Tiger Kaovilai
6ed67c01a0
* Add Dependabot docker updates for run-jammy-tiny on supported release branches The runtime base image is pinned on each release branch and was only bumped by hand during CVE patch releases, so it goes stale between releases (release-1.18 pinned 0.2.177, release-1.17 pins 0.2.90). Add docker ecosystem entries targeting the supported release branches (the current minor and N-1), limited to the paketobuildpacks/run-jammy-tiny image and to patch updates. Dependabot cannot compute target-branch, so add hack/update-dependabot-release-branches.sh, which regenerates those entries from the two newest minors with a GA vX.Y.0 tag, and a workflow that runs it when a release is published (plus weekly and on demand) and opens a pull request if dependabot.yml changed. Pre-release tags do not count, so release-1.19 is only picked up once 1.19.0 is out. Related to https://github.com/velero-io/velero/issues/10681 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Address review feedback on Dependabot release-branch automation - Replace head with sed in the tag pipeline: with pipefail set, head closing early can SIGPIPE the upstream sort and fail the script. - Allow minor version updates for the runtime base image (only semver-major stays ignored), per Paketo's stack bump policy: minors are maintainer-selected feature additions that should surface as PRs for review. Regenerated dependabot.yml. - Update development.md wording to match (patch or minor). Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Scope Dependabot automation workflow commit to dependabot.yml Commit only .github/dependabot.yml instead of all modified files when the automation workflow pushes its branch. Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>
3.2 KiB
title, layout
| title | layout |
|---|---|
| Development | docs |
Update generated files
Run make update to regenerate files if you make the following changes:
- Add/edit/remove command line flags and/or their help text
- Add/edit/remove commands or subcommands
- Add new API types
- Add/edit/remove plugin protobuf message or service definitions
The following files are automatically generated from the source code:
- CRDs
- Documentation
- Protobuf/gRPC types
You can run make verify to ensure that all generated files (CRDs, docs) are up to date.
Linting
You can run make lint which executes golangci-lint inside the build image, or make local-lint which executes outside of the build image.
Both make lint and make local-lint will only run the linter against changes.
Use lint-all to run the linter against the entire code base.
The default linters are defined in the Makefile via the LINTERS variable.
You can also override the default list of linters by running the command
$ make lint LINTERS=gosec
Test
To run unit tests, use make test.
Using the main branch
If you are developing or using the main branch, note that you may need to update the Velero CRDs to get new changes as other development work is completed.
velero install --crds-only --dry-run -o yaml | kubectl apply -f -
NOTE: You could change the default CRD API version (v1beta1 or v1) if Velero CLI can't discover the Kubernetes preferred CRD API version. The Kubernetes version < 1.16 preferred CRD API version is v1beta1; the Kubernetes version >= 1.16 preferred CRD API version is v1.
Dependency management
Velero is written in Go and uses Go modules to manage its dependencies. Direct and indirect dependencies are declared in go.mod and pinned in go.sum.
The project keeps dependencies up to date and responds to upstream security fixes as follows:
- Dependabot is configured in
.github/dependabot.ymlto open pull requests for Go module and GitHub Actions updates on a weekly schedule. Updates are grouped to reduce noise. It also opens pull requests against each supported release branch (the current minor and N-1) to bump the pinnedpaketobuildpacks/run-jammy-tinyruntime base image to the latest patch or minor version. Dependabot cannot resolve release branches dynamically, so thetarget-branchentries are regenerated by the Update Dependabot release branches workflow, which opens a pull request when a release is published. - Dependency update pull requests follow the same review process as any other change: they must pass CI and be approved by a maintainer before merging.
- Security-relevant updates are prioritized. Vulnerabilities in dependencies that affect Velero are handled through the security release process.
- New direct dependencies should be kept to a minimum and use a license compatible with Velero's Apache 2.0 license.