in no row before.
The FSBackup pair keeps its current behaviour: it runs in the non-CSI job
where Kibishii is still hostPath, so it still takes the zero-data path.
Moving it needs file system backup proven on a CSI-backed class first.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10679
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
e2e: run the RetainPV case too, and move the predicate beside the mapping
The RetainPV case was left out of the matrix on the assumption that it
needed checking first. It did not: it passes. Run on kind with
EnableCSI, Ran 1 of 70 Specs in 354 seconds, 1 passed, installing from
overlays/sc-reclaim-policy/kind-csi and taking two real CSI snapshots of
Kibishii's PVCs. So drop the exclusion rather than add a second row, and
the label becomes plain Basic && Snapshot, which selects the plain
snapshot case and the retained-PV one.
That overlay is the other half of the Kibishii change, and nothing
exercised it until now.
KibishiiVolumesAreHostPath moves from test/types.go to sit beside
installKibishii, since it is the inverse of that function's Kind branch
and the two have to agree on what enabling CSI means. Each now points at
the other in a comment. There is no import cycle: the kibishii package
already dot-imports test, and every call site already dot-imports
kibishii.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* e2e: point Kibishii at the kind-csi overlay when CSI is enabled
installKibishii maps the cloud platform to a Kibishii overlay directory
and already swaps Azure and AWS for their CSI variants when EnableCSI is
set. Kind has no such branch, so a CSI run on kind gets the plain kind
overlay, whose StorageClass provisions with rancher.io/local-path. Those
PVs are hostPath volumes and Velero skips them for both CSI snapshots
and PodVolumeBackups, which is why the snapshot cases are guarded off on
kind today.
Add the kind branch alongside the other two, and move KIBISHII_COMMIT to
the commit that adds the overlay. The pin delta is additive: the only
difference between the two trees is the new kind-csi directory and its
reclaim-policy overlay, so the plain kind overlay that run-e2e-test uses
still builds on rancher.io/local-path.
Nothing selects a Kibishii case under EnableCSI yet, so this changes no
observable behaviour on its own. Narrowing the kind guards and adding a
label set to the CSI job follow separately.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10657
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
The kind e2e jobs download every module on every run. setup-go restores
its cache from main, but push.yml runs `go clean -modcache` before
setup-go's post step saves, so main holds an empty entry (1568 bytes)
under the key PR jobs ask for. They count it as a hit, so nothing is
ever saved over it.
- push.yml: turn off setup-go's cache, since the job empties it.
- e2e-test-kind.yaml: the build job restores one module cache, downloads
what the e2e jobs need on a miss (`go mod download` plus the ginkgo
CLI), and saves it before the job ends. The e2e jobs restore the same
key. It is keyed on go.mod and go.sum rather than the Go patch version,
which differed between runner images within one run.
- pr-ci-check.yml: point GOMODCACHE at .go/pkg/mod, which the build
container mounts, so `go mod tidy` on the host and the containerised
steps share one download that setup-go caches.
Fixes#10653
Signed-off-by: Parman Mohammadalizadeh <prmma23@gmail.com>
* e2e: run the CSI cases on kind in CI
The CSI cases have never run in CI. kind has no driver that can take
snapshots, so they were skipped by omission: no label set selects them
and FEATURES is never set.
Add a job that installs the snapshot stack with
hack/install-csi-hostpath.sh and runs them against it, with the
StorageClass pointed at a hostpath definition so the volumes can actually
be snapshotted.
It is a separate job rather than a fifth entry in the existing matrix.
Installing the stack measures at about 3.4 minutes, which every job would
pay, and ResourceFiltering already peaks six minutes under its timeout.
This also keeps a CSI problem from reddening a job that has nothing to do
with CSI.
It runs on the newest three Kubernetes versions. csi-driver-host-path
ships deploy manifests only for recent releases, so the older end of the
matrix has nothing to install.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10644
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Fix the MinIO image cache key in the kind e2e workflow
The build job restores the MinIO image with
minio-bitnami-${{ env.BITNAMI_CONTAINERS_COMMIT }} and the e2e jobs look
for the same key, but the save step writes
minio-bitnami-${{ steps.minio-version.outputs.dockerfile_sha }}. No step
has that id, so the expression is empty and the image is saved under a
key nothing ever reads.
Upstream only works because an entry under the right key is still in the
cache and kept alive by use; caches unused for seven days are evicted, so
a quiet week would leave every e2e job unable to load the image. A fork
has no such entry, so all of them fail at once:
Loading MinIO image...
./minio-image.tar: No such file or directory
Save under the key the restores ask for.
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
* Add changelog for #10631
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
---------
Signed-off-by: krishhna24 <krishhnatupedev@gmail.com>
Velero has no published OpenSSF Scorecard results, so the Scorecard
badge does not resolve and CLOMonitor flags the openssf_scorecard_badge
check as missing.
Add the ossf/scorecard-action workflow (SHA-pinned, least-privilege
permissions, publish_results enabled) running weekly and on push to
main. Once it runs post-merge, results publish to the OpenSSF API and
the README badge resolves. This also surfaces the project's security
posture (currently 6.2/10) to guide further hardening.
Part of the CNCF incubation readiness work (#10383).
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
Add an explicit top-level permissions block to the GitHub Actions
workflows that were relying on the default token permissions. Each
workflow now defaults to contents: read, with additional scopes granted
only where a job needs them:
* nightly-trivy-scan keeps security-events: write at the job level to
upload SARIF results, plus contents: read for checkout.
* stale-issues gets issues: write and pull-requests: write for the
actions/stale action to label and close stale items.
Setting least-privilege permissions reduces the blast radius if a
workflow or one of its dependencies is compromised, and satisfies the
CLOMonitor token_permissions check.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
The changelog check decided whether a PR was exempt using the labels in
the triggering event payload (github.event.pull_request.labels). That
payload is frozen at event time, so a PR that gets the
kind/changelog-not-required label after its first run could not pass by
re-running the failed job, and the exemption only took effect if a brand
new event happened to fire afterward.
Move the exemption logic into hack/changelog-check.sh and query the PR's
current labels via the GitHub API instead. Re-runs and labels added after
the initial run are now evaluated correctly. The workflow grants
pull-requests: read and passes github.token so the script can read labels.
The exempt label set (kind/changelog-not-required, Design, Website,
Documentation) is unchanged.
Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com>
* Fix e2e cache miss on force push by saving artifacts explicitly
actions/cache@v4 writes the cache in a post-job hook that runs after the
job reports completion. The run-e2e-test jobs (needs: build) start as
soon as build completes, before that post-hook save runs, so on a force
push -- where the github.sha-keyed cache has no prior entry -- they
deterministically miss the cache and fail with
'stat velero.tar: no such file or directory'.
Switch the build job's lookups to actions/cache/restore and add explicit
actions/cache/save steps at the end of the job (CLI, image, and MinIO),
so the cache is written before build reports done. The run-e2e-test
reads become actions/cache/restore.
Fixes#9927
Signed-off-by: alliasgher <alliasgher123@gmail.com>
* Add changelog for #9952
Signed-off-by: alliasgher <alliasgher123@gmail.com>
---------
Signed-off-by: alliasgher <alliasgher123@gmail.com>
config/crd/{v1,v2alpha1}/crds/crds.go were generated files that
gzip-compressed the CRD YAML bases into committed []byte literals via
hack/crd-gen, requiring `go generate` and a dedicated CI drift check
(hack/verify-generated-crd-code.sh). This made the files large,
unreviewable in diffs, and a frequent source of merge conflicts.
Replace the generated files with config/crd/{v1,v2alpha1}/crds.go
using `//go:embed bases/*.yaml` to embed the already-committed YAML
manifests directly, decoding them the same way at init. Since Go's
go:embed can't reach outside a file's own directory tree, the crds
package now lives alongside bases/ instead of in a bases-sibling
subdirectory; import paths in pkg/install and pkg/controller were
updated accordingly.
Drop hack/crd-gen and hack/verify-generated-crd-code.sh entirely, and
trim their references from update-3generated-crd-code.sh and the
codespell skip-list. No codegen step remains, so no drift is possible.
Fixes#10328
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 1 (High)
AI-Code-Category: Category 1 (Production)
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>
* Fix e2e kind matrix misparsing pre-release node tags
The setup-test-matrix step excluded "alpha|beta" pre-release tags but
not "rc" ones. A tag like v1.37.0-rc.1 slipped through to the awk
field-splitter, which treats "." as the only separator: splitting
"v1.37.0-rc.1" yields ["v1","37","0-rc","1"], and printing
$1"."$2"."$NF produced the bogus version "v1.37.1" - an image that
was never published, since the real tag is v1.37.0-rc.1.
Replace the two greps with a single anchored pattern that only
matches well-formed vX.Y.Z tags, so any hyphenated pre-release
suffix (rc, alpha, beta, or otherwise) is excluded before reaching
the awk step.
Fixes#10358
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 2 (Medium)
AI-Code-Category: Category 2 (Non-Production)
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
* Add changelog entry for e2e matrix fix
AI-Tool-Used: Claude Code
AI-Tool-Use-Level: Category 3 (Low)
AI-Code-Category: Category 2 (Non-Production)
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
---------
Signed-off-by: lubronzhan <lubron.zhan@broadcom.com>
Pin bitnami/containers and distributed-data-generator to fixed SHAs instead of building default-branch HEAD, and add a minimal permissions block.
Signed-off-by: chlins <chlins.zhang@gmail.com>
* Replace rebase action with GitHub CLI
Signed-off-by: chlins <chlins.zhang@gmail.com>
* Add contents write permission for rebase workflow
Updating the PR branch pushes to the head branch, which requires contents: write for the GITHUB_TOKEN.
Signed-off-by: chlins <chlins.zhang@gmail.com>
---------
Signed-off-by: chlins <chlins.zhang@gmail.com>
dependabot[bot]
Tiger KaovilaiandClaude Code
KrishhnaT
Parman Mohammadalizadeh
copilot-swe-agent[bot]
Shubham Pampattiwar
Xun Jiang/Bruce Jiang
Ali Asghar
LubronandDaniel Jiang
R4mbo
PragatiVerma111andPragati
Chlins Zhang
Scott Seago