diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 9a130b67b..db3eddb7b 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -20,6 +20,14 @@ on: branches: - main - release-* + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: {} diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index ed2f9e35e..46b0f3081 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -17,7 +17,15 @@ name: CodeQL on: push: - branches: [ main ] + branches: [ main, release-* ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' schedule: - cron: '45 10 * * 1' diff --git a/.github/workflows/depsreview.yml b/.github/workflows/depsreview.yml index bc0fa0381..57bf58e6c 100644 --- a/.github/workflows/depsreview.yml +++ b/.github/workflows/depsreview.yml @@ -13,7 +13,17 @@ # See the License for the specific language governing permissions and # limitations under the License. name: 'Dependency Review' -on: [pull_request] +on: + pull_request: + branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: contents: read diff --git a/.github/workflows/donotsubmit.yaml b/.github/workflows/donotsubmit.yaml index 51bae13d8..4b0c7e34f 100644 --- a/.github/workflows/donotsubmit.yaml +++ b/.github/workflows/donotsubmit.yaml @@ -3,6 +3,14 @@ name: Do Not Submit on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: read-all diff --git a/.github/workflows/kind-cluster-image-policy-no-tuf.yaml b/.github/workflows/kind-cluster-image-policy-no-tuf.yaml index bb72e566a..63f8edf21 100644 --- a/.github/workflows/kind-cluster-image-policy-no-tuf.yaml +++ b/.github/workflows/kind-cluster-image-policy-no-tuf.yaml @@ -17,6 +17,14 @@ name: Test policy-controller with ClusterImagePolicy TUF disabled on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' defaults: run: diff --git a/.github/workflows/kind-cluster-image-policy-trustroot.yaml b/.github/workflows/kind-cluster-image-policy-trustroot.yaml index ec949e797..14a229daf 100644 --- a/.github/workflows/kind-cluster-image-policy-trustroot.yaml +++ b/.github/workflows/kind-cluster-image-policy-trustroot.yaml @@ -17,6 +17,14 @@ name: Test policy-controller with TrustRoot - Bring your own keys on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' defaults: run: diff --git a/.github/workflows/kind-cluster-image-policy-tsa.yaml b/.github/workflows/kind-cluster-image-policy-tsa.yaml index d8fd9a6cd..02bdec3dd 100644 --- a/.github/workflows/kind-cluster-image-policy-tsa.yaml +++ b/.github/workflows/kind-cluster-image-policy-tsa.yaml @@ -17,6 +17,14 @@ name: Test policy-controller with TSA on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' defaults: run: diff --git a/.github/workflows/kind-cluster-image-policy.yaml b/.github/workflows/kind-cluster-image-policy.yaml index 563d4bec8..f3084a827 100644 --- a/.github/workflows/kind-cluster-image-policy.yaml +++ b/.github/workflows/kind-cluster-image-policy.yaml @@ -17,6 +17,14 @@ name: Test policy-controller with ClusterImagePolicy on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' defaults: run: diff --git a/.github/workflows/kind-e2e-cosigned.yaml b/.github/workflows/kind-e2e-cosigned.yaml index f1c3186f9..5e592c651 100644 --- a/.github/workflows/kind-e2e-cosigned.yaml +++ b/.github/workflows/kind-e2e-cosigned.yaml @@ -18,6 +18,15 @@ on: pull_request: branches: - 'main' + - 'release-*' + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: {} diff --git a/.github/workflows/kind-e2e-trustroot-crd.yaml b/.github/workflows/kind-e2e-trustroot-crd.yaml index e8bc39f5e..ec26ff9cf 100644 --- a/.github/workflows/kind-e2e-trustroot-crd.yaml +++ b/.github/workflows/kind-e2e-trustroot-crd.yaml @@ -18,6 +18,15 @@ on: pull_request: branches: - 'main' + - 'release-*' + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: {} diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 1f20b2e67..0bcf330f4 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -3,7 +3,25 @@ on: push: branches: - main + - release-* + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' pull_request: + branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: {} diff --git a/.github/workflows/policy-tester-examples.yml b/.github/workflows/policy-tester-examples.yml index 0ea890f78..6e311b7c0 100644 --- a/.github/workflows/policy-tester-examples.yml +++ b/.github/workflows/policy-tester-examples.yml @@ -19,7 +19,24 @@ on: workflow_dispatch: push: branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' pull_request: + branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' jobs: verify: diff --git a/.github/workflows/release-snapshot.yaml b/.github/workflows/release-snapshot.yaml index 079f354d0..228970116 100644 --- a/.github/workflows/release-snapshot.yaml +++ b/.github/workflows/release-snapshot.yaml @@ -2,6 +2,15 @@ name: snapshot on: pull_request: + branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: contents: read diff --git a/.github/workflows/scorecard_action.yml b/.github/workflows/scorecard_action.yml index e1e0b32f9..18f5ffbcf 100644 --- a/.github/workflows/scorecard_action.yml +++ b/.github/workflows/scorecard_action.yml @@ -6,7 +6,15 @@ on: # Weekly on Saturdays. - cron: '30 1 * * 6' push: - branches: [ main ] + branches: [ main, release-* ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' # Declare default permissions as read only. permissions: read-all diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml index aeeb87ac4..51b909721 100644 --- a/.github/workflows/style.yaml +++ b/.github/workflows/style.yaml @@ -3,6 +3,14 @@ name: Code Style on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: read-all diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml index 1ff9b3e43..d065e9204 100644 --- a/.github/workflows/tests.yaml +++ b/.github/workflows/tests.yaml @@ -18,7 +18,24 @@ on: workflow_dispatch: push: branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' pull_request: + branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: read-all diff --git a/.github/workflows/verify-codegen.yaml b/.github/workflows/verify-codegen.yaml index b87540330..55a23c3b0 100644 --- a/.github/workflows/verify-codegen.yaml +++ b/.github/workflows/verify-codegen.yaml @@ -19,7 +19,24 @@ on: workflow_dispatch: push: branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' pull_request: + branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: read-all diff --git a/.github/workflows/verify-docs.yaml b/.github/workflows/verify-docs.yaml index f9ddeec1c..019e2409d 100644 --- a/.github/workflows/verify-docs.yaml +++ b/.github/workflows/verify-docs.yaml @@ -19,7 +19,22 @@ on: workflow_dispatch: push: branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'LICENSE' + - '*.md' pull_request: + branches: ['main', 'release-*'] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'LICENSE' + - '*.md' permissions: read-all diff --git a/.github/workflows/whitespace.yaml b/.github/workflows/whitespace.yaml index 12106eb53..d6ae8054c 100644 --- a/.github/workflows/whitespace.yaml +++ b/.github/workflows/whitespace.yaml @@ -3,6 +3,14 @@ name: Whitespace on: pull_request: branches: [ 'main', 'release-*' ] + paths-ignore: + - 'Dockerfile.rh' + - 'Dockerfile.coverage' + - 'renovate.json' + - '.tekton/**' + - 'docs/**' + - 'LICENSE' + - '**/*.md' permissions: read-all diff --git a/renovate.json b/renovate.json index 31bcce1d6..f9bbd08a9 100644 --- a/renovate.json +++ b/renovate.json @@ -1,85 +1,111 @@ { "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>securesign/renovate-config//org-inherited-config.json" + ], + "enabledManagers": ["dockerfile", "gomod", "tekton", "custom.regex"], "constraintsFiltering": "strict", - "gomod": { - "packageRules": [ - { - "description": "Do not bump the go directive - must stay at current version to prevent cascading dep upgrades", - "matchPackageNames": ["go"], - "enabled": false - }, - { - "description": "Pin sigstore deps - cosign v3.0.6+ breaks ASN.1 signature validation, sigstore v1.10.9+ pulls go-containerregistry v0.21.7", - "matchPackageNames": [ - "/^github\\.com\\/sigstore\\//" - ], - "enabled": false - }, - { - "description": "Pin go-containerregistry - v0.21.6+ changes .local domains to HTTPS, breaking e2e tests", - "matchPackageNames": [ - "/^github\\.com\\/google\\/go-containerregistry/" - ], - "enabled": false - }, - { - "description": "Pin otel - v1.45.0+ causes webhook CrashLoopBackOff (exit code 2)", - "matchPackageNames": [ - "/^go\\.opentelemetry\\.io\\//" - ], - "enabled": false - }, - { - "description": "Pin knative - newer versions require otel v1.45.0+", - "matchPackageNames": [ - "/^knative\\.dev\\//" - ], - "enabled": false - }, - { - "description": "Pin OPA - newer versions transitively pull otel v1.45.0+ and jwx/v4, causing webhook crashes", - "matchPackageNames": [ - "/^github\\.com\\/open-policy-agent\\/opa/" - ], - "enabled": false - }, - { - "description": "Block go-ini/ini - v1.67.3 declares module path as gopkg.in/ini.v1, causing module mismatch", - "matchPackageNames": [ - "github.com/go-ini/ini" - ], - "enabled": false - }, - { - "description": "Block major version module path changes that break imports", - "matchPackageNames": [ - "/^github\\.com\\/cenkalti\\/backoff/", - "/^github\\.com\\/hashicorp\\/golang-lru/", - "/^github\\.com\\/hashicorp\\/hcl/", - "/^github\\.com\\/ThalesIgnite\\/crypto11/", - "/^github\\.com\\/theupdateframework\\/go-tuf/", - "/^github\\.com\\/golang-jwt\\/jwt/", - "/^github\\.com\\/tjfoc\\/gmsm/", - "/^github\\.com\\/google\\/go-github/", - "/^github\\.com\\/lestrrat-go\\/jwx/", - "/^github\\.com\\/lestrrat-go\\/option/", - "/^gomodules\\.xyz\\/jsonpatch/", - "/^gopkg\\.in\\/evanphx\\/json-patch/", - "/^go\\.yaml\\.in\\/yaml/", - "/^gitlab\\.com\\/gitlab-org\\/api\\/client-go/" - ], - "enabled": false - }, - { - "description": "Block alibabacloud major version bumps (transitive deps of sigstore)", - "matchPackageNames": [ - "/^github\\.com\\/alibabacloud-go\\/cr-20160607/", - "/^github\\.com\\/alibabacloud-go\\/cr-20181201/", - "/^github\\.com\\/alibabacloud-go\\/darabonba-openapi/", - "/^github\\.com\\/alibabacloud-go\\/tea-utils/" - ], - "enabled": false - } - ] - } + "ignorePaths": [ + "Dockerfile.coverage", + ".ko.yaml", + ".goreleaser.yaml", + "hack/**", + "release/**", + "config/**", + ".github/workflows/**", + "test/testdata/**" + ], + "packageRules": [ + { + "description": "Disable GitHub Actions updates", + "matchManagers": ["github-actions"], + "enabled": false + }, + { + "description": "Disable updates for upstream-only Docker images", + "matchDatasources": ["docker"], + "matchPackageNames": [ + "golang", + "cgr.dev/chainguard/static" + ], + "enabled": false + }, + { + "description": "Do not bump the go directive - must stay at current version to prevent cascading dep upgrades", + "matchPackageNames": ["go"], + "enabled": false + }, + { + "description": "Pin sigstore deps - cosign v3.0.6+ breaks ASN.1 signature validation, sigstore v1.10.9+ pulls go-containerregistry v0.21.7", + "matchPackageNames": [ + "/^github\\.com\\/sigstore\\//" + ], + "enabled": false + }, + { + "description": "Pin go-containerregistry - v0.21.6+ changes .local domains to HTTPS, breaking e2e tests", + "matchPackageNames": [ + "/^github\\.com\\/google\\/go-containerregistry/" + ], + "enabled": false + }, + { + "description": "Pin otel - v1.45.0+ causes webhook CrashLoopBackOff (exit code 2)", + "matchPackageNames": [ + "/^go\\.opentelemetry\\.io\\//" + ], + "enabled": false + }, + { + "description": "Pin knative - newer versions require otel v1.45.0+", + "matchPackageNames": [ + "/^knative\\.dev\\//" + ], + "enabled": false + }, + { + "description": "Pin OPA - newer versions transitively pull otel v1.45.0+ and jwx/v4, causing webhook crashes", + "matchPackageNames": [ + "/^github\\.com\\/open-policy-agent\\/opa/" + ], + "enabled": false + }, + { + "description": "Block go-ini/ini - v1.67.3 declares module path as gopkg.in/ini.v1, causing module mismatch", + "matchPackageNames": [ + "github.com/go-ini/ini" + ], + "enabled": false + }, + { + "description": "Block major version module path changes that break imports", + "matchPackageNames": [ + "/^github\\.com\\/cenkalti\\/backoff/", + "/^github\\.com\\/hashicorp\\/golang-lru/", + "/^github\\.com\\/hashicorp\\/hcl/", + "/^github\\.com\\/ThalesIgnite\\/crypto11/", + "/^github\\.com\\/theupdateframework\\/go-tuf/", + "/^github\\.com\\/golang-jwt\\/jwt/", + "/^github\\.com\\/tjfoc\\/gmsm/", + "/^github\\.com\\/google\\/go-github/", + "/^github\\.com\\/lestrrat-go\\/jwx/", + "/^github\\.com\\/lestrrat-go\\/option/", + "/^gomodules\\.xyz\\/jsonpatch/", + "/^gopkg\\.in\\/evanphx\\/json-patch/", + "/^go\\.yaml\\.in\\/yaml/", + "/^gitlab\\.com\\/gitlab-org\\/api\\/client-go/" + ], + "enabled": false + }, + { + "description": "Block alibabacloud major version bumps (transitive deps of sigstore)", + "matchPackageNames": [ + "/^github\\.com\\/alibabacloud-go\\/cr-20160607/", + "/^github\\.com\\/alibabacloud-go\\/cr-20181201/", + "/^github\\.com\\/alibabacloud-go\\/darabonba-openapi/", + "/^github\\.com\\/alibabacloud-go\\/tea-utils/" + ], + "enabled": false + } + ] }