mirror of
https://github.com/vmware-tanzu/velero.git
synced 2026-11-08 04:18:06 +00:00
Tiger Kaovilai
6ed67c01a0
* Add Dependabot docker updates for run-jammy-tiny on supported release branches The runtime base image is pinned on each release branch and was only bumped by hand during CVE patch releases, so it goes stale between releases (release-1.18 pinned 0.2.177, release-1.17 pins 0.2.90). Add docker ecosystem entries targeting the supported release branches (the current minor and N-1), limited to the paketobuildpacks/run-jammy-tiny image and to patch updates. Dependabot cannot compute target-branch, so add hack/update-dependabot-release-branches.sh, which regenerates those entries from the two newest minors with a GA vX.Y.0 tag, and a workflow that runs it when a release is published (plus weekly and on demand) and opens a pull request if dependabot.yml changed. Pre-release tags do not count, so release-1.19 is only picked up once 1.19.0 is out. Related to https://github.com/velero-io/velero/issues/10681 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Address review feedback on Dependabot release-branch automation - Replace head with sed in the tag pipeline: with pipefail set, head closing early can SIGPIPE the upstream sort and fail the script. - Allow minor version updates for the runtime base image (only semver-major stays ignored), per Paketo's stack bump policy: minors are maintainer-selected feature additions that should surface as PRs for review. Regenerated dependabot.yml. - Update development.md wording to match (patch or minor). Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Scope Dependabot automation workflow commit to dependabot.yml Commit only .github/dependabot.yml instead of all modified files when the automation workflow pushes its branch. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
93 lines
3.2 KiB
Bash
Executable File
93 lines
3.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Copyright the Velero contributors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Dependabot cannot compute `target-branch`, so regenerate the docker entries
|
|
# in .github/dependabot.yml for the currently supported release branches.
|
|
# The runtime base image is run-jammy-tiny on older branches and
|
|
# ubuntu-noble-run-tiny from the branch `main` is on, so both are allowed.
|
|
#
|
|
# Supported branches are the newest SUPPORTED_MINORS minor versions that have
|
|
# a GA `vX.Y.0` tag (pre-release tags such as `vX.Y.0-rc.1` do not count), so a
|
|
# `release-X.Y` branch is not picked up before X.Y.0 is released.
|
|
#
|
|
# Only the lines between the BEGIN and END markers in dependabot.yml are
|
|
# rewritten. Run from the repository root; this is a no-op when the file is
|
|
# already up to date.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_URL="${REPO_URL:-https://github.com/velero-io/velero.git}"
|
|
DEPENDABOT_FILE="${DEPENDABOT_FILE:-.github/dependabot.yml}"
|
|
SUPPORTED_MINORS="${SUPPORTED_MINORS:-2}"
|
|
|
|
BEGIN_MARKER=" # BEGIN generated by hack/update-dependabot-release-branches.sh, do not edit by hand"
|
|
END_MARKER=" # END generated by hack/update-dependabot-release-branches.sh"
|
|
|
|
# Newest first, e.g. "1.18" then "1.17".
|
|
minors=$(git ls-remote --tags --refs "${REPO_URL}" 'v*.*.0' |
|
|
sed -n 's#.*refs/tags/v\([0-9][0-9]*\.[0-9][0-9]*\)\.0$#\1#p' |
|
|
sort -t. -k1,1nr -k2,2nr -u |
|
|
sed -n "1,${SUPPORTED_MINORS}p")
|
|
|
|
if [[ -z "${minors}" ]]; then
|
|
echo "no GA release tags found in ${REPO_URL}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if ! grep -qxF "${BEGIN_MARKER}" "${DEPENDABOT_FILE}" || ! grep -qxF "${END_MARKER}" "${DEPENDABOT_FILE}"; then
|
|
echo "${DEPENDABOT_FILE} is missing the BEGIN/END markers" >&2
|
|
exit 1
|
|
fi
|
|
|
|
generated=$(mktemp)
|
|
output=$(mktemp)
|
|
trap 'rm -f "${generated}" "${output}"' EXIT
|
|
|
|
for minor in ${minors}; do
|
|
cat >>"${generated}" <<EOF
|
|
- package-ecosystem: "docker"
|
|
directory: "/"
|
|
target-branch: "release-${minor}"
|
|
schedule:
|
|
interval: "weekly"
|
|
allow:
|
|
- dependency-name: "paketobuildpacks/run-jammy-tiny"
|
|
- dependency-name: "paketobuildpacks/ubuntu-noble-run-tiny"
|
|
ignore:
|
|
- dependency-name: "*"
|
|
update-types: ["version-update:semver-major"]
|
|
labels:
|
|
- "Dependencies"
|
|
- "kind/changelog-not-required"
|
|
commit-message:
|
|
prefix: "[release-${minor}]"
|
|
EOF
|
|
done
|
|
|
|
awk -v begin="${BEGIN_MARKER}" -v end="${END_MARKER}" -v generated="${generated}" '
|
|
$0 == begin {
|
|
print
|
|
while ((getline line < generated) > 0) print line
|
|
skipping = 1
|
|
next
|
|
}
|
|
$0 == end { skipping = 0 }
|
|
!skipping { print }
|
|
' "${DEPENDABOT_FILE}" >"${output}"
|
|
|
|
cat "${output}" >"${DEPENDABOT_FILE}"
|
|
echo "supported release branches: $(echo "${minors}" | sed 's/^/release-/' | paste -sd, -)"
|