PR for next LTS release (0.68.7)

.github/actions/publish-reports/action.yml

@@ -0,0 +1,11 @@
+name: Publish Reports
+description: Publish JUnit test report
+
+runs:
+  using: composite
+  steps:
+    - name: Publish Test Report
+      if: success() || failure()
+      uses: mikepenz/action-junit-report@3a81627bfac62268172037048872e8ebd4207e6d  # v6.4.1
+      with:
+        report_paths: 'report.xml'

.github/actions/save-go-cache/action.yml

@@ -0,0 +1,19 @@
+name: Save Go Cache
+description: Trim old entries and persist Go module and build cache
+
+runs:
+  using: composite
+  steps:
+    - name: Trim Go cache
+      shell: bash
+      run: find ~/.cache/go-build -type f -mmin +90 -delete
+    - name: Set Go cache date
+      shell: bash
+      run: echo "GO_CACHE_DATE=$(date +%Y-%m-%d)" >> $GITHUB_ENV
+    - name: Save Go cache
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+      with:
+        path: |
+          ~/go/pkg/mod
+          ~/.cache/go-build
+        key: "release-0.68-${{ runner.os }}-go-${{ hashFiles('go.mod') }}-${{ env.GO_CACHE_DATE }}"

.github/actions/setup-build-env/action.yml

@@ -0,0 +1,80 @@
+name: Setup Build Environment
+description: Checkout code, setup Go with caching, apt packages, and Docker image caching
+
+outputs:
+  image-tag:
+    description: Short SHA image tag (first 7 chars of GITHUB_SHA)
+    value: ${{ steps.vars.outputs.IMAGE_TAG }}
+
+runs:
+  using: composite
+  steps:
+    - name: Free space
+      shell: bash
+      run: |
+        formatByteCount() { echo $(numfmt --to=iec-i --suffix=B --padding=7 $1'000'); }
+        getAvailableSpace() { echo $(df -a $1 | awk 'NR > 1 {avail+=$4} END {print avail}'); }
+        BEFORE=$(getAvailableSpace)
+        sudo rm -rf /usr/local/lib/android &
+        sudo rm -rf /usr/share/dotnet &
+        sudo rm -rf /opt/ghc &
+        sudo rm -rf /usr/local/.ghcup &
+        wait
+        AFTER=$(getAvailableSpace)
+        SAVED=$((AFTER-BEFORE))
+        echo "Saved $(formatByteCount $SAVED)"
+    - name: Prepare binary cache
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+      with:
+        path: ./bin
+        key: binary
+    - name: Setup Go
+      id: go
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+      with:
+        go-version-file: "go.mod"
+        check-latest: true
+        cache: false
+    - name: Restore Go cache
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+      with:
+        path: |
+          ~/go/pkg/mod
+          ~/.cache/go-build
+        key: nonexistent
+        restore-keys: |
+          release-0.68-${{ runner.os }}-go-${{ hashFiles('go.mod') }}-
+    - name: Download Go modules
+      shell: bash
+      run: go mod download
+    - name: Cache apt packages
+      uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05  # v1.6.0
+      with:
+        packages: libgpgme-dev
+        version: "1.0"
+    - name: Get Golang Docker image version
+      id: golang-version
+      shell: bash
+      run: |
+        echo "version=$(grep '^FROM golang:' Dockerfile | cut -d: -f2 | cut -d' ' -f1)" >> $GITHUB_OUTPUT
+    - name: Cache Golang Docker image
+      id: golang-docker-cache
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
+      with:
+        path: /tmp/golang-docker.tar
+        key: golang-docker-${{ steps.golang-version.outputs.version }}
+    - name: Load Golang Docker image from cache
+      if: steps.golang-docker-cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: docker load -i /tmp/golang-docker.tar
+    - name: Pull and cache Golang Docker image
+      if: steps.golang-docker-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        docker pull golang:${{ steps.golang-version.outputs.version }}
+        docker save golang:${{ steps.golang-version.outputs.version }} -o /tmp/golang-docker.tar
+    - name: Set output variables
+      id: vars
+      shell: bash
+      run: |
+        echo "IMAGE_TAG=${GITHUB_SHA:0:7}" >> $GITHUB_OUTPUT

.github/workflows/main.yaml

@@ -3,16 +3,7 @@ name: Build and Test
 on:
   push:
     branches:
-      - master
-    paths:
-      - '**'
-      - '!docs/**'
-      - '!*.md'
-      - '!.github/**'
-      - '.github/workflows/docs.yaml'
-      - '!codespell/**'
-      - 'LICENSE'
-      - 'PROJECT'
+      - release-*
   pull_request:
     branches:
       - master
@@ -23,18 +14,12 @@ on:
       - synchronize
       - ready_for_review
       - converted_to_draft
-    paths:
-      - '**'
-      - '!docs/**'
-      - '!*.md'
-      - '!.github/**'
-      - '.github/workflows/docs.yaml'
-      - '!codespell/**'
-      - 'LICENSE'
-      - 'PROJECT'
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
+
+permissions: {}
+
 jobs:
   build:
     name: Build and Test
@@ -44,91 +29,94 @@ jobs:
       contents: read
       security-events: write
       checks: write
+    outputs:
+      run_e2e: ${{ steps.changes.outputs.src }}
     steps:
-      - name: Free space
-        run: |
-          # cleanup up space to free additional ~20GiB of memory
-          # which are lacking for multiplaform images build
-          formatByteCount() { echo $(numfmt --to=iec-i --suffix=B --padding=7 $1'000'); }
-          getAvailableSpace() { echo $(df -a $1 | awk 'NR > 1 {avail+=$4} END {print avail}'); }
-          BEFORE=$(getAvailableSpace)
-          sudo rm -rf /usr/local/lib/android || true
-          sudo rm -rf /usr/share/dotnet || true
-          sudo rm -rf /opt/ghc || true
-          sudo rm -rf /usr/local/.ghcup || true
-          AFTER=$(getAvailableSpace)
-          SAVED=$((AFTER-BEFORE))
-          echo "Saved $(formatByteCount $SAVED)"
       - name: Checkout code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
-      - name: Prepare binary cache
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
-        with:
-          path: ./bin
-          key: binary
-      - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417  # v6.3.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
-          go-version-file: "go.mod"
-          check-latest: true
-          cache: true
-        id: go
+          persist-credentials: false
+
+      - name: Setup build environment
+        id: setup
+        uses: ./.github/actions/setup-build-env
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25  # v0.36.0
         with:
           scan-type: "fs"
           ignore-unfixed: true
           format: "sarif"
           output: "trivy-results.sarif"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745  # v4.34.0
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
         with:
           sarif_file: "trivy-results.sarif"
 
-      - name: Set output variables
-        id: vars
-        run: |
-          IMAGE_TAG=${GITHUB_SHA:0:7}
-          echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_OUTPUT
-      - name: Install mirrord
-        run: |
-          curl -o ./mirrord_linux_x86_64.zip -fsSL https://github.com/metalbear-co/mirrord/releases/download/3.188.1/mirrord_linux_x86_64.zip
-          curl -o ./mirrord_linux_x86_64.shasum256 -fsSL https://github.com/metalbear-co/mirrord/releases/download/3.188.1/mirrord_linux_x86_64.shasum256
-          sha256sum -c mirrord_linux_x86_64.shasum256
-          unzip mirrord_linux_x86_64.zip
-          sudo mv ./mirrord /usr/bin/mirrord
-          sudo chmod +x /usr/bin/mirrord
       - name: Lint, Test and Build
         if: github.event.pull_request.draft == false
-        env:
-          DOCKER_BUILD_ARGS: --cache-from=type=gha --cache-to=type=gha,mode=max
-          TAG: ${{ steps.vars.outputs.IMAGE_TAG }}
-          LICENSE_KEY: ${{ secrets.ENTERPRISE_COMPONENTS_LICENSE_KEY }}
         run: |
-          sudo apt update
-          sudo apt install -y libgpgme-dev
           make lint
           make manifests
           make api-gen
           make docs
           # check for uncommited changes to crds, docs or API
           git diff --exit-code
           make test
-          git fetch origin ${{ github.base_ref || 'master' }}
-          BASE_REF=origin/${{ github.base_ref || 'master' }} TAG=${TAG} make test-e2e
-      - name: Publish Test Report
-        uses: mikepenz/action-junit-report@49b2ca06f62aa7ef83ae6769a2179271e160d8e4  # v6.3.1
-        if: success() || failure()
-        with:
-          report_paths: 'report.xml'
-      - name: Generate Allure Report
-        if: github.event.pull_request.draft == false && failure()
-        run: make allure-report
-      - name: Archive Allure report
-        if: github.event.pull_request.draft == false && failure()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
+
+      - name: Save Go cache
+        if: ${{ github.ref == 'refs/heads/release-0.68' }}
+        uses: ./.github/actions/save-go-cache
+
+      - name: Check changed files
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d  # v4.0.1
+        id: changes
         with:
-          name: allure-report
-          path: ./allure-report
+          filters: |
+            src:
+              - '**'
+              - '!Makefile'
+              - '!docs/**'
+              - '!*.md'
+              - '!.github/**'
+              - '.github/workflows/main.yaml'
+              - '!codespell/**'
+              - 'LICENSE'
+              - 'PROJECT'
+
+  e2e:
+    name: E2E / ${{ matrix.name }}
+    needs: build
+    if: github.event.pull_request.draft == false && needs.build.outputs.run_e2e == 'true'
+    runs-on: vm-runner
+    permissions:
+      actions: read
+      contents: read
+      checks: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: main
+            e2e_target: ./test/e2e/
+          - name: upgrade
+            e2e_target: ./test/e2e/upgrade/...
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - name: Setup build environment
+        id: setup
+        uses: ./.github/actions/setup-build-env
+      - name: E2E Tests
+        env:
+          DOCKER_BUILD_ARGS: --cache-from=type=gha --cache-to=type=gha,mode=max
+          LICENSE_KEY: ${{ secrets.ENTERPRISE_COMPONENTS_LICENSE_KEY }}
+          E2E_TARGET: ${{ matrix.e2e_target }}
+        run: |
+          TAG=${GITHUB_SHA:0:7} BASE_REF=origin/${{ github.base_ref || 'release-0.68' }} make test-e2e
+      - name: Save Go cache
+        if: ${{ github.ref == 'refs/heads/release-0.68' }}
+        uses: ./.github/actions/save-go-cache
+      - name: Publish reports
+        uses: ./.github/actions/publish-reports