Merge branch 'main' into gate

.dockerignore

@@ -22,6 +22,7 @@ bin
 /hack
 /LICENSES
 /local
+/gen
 
 /pkg/test*
 
@@ -35,3 +36,4 @@ bin
 
 !go.*
 !**/*.go
+!.git

.github/CODEOWNERS

@@ -3,6 +3,10 @@
 # will be requested for review when someone opens a pull request.
 *       @open-component-model/Maintainers
 
+# Changes on repository settings require admin permissions
+/.github/settings.yml   @open-component-model/admins
+/.github/CODEOWNERS     @open-component-model/admins
+
 # Owners for specific directories
 #/docs/  @<org>/<team>
 #/src/   @<org>/<team>

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,7 +1,7 @@
 ---
 name: Bug Report
 about: Report a bug
-labels: kind/bug
+labels: kind/bugfix
 ---
 
 <!-- markdownlint-disable MD041 -->

.github/ISSUE_TEMPLATE/enhancement_request.md

@@ -1,7 +1,7 @@
 ---
 name: Enhancement Request
 about: Suggest an enhancement
-labels: kind/enhancement
+labels: kind/feature
 ---
 
 <!-- markdownlint-disable MD041 -->

.github/ISSUE_TEMPLATE/user_story.md

@@ -1,7 +1,7 @@
 ---
 name: User Story
 about: User Story
-labels:
+labels: kind/feature
 title: <User Story> - Title
 ---
 

.github/config/labeler.yml

@@ -1,9 +1,27 @@
 # see https://github.com/actions/labeler?tab=readme-ov-file#match-object to configure correctly
-dependencies:
+kind/dependency:
 - any:
   - head-branch: 'dependencies/*'
   - head-branch: 'dependabot/*'
-github-actions:
+  - changed-files:
+    - any-glob-to-any-file: ['go.mod', 'go.sum']
+component/github-actions:
+- any:
+  - changed-files:
+    - any-glob-to-any-file: ['.github/**']
+area/documentation:
+- any:
+  - changed-files:
+    - any-glob-to-any-file: ['docs/**', 'examples/**']
+component/ocm-cli:
+- any:
+  - changed-files:
+    - any-glob-to-any-file: ['components/ocmcli/**', 'cmds/ocm/**']
+component/ocm-spec:
+- any:
+  - changed-files:
+    - any-glob-to-any-file: ['resources/**']
+kind/skip-release-notes:
 - any:
   - changed-files:
-    - any-glob-to-any-file: ['.github/**']
+    - any-glob-to-any-file: ['flake.lock', 'flake.nix']

.github/config/markdown-link-check.json

@@ -5,5 +5,6 @@
      { "pattern": "^http[s]*://localhost.*" }
     ,{ "pattern": "^https://.*\\.sigstore\\.dev.*" }
     ,{ "pattern": "^{{.*}}$" }
+    ,{ "pattern": "^https://github.com/**/compare/**" }
   ]
 }

.github/config/markdownignore

@@ -1,3 +1,4 @@
 examples/lib/tour/0*
 docs/reference
 docs/pluginreference
+hack/collapse/*

.github/config/release.yml

@@ -0,0 +1,30 @@
+changelog:
+  # ../workflows/pull_request.yaml#verify-labels one_of: kind/chore,kind/bugfix,kind/feature,kind/dependency,kind/refactor
+  exclude:
+    labels:
+    - 'kind/skip-release-notes'
+    - 'dev/wont-fix'
+    - 'dev/cant-reproduce'
+  # if an issue matches more than one category, the first one in the list will be used
+  # Example:
+  # Labels: kind/chore, kind/dependency => Category: Dependencies
+  categories:
+  - title: '‼️ Breaking Changes'
+    labels:
+    - '!BREAKING-CHANGE!'
+  - title: '🚀 Features'
+    labels:
+    - 'kind/feature'
+  - title: '🐛 Bug Fixes'
+    labels:
+    - 'kind/bugfix'
+  - title: '⬆️ Dependencies'
+    labels:
+      - 'kind/dependency'
+  - title: '🧰 Maintenance'
+    labels:
+    - 'kind/chore'
+    - 'kind/refactor'
+  - title: 'Other Changes'
+    labels:
+      - "*"

.github/config/wordlist.txt

@@ -27,6 +27,7 @@ bool
 boolean
 buildx
 cas
+changelog
 chocolateyinstall
 cli
 cliconfig
@@ -216,6 +217,7 @@ packageversion
 parameterization
 pendingdeprecationwarning
 pflag
+pkgs
 podinfo
 podman
 pre
@@ -240,6 +242,7 @@ resendbuffer
 resmgmt
 resolvers
 resourcereference
+retrigger
 routings
 routingslips
 rsa
@@ -306,4 +309,4 @@ xml
 yaml
 yitsushi
 yml
-yyyy
+yyyy

.github/dependabot.yml

@@ -11,6 +11,11 @@ updates:
     schedule:
       interval: "weekly"
       day: "sunday"
+    labels:
+      - kind/dependency
+      - kind/chore
+      - kind/skip-release-notes
+      - component/github-actions
   - package-ecosystem: "gomod"
     directory: "/"
     groups:
@@ -19,3 +24,14 @@ updates:
     schedule:
       interval: "weekly"
       day: "sunday"
+    labels:
+      - kind/dependency
+      - kind/chore
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+    labels:
+      - kind/dependency
+      - kind/chore

.github/settings.yml

@@ -0,0 +1,8 @@
+# These settings are synced to GitHub by https://probot.github.io/apps/settings/
+
+# see: https://github.com/open-component-model/.github/blob/main/.github/settings.yml
+_extends: .github
+
+labels:
+- name: repo/ocm
+  color: bfd4f2

.github/workflows/components.yaml

@@ -33,6 +33,8 @@ env:
   components: '["ocmcli", "helminstaller", "helmdemo", "subchartsdemo", "ecrplugin"]'
   IMAGE_PLATFORMS: 'linux/amd64 linux/arm64'
   PLATFORMS: 'windows/amd64 darwin/arm64 darwin/amd64 linux/amd64 linux/arm64'
+  BUILDX_CACHE_PUSH: false
+  BUILDX_CACHE_REF_BASE: ghcr.io/${{ github.repository }}/buildx-cache
 
 jobs:
   define-matrix:
@@ -66,6 +68,14 @@ jobs:
         with:
           go-version-file: '${{ github.workspace }}/go.mod'
           cache: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Docker Login
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Get go environment for use with cache
         run: |
           echo "go_cache=$(go env GOCACHE)" >> $GITHUB_ENV
@@ -95,6 +105,8 @@ jobs:
           VERSION=${{ inputs.version }} \
           PLATFORMS="${{ env.PLATFORMS }}" \
           IMAGE_PLATFORMS="${{ env.IMAGE_PLATFORMS }}" \
+          BUILDX_CACHE_REF=${{ env.BUILDX_CACHE_REF_BASE }}:${{ matrix.component }} \
+          BUILDX_CACHE_PUSH=${{ env.BUILDX_CACHE_PUSH }} \
           make \
             ctf descriptor describe
       - name: Upload CTF

.github/workflows/flake_vendorhash.yaml

@@ -59,6 +59,6 @@ jobs:
           sign-commits: true
           labels: |
             kind/skip-release-notes
-            chore
+            kind/chore
           body: |
             Update OCM CLI vendor hash (see: .github/workflows/flake_vendorhash.yaml)

.github/workflows/integration-test.yaml

@@ -16,6 +16,7 @@ permissions:
 
 jobs:
   test:
+    if: github.event_name == 'push'
     name: Run tests
     uses: open-component-model/ocm-integrationtest/.github/workflows/integrationtest.yaml@main
     permissions:
@@ -24,4 +25,17 @@ jobs:
       packages: write
     secrets: inherit
     with:
-      ref: ${{ github.ref }}
+      ref: ${{ github.ref }}
+      repo: ${{ github.repository }}
+  test-pr:
+    if: github.event_name == 'pull_request_target'
+    name: Run tests
+    uses: open-component-model/ocm-integrationtest/.github/workflows/integrationtest.yaml@main
+    permissions:
+      contents: write
+      id-token: write
+      packages: write
+    secrets: inherit
+    with:
+      ref: ${{ github.event.pull_request.head.ref }}
+      repo: ${{ github.event.pull_request.head.repo.full_name }}

.github/workflows/publish-latest.yaml

@@ -60,8 +60,8 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          # supported platforms of https://hub.docker.com/_/golang/tags?page=1&name=1.23-alpine3.20
-          # platforms: linux/386,linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le,linux/s390x
+          # supported platforms: https://github.com/GoogleContainerTools/distroless?tab=readme-ov-file#what-images-are-available
+          platforms: linux/amd64,linux/arm64 #linux/arm,linux/ppc64le,linux/s390x
           push: true
           tags: |
             ghcr.io/open-component-model/ocm:latest
@@ -166,4 +166,4 @@ jobs:
         key: ${{ env.cache_name }}-${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-${{ hashFiles('**/go.mod') }}
         upload-chunk-size: 256000000 # default of 32MB is not really optimal for our large cache, choose 256MB instead
       env:
-        cache_name: ocm-cli-latest-go-cache # needs to be the same key in the end as in the build step
+        cache_name: ocm-cli-latest-go-cache # needs to be the same key in the end as in the build step

.github/workflows/publish-to-other-than-github.yaml

@@ -55,7 +55,7 @@ jobs:
             --outputDirectory ${{ github.workspace }}/tap/Formula)
         mkdir -p ${{ github.workspace }}/tap/Aliases
         cd ${{ github.workspace }}/tap/Aliases
-        ln -s ../Formula/$(basename $formula) ./ocm
+        ln -sf ../Formula/$(basename $formula) ./ocm
     - name: Create Pull Request
       uses: peter-evans/create-pull-request@v7
       with:
@@ -147,6 +147,12 @@ jobs:
     steps:
     - name: Ensure proper version
       run: echo "RELEASE_VERSION=$(echo ${{ github.event.client_payload.version }})" >> $GITHUB_ENV
+    - name: Generate token
+      id: generate_token
+      uses: tibdex/github-app-token@v2
+      with:
+        app_id: ${{ secrets.OCMBOT_APP_ID }}
+        private_key: ${{ secrets.OCMBOT_PRIV_KEY }}
     - name: Publish Release Event
       uses: peter-evans/repository-dispatch@v3
       with:

.github/workflows/pull-request.yaml

@@ -24,18 +24,18 @@ jobs:
         env:
           TYPE_TO_LABEL: |
             {
-              "feat":"kind/enhancement",
-              "fix":"fix",
-              "chore":"chore",
-              "docs":"kind/documentation",
-              "test":"kind/test",
-              "perf":"kind/performance"
+              "feat":"kind/feature",
+              "fix":"kind/bugfix",
+              "chore":"kind/chore",
+              "docs":"area/documentation",
+              "test":"area/testing",
+              "perf":"area/performance"
             }
           SCOPE_TO_LABEL: |
             {
-              "deps":"dependencies"
+              "deps":"kind/dependency"
             }
-          BREAKING_CHANGE_LABEL: "breaking"
+          BREAKING_CHANGE_LABEL: "!BREAKING-CHANGE!"
         with:
           script: |
             console.log("Verify that the PR title follows the Conventional Commit format");
@@ -158,5 +158,5 @@ jobs:
       - name: PRs should have at least one qualifying label
         uses: docker://agilepathway/pull-request-label-checker:latest
         with:
-          one_of: chore,fix,bugfix,bug,kind/bug,feature,enhancement,kind/enhancement,dependencies
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          any_of: kind/chore,kind/bugfix,kind/feature,kind/dependency,kind/refactor
+          repo_token: ${{ secrets.GITHUB_TOKEN }}