chore(deps): update github actions

.github/workflows/build-bink.yaml

@@ -42,7 +42,7 @@ jobs:
         run: make build-bink
 
       - name: Upload bink binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bink
           path: bink

.github/workflows/build-operator.yaml

@@ -24,7 +24,7 @@ jobs:
         run: podman save -o operator-image.tar bootc-operator:dev
 
       - name: Upload operator image
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: operator-image
           path: operator-image.tar

.github/workflows/ci.yaml

@@ -84,7 +84,7 @@ jobs:
           persist-credentials: false
 
       - name: Download bink binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: bink
           path: /usr/local/bin
@@ -102,7 +102,7 @@ jobs:
         uses: $/.github/actions/setup-bink-env
 
       - name: Download operator image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: operator-image
 
@@ -124,7 +124,7 @@ jobs:
 
       - name: Upload logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: e2e-logs-${{ matrix.kube-minor }}
           path: _output/logs/
@@ -141,7 +141,7 @@ jobs:
       IMAGE: ghcr.io/${{ github.repository }}
     steps:
       - name: Download operator image
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: operator-image
 

.github/workflows/helm.yaml

@@ -0,0 +1,111 @@
+name: Helm
+
+on:
+  push:
+    branches: [main, release-*]
+  pull_request:
+    branches: [main, release-*]
+
+env:
+  BINK_COMMIT: c7c4013e1275f07fe6ee90be92b61d256117460f
+
+permissions:
+  contents: read
+
+concurrency:
+  group: helm-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-bink:
+    uses: $/.github/workflows/build-bink.yaml
+    with:
+      bink-commit: c7c4013e1275f07fe6ee90be92b61d256117460f
+
+  build-operator:
+    uses: $/.github/workflows/build-operator.yaml
+
+  helm-e2e:
+    runs-on: ubuntu-latest
+    needs: [build-bink, build-operator]
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    env:
+      BINK_NODE_DISK_IMAGE: ghcr.io/bootc-dev/bink/node@sha256:d3077c99027db0c196d5c6531ef07b8955be827651b9e3d2bc4b8e7c6ebf5612
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Download bink binary
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: bink
+          path: /usr/local/bin
+
+      - name: Make bink executable
+        run: chmod +x /usr/local/bin/bink
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+          cache: true # zizmor: ignore[cache-poisoning]
+
+      - name: Set up bink environment
+        uses: $/.github/actions/setup-bink-env
+
+      - name: Download operator image
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: operator-image
+
+      - name: Load operator image
+        run: podman load -i operator-image.tar
+
+      - name: Start bink cluster
+        run: make start-bink
+
+      - name: Build update images
+        run: make build-update-image
+
+      - name: Push operator image to bink registry
+        run: podman push --tls-verify=false bootc-operator:dev localhost:5000/bootc-operator:dev
+
+      - name: Generate Helm chart
+        run: make helm
+
+      - name: Install Helm charts
+        run: |
+          helm dependency build ./chart/bootc-operator
+          helm install bootc-operator ./chart/bootc-operator \
+            --kubeconfig $(pwd)/kubeconfig-e2e \
+            --create-namespace --namespace bootc-operator \
+            --set image.repository=registry.cluster.local:5000/bootc-operator \
+            --set image.tag=dev \
+            --set image.pullPolicy=Always \
+            --set-json 'controller.extraArgs=["--allow-insecure-registry"]'
+
+      - name: Verify controller is running
+        run: |
+          kubectl --kubeconfig $(pwd)/kubeconfig-e2e -n bootc-operator \
+            rollout status deployment/bootc-operator-controller --timeout=3m
+          kubectl --kubeconfig $(pwd)/kubeconfig-e2e -n bootc-operator \
+            get pods
+
+      - name: Run e2e smoke tests
+        run: make e2e RUN='TestCRDSmoke|TestControllerMembership' V=1
+
+      - name: Gather logs on failure
+        if: failure()
+        run: make gather-bink
+
+      - name: Upload logs
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: helm-e2e-logs
+          path: _output/logs/
+          if-no-files-found: ignore

.github/workflows/release.yaml

@@ -49,16 +49,18 @@ jobs:
       IMAGE: ghcr.io/${{ github.repository }}
     steps:
       - name: Create GitHub App token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         with:
           client-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
 
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Import GPG key
@@ -84,12 +86,14 @@ jobs:
       - name: Create and push tag
         env:
           TAG: ${{ steps.version.outputs.tag }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           if git rev-parse "${TAG}" >/dev/null 2>&1; then
             echo "::error::Tag ${TAG} already exists"
             exit 1
           fi
           git tag -s -m "Release ${TAG}" "${TAG}"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
           git push origin "${TAG}"
 
       - name: Create release branch

.github/workflows/zizmor.yml

@@ -11,7 +11,7 @@ permissions: {}
 jobs:
   zizmor:
     name: Scan GHA workflows
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     permissions:
       security-events: write # Required to upload SARIF files
     steps:
@@ -21,4 +21,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1