Merge pull request 'chore(deps): update docker/login-action action to v4.7.0' (#217) from renovate/docker-login-action-4.x into master

This reverts commit 2cfe8ddb2c.

.gitea/scripts/add-annotations.sh

@@ -1,133 +0,0 @@
-#!/bin/bash
-
-# ============================================================================
-# Generate ArtifactHub changelog annotations from git commit history
-# ============================================================================
-
-set -euo pipefail
-
-readonly CHART_FILE="Chart.yaml"
-readonly RC_PATTERN="\-rc([-\.][0-9]+)?$"
-
-CHANGE_LOG_YAML=""
-
-cleanup() {
-  if [[ -n "${CHANGE_LOG_YAML:-}" && -f "${CHANGE_LOG_YAML}" ]]; then
-    rm -f "${CHANGE_LOG_YAML}"
-  fi
-}
-trap cleanup EXIT
-
-if [[ ! -f "${CHART_FILE}" ]]; then
-  echo "ERROR: ${CHART_FILE} not found!" >&2
-  exit 1
-fi
-
-# Exclude prerelease tags (matching -rc or -rc.<digits>) from default tag selection
-DEFAULT_NEW_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${RC_PATTERN}" | head --lines 1)"
-DEFAULT_OLD_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${RC_PATTERN}" | head --lines 2 | tail --lines 1)"
-
-if [[ -z "${1:-}" ]]; then
-  read -rp "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
-  if [[ -z "${OLD_TAG}" ]]; then
-    OLD_TAG="${DEFAULT_OLD_TAG}"
-  fi
-
-  while [[ -z "$(git tag --list "${OLD_TAG}")" ]]; do
-    echo "ERROR: Tag '${OLD_TAG}' not found!" >&2
-    read -rp "Enter start tag [${DEFAULT_OLD_TAG}]: " OLD_TAG
-    if [[ -z "${OLD_TAG}" ]]; then
-      OLD_TAG="${DEFAULT_OLD_TAG}"
-    fi
-  done
-else
-  OLD_TAG="${1}"
-  if [[ -z "$(git tag --list "${OLD_TAG}")" ]]; then
-    echo "ERROR: Tag '${OLD_TAG}' not found!" >&2
-    exit 1
-  fi
-fi
-
-if [[ -z "${2:-}" ]]; then
-  read -rp "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
-  if [[ -z "${NEW_TAG}" ]]; then
-    NEW_TAG="${DEFAULT_NEW_TAG}"
-  fi
-
-  while [[ -z "$(git tag --list "${NEW_TAG}")" ]]; do
-    echo "ERROR: Tag '${NEW_TAG}' not found!" >&2
-    read -rp "Enter end tag [${DEFAULT_NEW_TAG}]: " NEW_TAG
-    if [[ -z "${NEW_TAG}" ]]; then
-      NEW_TAG="${DEFAULT_NEW_TAG}"
-    fi
-  done
-else
-  NEW_TAG="${2}"
-
-  if [[ -z "$(git tag --list "${NEW_TAG}")" ]]; then
-    echo "ERROR: Tag '${NEW_TAG}' not found!" >&2
-    exit 1
-  fi
-fi
-
-if [[ "${NEW_TAG}" =~ ${RC_PATTERN} ]]; then
-  echo "INFO: Tag '${NEW_TAG}' is a prerelease, setting prerelease annotation and skipping changelog."
-  yq --no-colors --inplace ".annotations.\"artifacthub.io/prerelease\" = \"true\" | sort_keys(.)" "${CHART_FILE}"
-  exit 0
-fi
-
-CHANGE_LOG_YAML="$(mktemp)"
-echo "[]" > "${CHANGE_LOG_YAML}"
-
-map_type_to_kind() {
-  case "${1}" in
-    feat)
-      echo "added"
-      ;;
-    fix)
-      echo "fixed"
-      ;;
-    chore|style|test|ci|docs|refac)
-      echo "changed"
-      ;;
-    revert)
-      echo "removed"
-      ;;
-    sec)
-      echo "security"
-      ;;
-    *)
-      echo "skip"
-      ;;
-  esac
-}
-
-COMMIT_TITLES="$(git log --pretty=format:"%s" "${OLD_TAG}..${NEW_TAG}")"
-
-echo "INFO: Generate change log entries from ${OLD_TAG} until ${NEW_TAG}"
-
-while IFS= read -r line; do
-  if [[ "${line}" =~ ^([a-zA-Z]+)(\([^\)]+\))?\:\ (.+)$ ]]; then
-    TYPE="${BASH_REMATCH[1]}"
-    KIND="$(map_type_to_kind "${TYPE}")"
-
-    if [[ "${KIND}" == "skip" ]]; then
-      continue
-    fi
-
-    DESC="${BASH_REMATCH[3]}"
-
-    echo "- ${KIND}: ${DESC}"
-
-    jq --arg kind "${KIND}" --arg description "${DESC}" '. += [ $ARGS.named ]' < "${CHANGE_LOG_YAML}" > "${CHANGE_LOG_YAML}.new"
-    mv "${CHANGE_LOG_YAML}.new" "${CHANGE_LOG_YAML}"
-  fi
-done <<< "${COMMIT_TITLES}"
-
-if [[ -s "${CHANGE_LOG_YAML}" ]]; then
-  yq --inplace --input-format json --output-format yml "${CHANGE_LOG_YAML}"
-  yq --no-colors --inplace ".annotations.\"artifacthub.io/changes\" |= loadstr(\"${CHANGE_LOG_YAML}\") | sort_keys(.)" "${CHART_FILE}"
-else
-  echo "ERROR: Changelog file is empty: ${CHANGE_LOG_YAML}" >&2
-  exit 1
-fi

.gitea/workflows/artifacthub-metadata.yaml

@@ -10,15 +10,15 @@ jobs:
     name: "Upload artifacthub-repo.yml to OCI registry"
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-    - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
       with:
         registry: ${{ github.server_url }}
         username: ${{ github.repository_owner }}
         password: ${{ secrets.GIT_CRYPTIC_SYSTEMS_PACKAGE_REGISTRY_TOKEN }}
-    - uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+    - uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
       with:
-        version: 1.3.3 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
+        version: 1.3.5 # renovate: datasource=github-tags depName=oras-project/oras extractVersion='^v?(?<version>.*)$'
     - name: Extract meta information
       run: |
         echo "GITEA_SERVER_HOSTNAME=$(echo "${GITHUB_SERVER_URL}" | cut -d '/' -f 3)" >> $GITHUB_ENV

.gitea/workflows/generate-readme.yaml

@@ -15,14 +15,14 @@ on:
 jobs:
   generate-parameters:
     container:
-      image: docker.io/library/node:26.7.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
       run: |
         apk update
         apk add git npm
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Generate parameter section in README
       run: |
         npm install

.gitea/workflows/helm.yaml

@@ -14,10 +14,10 @@ jobs:
   helm-lint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v4.2.4 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.3.1 # renovate: datasource=github-releases depName=helm/helm
     - name: Lint helm files
       run: |
         helm lint --values values.yaml .
@@ -25,10 +25,10 @@ jobs:
   helm-unittest:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
-        version: v4.2.4 # renovate: datasource=github-releases depName=helm/helm
+        version: v4.3.1 # renovate: datasource=github-releases depName=helm/helm
     - env:
         HELM_UNITTEST_VERSION: v1.0.0 #renovate: datasource=github-releases depName=helm-unittest/helm-unittest
       name: Install helm-unittest

.gitea/workflows/markdown-linters.yaml

@@ -15,14 +15,14 @@ on:
 jobs:
   markdown-link-checker:
     container:
-      image: docker.io/library/node:26.7.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
       run: |
         apk update
         apk add git npm
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Verify links in markdown files
       run: |
         npm install
@@ -30,14 +30,14 @@ jobs:
 
   markdown-lint:
     container:
-      image: docker.io/library/node:26.7.0-alpine
+      image: docker.io/library/node:26.12.1-alpine
     runs-on: ubuntu-latest
     steps:
     - name: Install tooling
       run: |
         apk update
         apk add git
-    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Lint markdown files
       run: |
         npm install

.gitea/workflows/release.yaml

@@ -16,17 +16,17 @@ jobs:
     steps:
       - uses: volker-raschek/cosign-installer@7643eed6736a199595ed2a31e9979ec353a88adb # v4.1.3-rc3
         with:
-          cosign-release: "v3.1.3" # renovate: datasource=github-tags depName=sigstore/cosign
+          cosign-release: "v3.1.4" # renovate: datasource=github-tags depName=sigstore/cosign
 
       - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          version: "v4.2.4" # renovate: datasource=github-tags depName=helm/helm
+          version: "v4.3.1" # renovate: datasource=github-tags depName=helm/helm
 
       - name: Install helm plugins
         env:
           HELM_SIGSTORE_VERSION: "0.3.0" # renovate: datasource=github-tags depName=sigstore/helm-sigstore extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
-          HELM_SCHEMA_VALUES_VERSION: "2.5.0" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
-          HELM_UNITTEST_VERSION: "1.1.2" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+          HELM_SCHEMA_VALUES_VERSION: "2.6.0" # renovate: datasource=github-tags depName=losisin/helm-values-schema-json extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
+          HELM_UNITTEST_VERSION: "1.2.1" # renovate: datasource=github-tags depName=helm-unittest/helm-unittest extractVersion='^v(?<version>\d+\.\d+\.\d+)$'
         run: |
           helm plugin install --verify=false https://github.com/sigstore/helm-sigstore.git --version "${HELM_SIGSTORE_VERSION}" 1> /dev/null
           helm plugin install --verify=false https://github.com/losisin/helm-values-schema-json.git --version "${HELM_SCHEMA_VALUES_VERSION}" 1> /dev/null
@@ -65,16 +65,11 @@ jobs:
           gpg --batch --yes --export "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/pubring.gpg"
           gpg --batch --yes --passphrase-fd 0 --export-secret-keys "${GPG_PRIVATE_KEY_FINGERPRINT}" 1> "${HOME}/.gnupg/secring.gpg" <<< "${GPG_PRIVATE_KEY_PASSPHRASE}"
 
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - name: Add Artifacthub.io annotations
-        run: |
-          rc_pattern="\-rc([-\.][0-9]+)?$"
-          NEW_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${rc_pattern}" | head --lines 1)"
-          OLD_TAG="$(git tag --sort=-version:refname | grep --invert-match --perl-regexp "${rc_pattern}" | head --lines 2 | tail --lines 1)"
-          .gitea/scripts/add-annotations.sh "${OLD_TAG}" "${NEW_TAG}"
+      - uses: volker-raschek/ah-annotations@5b4361f7865c1e71a9ce2263df1c780871e0fee8 # v0.2.4
 
       - name: Extract meta information
         run: |
@@ -96,7 +91,7 @@ jobs:
             --passphrase-file "${GPG_PRIVATE_KEY_PASSPHRASE_FILE}" \
             --version "${PACKAGE_VERSION}" ./
 
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ github.server_url }}
           username: ${{ github.repository_owner }}
@@ -122,21 +117,15 @@ jobs:
             --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz" \
               https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/charts
 
-          # NOTE:
-          # Gitea does currently not support uploading Helm chart provenance files, so we skip this step for now. Once
-          # Gitea supports this, we can simply uncomment the following lines to upload the provenance file as well.
-          #
-          #   https://github.com/helm/helm/issues/31866
-          #
-          # if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then
-          #   curl \
-          #     --fail \
-          #     --show-error \
-          #     --request POST \
-          #     --user "${CHARTMUSEUM_USERNAME}:${CHARTMUSEUM_PASSWORD}" \
-          #     --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" \
-          #       https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/prov
-          # fi
+          if [ -f "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" ]; then
+            curl \
+              --fail \
+              --show-error \
+              --request POST \
+              --user "${REPOSITORY_OWNER}:${GITEA_REGISTRY_TOKEN}" \
+              --upload-file "${REPOSITORY_NAME}-${PACKAGE_VERSION}.tgz.prov" \
+                https://${GITEA_SERVER_HOSTNAME}/api/packages/${REPOSITORY_OWNER}/helm/api/prov
+          fi
 
       - name: Upload Chart to Chartmuseum (Helm)
         env:

.vscode/settings.json

@@ -1,8 +1,11 @@
 {
+  "files.associations": {
+    ".gitea/workflows/*.yaml": "github-actions-workflow"
+  },
   "yaml.schemas": {
-    "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.1.2/schema/helm-testsuite.json": [
+    "https://raw.githubusercontent.com/helm-unittest/helm-unittest/v1.2.1/schema/helm-testsuite.json": [
       "/unittests/**/*.yaml"
     ]
   },
   "yaml.schemaStore.enable": true
-}
+}

Chart.yaml

@@ -1,3 +1,4 @@
+---
 annotations:
   artifacthub.io/license: MIT
   artifacthub.io/links: |
@@ -5,26 +6,24 @@ annotations:
       url: https://github.com/gomods/athens
     - name: support
       url: https://git.cryptic.systems/volker.raschek/athens-proxy-charts/issues
-  artifacthub.io/operator: "false"
-  artifacthub.io/prerelease: "false"
+  artifacthub.io/operator: 'false'
+  artifacthub.io/prerelease: 'false'
   artifacthub.io/signKey: |
     fingerprint: 3B0CE9853CAD76076260025383D342258456906E
     url: https://keys.openpgp.org/vks/v1/by-fingerprint/3B0CE9853CAD76076260025383D342258456906E
 apiVersion: v2
-name: athens-proxy
+appVersion: v0.20.0
 description: Athens proxy server for golang
-type: application
-version: "0.1.0"
-appVersion: "v0.17.1"
 icon: https://github.com/gomods/athens/blob/main/docs/static/banner.png?raw=true
-
 keywords:
-- golang
-- athens
-- gomod
-- go-proxy
-
+  - golang
+  - athens
+  - gomod
+  - go-proxy
+name: athens-proxy
 sources:
-- https://git.cryptic.systems/volker.raschek/athens-proxy-charts
-- https://github.com/gomods/athens
-- https://hub.docker.com/r/gomods/athens
+  - https://git.cryptic.systems/volker.raschek/athens-proxy-charts
+  - https://github.com/gomods/athens
+  - https://hub.docker.com/r/gomods/athens
+type: application
+version: 0.1.0

README.md

@@ -37,7 +37,7 @@ version of the chart must be in sync with the `values.yaml`. Newer *minor* versi
 versions can break something!
 
 ```bash
-CHART_VERSION=v2.0.3
+CHART_VERSION=2.1.0
 helm show values volker.raschek/athens-proxy --version "${CHART_VERSION}" > values.yaml
 ```
 
@@ -51,7 +51,7 @@ The helm chart also contains a persistent volume claim definition. It persistent
 Use the `--set` argument to persist your data.
 
 ```bash
-CHART_VERSION=v2.0.3
+CHART_VERSION=2.1.0
 helm install --version "${CHART_VERSION}" athens-proxy volker.raschek/athens-proxy \
   persistence.enabled=true
 ```
@@ -81,7 +81,7 @@ Further information about this topic can be found in one of Kanishk's blog
 > Please take care the a CPU limit < `1000m` can also lead to CPU throttling. Please read the linked documentation carefully.
 
 ```bash
-CHART_VERSION=v2.0.3
+CHART_VERSION=2.1.0
 helm install --version "${CHART_VERSION}" athens-proxy volker.raschek/athens-proxy \
   --set 'deployment.athensProxy.env.name=GOMAXPROCS' \
   --set 'deployment.athensProxy.env.valueFrom.resourceFieldRef.resource=limits.cpu' \
@@ -105,7 +105,7 @@ describes configuring [Ingress NGINX](#ingress-nginx) as well as [NGINX Gateway
 > `athens-proxy-ca` is present in the same namespace of the helm deployment.
 
 ```bash
-CHART_VERSION=v2.0.3
+CHART_VERSION=2.1.0
 helm install --version "${CHART_VERSION}" athens-proxy volker.raschek/athens-proxy \
   --set 'config.certificate.enabled=true' \
   --set 'config.certificate.new.issuerRef.kind=Issuer' \

renovate.json

@@ -15,7 +15,7 @@
         "^Chart\\.yaml$"
       ],
       "matchStrings": [
-        "^appVersion: \"?(?<currentValue>.*)\"?"
+        "appVersion: \"?(?<currentValue>[^\"\\s]+)\"?\\s*"
       ],
       "datasourceTemplate": "docker",
       "depNameTemplate": "gomods/athens",
@@ -24,9 +24,7 @@
     },
     {
       "customType": "regex",
-      "fileMatch": [
-        "^README\\.md$"
-      ],
+      "fileMatch": ["^README\\.md$"],
       "matchStrings": [
         "CHART_VERSION=(?<currentValue>.*)"
       ],

templates/deployment.yaml

@@ -105,6 +105,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.deployment.initContainers }}
+      initContainers:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- with .Values.deployment.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

unittests/deployments/deployment.yaml

@@ -129,6 +129,9 @@ tests:
   - notExists:
       path: spec.template.spec.imagePullSecrets
     template: templates/deployment.yaml
+  - notExists:
+      path: spec.template.spec.initContainers
+    template: templates/deployment.yaml
   - notExists:
       path: spec.template.spec.nodeSelector
     template: templates/deployment.yaml
@@ -463,6 +466,22 @@ tests:
       - name: my-special-secret
     template: templates/deployment.yaml
 
+- it: Test initContainers
+  set:
+    # Ensure that the secrets and config maps are well configured.
+
+    # Normal test values
+    deployment.initContainers:
+    - name: busybox
+      image: docker.io/library/busybox:latest
+  asserts:
+  - contains:
+      path: spec.template.spec.initContainers
+      content:
+        name: busybox
+        image: docker.io/library/busybox:latest
+    template: templates/deployment.yaml
+
 - it: Test nodeSelector
   set:
     # Ensure that the secrets and config maps are well configured.