From ea68a4362b47a3115fb8b3684c6a00b8d19e99a0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20Gond=C5=BEa?= Date: Wed, 4 Nov 2026 09:25:20 +0100 Subject: [PATCH 1/6] chore: Unify .github. Salvage cherry-pick-bot, remove the rest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Oliver Gondža --- .../.github => .github}/cherry-pick-bot.yml | 0 .github/workflows/codegen.yaml | 17 ++ .../.github/ISSUE_TEMPLATE/bug_report.md | 27 --- .../.github/ISSUE_TEMPLATE/feature_request.md | 23 --- .../.github/ISSUE_TEMPLATE/task.md | 19 --- .../.github/PULL_REQUEST_TEMPLATE.md | 26 --- argocd-operator/.github/dependabot.yml | 47 ------ .../.github/workflows/ci-build.yaml | 159 ------------------ .../.github/workflows/codegen.yaml | 59 ------- argocd-operator/.github/workflows/go.yml | 42 ----- argocd-operator/.github/workflows/lint.yaml | 47 ------ 11 files changed, 17 insertions(+), 449 deletions(-) rename {argocd-operator/.github => .github}/cherry-pick-bot.yml (100%) delete mode 100644 argocd-operator/.github/ISSUE_TEMPLATE/bug_report.md delete mode 100644 argocd-operator/.github/ISSUE_TEMPLATE/feature_request.md delete mode 100644 argocd-operator/.github/ISSUE_TEMPLATE/task.md delete mode 100644 argocd-operator/.github/PULL_REQUEST_TEMPLATE.md delete mode 100644 argocd-operator/.github/dependabot.yml delete mode 100644 argocd-operator/.github/workflows/ci-build.yaml delete mode 100644 argocd-operator/.github/workflows/codegen.yaml delete mode 100644 argocd-operator/.github/workflows/go.yml delete mode 100644 argocd-operator/.github/workflows/lint.yaml diff --git a/argocd-operator/.github/cherry-pick-bot.yml b/.github/cherry-pick-bot.yml similarity index 100% rename from argocd-operator/.github/cherry-pick-bot.yml rename to .github/cherry-pick-bot.yml diff --git a/.github/workflows/codegen.yaml b/.github/workflows/codegen.yaml index 25fffca3bec..95e6c19a7d6 100644 --- a/.github/workflows/codegen.yaml +++ b/.github/workflows/codegen.yaml @@ -88,3 +88,20 @@ jobs: - name: "Ensure code passes 'golangci-lint' - run 'make lint' to identify issues" run: | make lint + + verify_argo_cd_has_updated_dependencies: + name: Verify Argo CD has updated dependencies, for the given target version + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v7 + - name: Set up Go + uses: actions/setup-go@v7 + with: + go-version-file: "go.mod" + - name: "Call update dependencies Makefile target" + run: | + make update-dependencies + - name: Ensure there is no unexpected diff in repository artifacts + run: | + git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- . diff --git a/argocd-operator/.github/ISSUE_TEMPLATE/bug_report.md b/argocd-operator/.github/ISSUE_TEMPLATE/bug_report.md deleted file mode 100644 index 891c6177548..00000000000 --- a/argocd-operator/.github/ISSUE_TEMPLATE/bug_report.md +++ /dev/null @@ -1,27 +0,0 @@ ---- -name: Bug report -about: Create a report to help us improve -title: '' -labels: '' -assignees: '' - ---- - -**Describe the bug** -A clear and concise description of what the bug is. - -**To Reproduce** -Steps to reproduce the behavior: -1. Go to '...' -2. Click on '....' -3. Scroll down to '....' -4. See error - -**Expected behavior** -A clear and concise description of what you expected to happen. - -**Screenshots** -If applicable, add screenshots to help explain your problem. - -**Additional context** -Add any other context about the problem here. diff --git a/argocd-operator/.github/ISSUE_TEMPLATE/feature_request.md b/argocd-operator/.github/ISSUE_TEMPLATE/feature_request.md deleted file mode 100644 index fdfd1ff492c..00000000000 --- a/argocd-operator/.github/ISSUE_TEMPLATE/feature_request.md +++ /dev/null @@ -1,23 +0,0 @@ ---- -name: Feature request -about: Suggest an idea for this project -title: '' -labels: '' -assignees: '' - ---- - -> if your feature request is a large change and requires a formal proposal or design doc, please read the docs for [contributing](https://github.com/argoproj-labs/argocd-operator/blob/master/docs/developer-guide/contributing.md) first. You may need to submit an additional Pull Request using the [enhancement proposal template](https://github.com/argoproj-labs/argocd-operator/blob/master/docs/proposals/001-proposal-template.md). - - -**Is your feature request related to a problem? Please describe.** -A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] - -**Describe the solution you'd like** -A clear and concise description of what you want to happen. - -**Describe alternatives you've considered** -A clear and concise description of any alternative solutions or features you've considered. - -**Additional context** -Add any other context or screenshots about the feature request here. diff --git a/argocd-operator/.github/ISSUE_TEMPLATE/task.md b/argocd-operator/.github/ISSUE_TEMPLATE/task.md deleted file mode 100644 index 9f6ffb0db68..00000000000 --- a/argocd-operator/.github/ISSUE_TEMPLATE/task.md +++ /dev/null @@ -1,19 +0,0 @@ ---- -name: Task 🔧 -about: Internal things, technical debt, and to-do tasks to be performed. -title: '' -labels: 'kind/task' -assignees: '' - ---- -### Is your task related to a problem? Please describe. - - -### Describe the solution you'd like - - -### Describe alternatives you've considered - - -### Additional context - diff --git a/argocd-operator/.github/PULL_REQUEST_TEMPLATE.md b/argocd-operator/.github/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index f2d100a9e6b..00000000000 --- a/argocd-operator/.github/PULL_REQUEST_TEMPLATE.md +++ /dev/null @@ -1,26 +0,0 @@ -**What type of PR is this?** - -[//]: # (Uncomment only one line, and delete the rest.) -[//]: # (For example, would simply become: /kind bug ) - - - - - - - - - - -**What does this PR do / why we need it**: - -**Have you updated the necessary documentation?** - -* [ ] Documentation update is required by this PR. -* [ ] Documentation has been updated. - -**Which issue(s) this PR fixes**: - -Fixes #? - -**How to test changes / Special notes to the reviewer**: diff --git a/argocd-operator/.github/dependabot.yml b/argocd-operator/.github/dependabot.yml deleted file mode 100644 index 4e3920e6009..00000000000 --- a/argocd-operator/.github/dependabot.yml +++ /dev/null @@ -1,47 +0,0 @@ -# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates - -version: 2 -updates: - - package-ecosystem: "gomod" - directory: "/" - schedule: - interval: "daily" - open-pull-requests-limit: 10 - ignore: - # Only suggest patch updates. Rest is manually controlled. - - dependency-name: "github.com/argoproj-labs/argocd-image-updater" - update-types: - - "version-update:semver-major" - - "version-update:semver-minor" - # Ignore argo-cd altogether. Needs `make update-dependencies` to be done correctly. - - dependency-name: "github.com/argoproj/argo-cd/v3" - - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "daily" - - - package-ecosystem: "docker" - directory: "/build/" - schedule: - interval: "daily" - - - package-ecosystem: "docker" - directory: "/build/util/" - schedule: - interval: "daily" - - - package-ecosystem: "docker" - directory: "/deploy/registry/" - schedule: - interval: "daily" - - - package-ecosystem: "docker" - directory: "/tests/auxiliary/smtplistener/" - schedule: - interval: "daily" diff --git a/argocd-operator/.github/workflows/ci-build.yaml b/argocd-operator/.github/workflows/ci-build.yaml deleted file mode 100644 index c97eaec16eb..00000000000 --- a/argocd-operator/.github/workflows/ci-build.yaml +++ /dev/null @@ -1,159 +0,0 @@ -name: Build and test the operator -on: - push: - branches: - - "master" - - "release-*" - - "rhos-*" - pull_request: - paths-ignore: - - "docs/**" - branches: - - "master" - - "release-*" - - "rhos-*" - -jobs: - build-operator: - runs-on: ubuntu-latest - - steps: - - name: Create checkout directory - run: mkdir -p ~/go/src/github.com/argoproj-labs - - - name: Checkout code - uses: actions/checkout@v7 - - - name: Create symlink in GOPATH - run: ln -s $(pwd) ~/go/src/github.com/argoproj-labs - - - name: Set up Go - uses: actions/setup-go@v7 - with: - go-version-file: "go.mod" - - - name: Restore go build cache - uses: actions/cache@v6 - with: - path: ~/.cache/go-build - key: ${{ runner.os }}-go-build-v1-${{ github.run_id }} - - - name: Build operator container image - run: make docker-build IMG=quay.io/argoprojlabs/argocd-operator:latest - - test-e2e: - name: Run end-to-end tests - runs-on: ubuntu-latest - strategy: - matrix: - k3s-version: - - v1.27.1-k3s1 - - v1.33.5-k3s1 - steps: - - name: Install K3D - run: | - set -x - curl -s https://raw.githubusercontent.com/rancher/k3d/main/install.sh | bash - sudo mkdir -p $HOME/.kube && sudo chown -R runner $HOME/.kube - - feature_flags=() - case "${{ matrix.k3s-version }}" in - v1.3[3456789]*) - # Enable ClusterTrustBundle and ClusterTrustBundleProjection until it is enabled by default in kubernetes - feature_flags+=( - "--k3s-arg" "--kube-apiserver-arg=feature-gates=ClusterTrustBundle=true,ClusterTrustBundleProjection=true@server:*" - "--k3s-arg" "--kube-apiserver-arg=runtime-config=certificates.k8s.io/v1beta1/clustertrustbundles=true@server:*" - "--k3s-arg" "--kubelet-arg=feature-gates=ClusterTrustBundle=true,ClusterTrustBundleProjection=true@agent:*" - ) - ;; - esac - - # preserved for future use: - # - limit logs to 4Mi, to avoid overwhelming GitHub's small runner storage (14Gi) - # - k3d cluster create --servers 3 --image "rancher/k3s:${{ matrix.k3s-version }}" --k3s-arg '--kubelet-arg=container-log-max-files=2@server:*' --k3s-arg '--kubelet-arg=container-log-max-size=2Mi@server:*' - # - I tried this, to reduce the the amount of GitHub Runner disk space used by k3d. These params did not appear to affect disk space usage. - k3d cluster create --servers 3 --image "rancher/k3s:${{ matrix.k3s-version }}" "${feature_flags[@]}" - kubectl version - k3d version - - name: Checkout code - uses: actions/checkout@v7 - - name: Setup Golang - uses: actions/setup-go@v7 - with: - go-version-file: "go.mod" - - name: GH actions workaround - Kill XSP4 process - run: | - sudo pkill mono || true - - name: Restore go build cache - uses: actions/cache@v6 - with: - path: ~/.cache/go-build - key: ${{ runner.os }}-go-build-v1-${{ github.run_id }} - - name: Add /usr/local/bin to PATH - run: | - echo "/usr/local/bin" >> $GITHUB_PATH - - name: Download Go dependencies - run: | - go mod download - - name: Run the operator locally - env: - ARGOCD_CLUSTER_CONFIG_NAMESPACES: argocd-e2e-cluster-config, argocd-test-impersonation - run: | - set -o pipefail - make install generate fmt vet - # Use tee to flush output to the log. Other solutions like stdbuf don't work, not sure why. - make start-e2e 2>&1 | tee /tmp/e2e-operator-run.log & - - - name: Run ginkgo tests - run: | - set -o pipefail - LOCAL_RUN=true make e2e-tests-sequential-ginkgo e2e-tests-parallel-ginkgo 2>&1 | tee /tmp/e2e-test-ginkgo.log - - - name: Upload operator logs - uses: actions/upload-artifact@v7 - with: - name: e2e-operator-run-${{ matrix.k3s-version }}.log - path: /tmp/e2e-operator-run.log - if: ${{ failure() }} - - - name: Upload ginkgo test logs - uses: actions/upload-artifact@v7 - with: - name: e2e-test-${{ matrix.k3s-version }}.log - path: /tmp/e2e-test-ginkgo.log - if: ${{ failure() }} - - - name: Save application controller and server logs - if: ${{ failure() }} - run: | - # Since the tests stop on the first failure, only one of the namespaces will exist - set -x - if [ $(kubectl get namespaces -o=name | grep '^namespace/argocd-e2e$') ]; then - hack/pods.sh argocd-e2e > /tmp/pods.log - kubectl logs -n argocd-e2e $(kubectl get po -n argocd-e2e -o=name | grep example-argocd-application-controller) > /tmp/e2e-application-controller.log - kubectl logs -n argocd-e2e $(kubectl get po -n argocd-e2e -o=name | grep example-argocd-server) > /tmp/e2e-server.log - kubectl describe -n argocd-e2e $(kubectl get po -n argocd-e2e -o=name | grep example-argocd-server) >> /tmp/e2e-server.log - elif [ $(kubectl get namespaces -o=name | grep '^namespace/argocd-e2e-cluster-config$') ]; then - hack/pods.sh argocd-e2e-cluster-config > /tmp/pods.log - kubectl logs -n argocd-e2e-cluster-config $(kubectl get po -n argocd-e2e-cluster-config -o=name | grep example-argocd-application-controller) > /tmp/e2e-application-controller.log - kubectl logs -n argocd-e2e-cluster-config $(kubectl get po -n argocd-e2e-cluster-config -o=name | grep example-argocd-server) > /tmp/e2e-server.log - kubectl describe -n argocd-e2e-cluster-config $(kubectl get po -n argocd-e2e-cluster-config -o=name | grep example-argocd-server) >> /tmp/e2e-server.log - fi - - name: Upload application controller logs - uses: actions/upload-artifact@v7 - with: - name: e2e-application-controller-${{ matrix.k3s-version }}.log - path: /tmp/e2e-application-controller.log - if: ${{ failure() }} - - name: Upload server logs - uses: actions/upload-artifact@v7 - with: - name: e2e-server-${{ matrix.k3s-version }}.log - path: /tmp/e2e-server.log - if: ${{ failure() }} - - name: Upload pod descriptions - uses: actions/upload-artifact@v7 - with: - name: e2e-pods-${{ matrix.k3s-version }}.log - path: /tmp/pods.log - if: ${{ failure() }} diff --git a/argocd-operator/.github/workflows/codegen.yaml b/argocd-operator/.github/workflows/codegen.yaml deleted file mode 100644 index 5248e82cb86..00000000000 --- a/argocd-operator/.github/workflows/codegen.yaml +++ /dev/null @@ -1,59 +0,0 @@ -name: Generated code -on: - push: - branches: - - 'master' - pull_request: - paths-ignore: - - "docs/**" - branches: - - 'master' - -jobs: - check-go-modules: - name: "Check for go.mod/go.sum synchronicity" - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v7 - - name: Setup Golang - uses: actions/setup-go@v7 - with: - go-version-file: 'go.mod' - - name: Download all Go modules - run: | - go mod download - - name: Check for tidyness of go.mod and go.sum - run: | - go mod tidy - git diff --exit-code -- . - - check-sdk-codegen: - name: "Check for changes from make bundle" - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v7 - - name: Setup Golang - uses: actions/setup-go@v7 - with: - go-version-file: 'go.mod' - - name: Run make bundle - run: | - make bundle - - name: Ensure there is no diff in bundle - # --ignore-matching-lines='.*createdAt:.*' added to ignore bundle differences of timestamp that is generated by upgraded operator-sdk - run: | - git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- . - - name: Run make generate - run: | - make generate - - name: Ensure there is no diff in generated assets - run: | - git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- . - - name: Run make manifests - run: | - make manifests - - name: Ensure there is no diff in manifests - run: | - git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- . diff --git a/argocd-operator/.github/workflows/go.yml b/argocd-operator/.github/workflows/go.yml deleted file mode 100644 index ae019fdcb8b..00000000000 --- a/argocd-operator/.github/workflows/go.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: Go - -on: - push: - branches: - - 'master' - - 'release-*' - - 'rhos-*' - pull_request: - paths-ignore: - - "docs/**" - branches: - - 'master' - - 'release-*' - - 'rhos-*' - -jobs: - - build: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v7 - - - name: Set up Go - uses: actions/setup-go@v7 - with: - go-version-file: 'go.mod' - - - name: Build - run: make build - - - name: Test - run: make test - - - name: Upload code coverage to codecov.io - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 - with: - files: cover.out - flags: unit-tests - fail_ci_if_error: false - env: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/argocd-operator/.github/workflows/lint.yaml b/argocd-operator/.github/workflows/lint.yaml deleted file mode 100644 index 86dfc1dcaed..00000000000 --- a/argocd-operator/.github/workflows/lint.yaml +++ /dev/null @@ -1,47 +0,0 @@ -name: "Validation, verifications, and lints" -on: - pull_request: - paths-ignore: - - "docs/**" - branches: - - "master" - - "release-*" - - "rhos-*" - -jobs: - lint_code: - name: Run golangci-lint and gosec - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v7 - - name: Set up Go - uses: actions/setup-go@v7 - with: - go-version-file: "go.mod" - - name: "Ensure code passes 'go-sec' - run 'make gosec' to identify issues" - run: | - make gosec - - name: "Ensure code passes 'golangci-lint' - run 'make lint' to identify issues" - run: | - make lint - - name: Ensure there is no diff in code - run: | - git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- . - - verify_argo_cd_has_updated_dependencies: - name: Verify Argo CD has updated dependencies, for the given target version - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v7 - - name: Set up Go - uses: actions/setup-go@v7 - with: - go-version-file: "go.mod" - - name: "Call update dependencies Makefile target" - run: | - make update-dependencies - - name: Ensure there is no unexpected diff in repository artifacts - run: | - git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- . From e3c4f4bb4ef96d6cd2bf4f0fbb376f0c5ff79f37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20Gond=C5=BEa?= Date: Wed, 4 Nov 2026 09:52:40 +0100 Subject: [PATCH 2/6] chore: Move `make update-dependencies*` goals to top level MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Oliver Gondža --- Makefile | 12 +++++++--- argocd-operator/Makefile | 22 ------------------- .../update-dependencies-script/README.md | 0 .../update-dependencies-script/argocd/main.go | 8 +++---- .../update-dependencies-script/argocd/run.sh | 0 .../gitops-promoter/main.go | 2 +- .../gitops-promoter/run.sh | 0 .../update-dependencies-script/go.mod | 0 .../update-dependencies-script/go.sum | 0 .../update-dependencies-script/run.sh | 0 .../update-dependencies-script/utils/utils.go | 1 + 11 files changed, 15 insertions(+), 30 deletions(-) rename {argocd-operator/hack => hack}/update-dependencies-script/README.md (100%) rename {argocd-operator/hack => hack}/update-dependencies-script/argocd/main.go (98%) rename {argocd-operator/hack => hack}/update-dependencies-script/argocd/run.sh (100%) rename {argocd-operator/hack => hack}/update-dependencies-script/gitops-promoter/main.go (99%) rename {argocd-operator/hack => hack}/update-dependencies-script/gitops-promoter/run.sh (100%) rename {argocd-operator/hack => hack}/update-dependencies-script/go.mod (100%) rename {argocd-operator/hack => hack}/update-dependencies-script/go.sum (100%) rename {argocd-operator/hack => hack}/update-dependencies-script/run.sh (100%) rename {argocd-operator/hack => hack}/update-dependencies-script/utils/utils.go (98%) diff --git a/Makefile b/Makefile index 370e31b5ae8..825cec77784 100644 --- a/Makefile +++ b/Makefile @@ -5,6 +5,12 @@ # - use environment variables to overwrite this value (e.g export VERSION=0.0.2) VERSION ?= "" +# ARGO_CD_TARGET_VERSION is the target version that argocd-operator will install. +# Update this when you upgrade the Argo CD dependencies of the project. +# After updating, call 'make update-dependencies'. +# Notes: +# - String should NOT begin with 'v' prefix, e.g. 'v3.1.1' +ARGO_CD_TARGET_VERSION ?= 3.5.6 # Try to detect Docker or Podman CONTAINER_RUNTIME := $(shell command -v docker 2> /dev/null || command -v podman 2> /dev/null) @@ -137,15 +143,15 @@ vet: ## Run go vet against code. .PHONY: update-dependencies update-dependencies: ## Update Go dependencies and regenerate CRDs, manifests and bundle. - $(MAKE) -C argocd-operator update-dependencies + hack/update-dependencies-script/run.sh .PHONY: update-dependencies-argocd update-dependencies-argocd: ## Update only the Argo CD dependency. - $(MAKE) -C argocd-operator update-dependencies-argocd + hack/update-dependencies-script/argocd/run.sh .PHONY: update-dependencies-gitops-promoter update-dependencies-gitops-promoter: ## Update only the GitOps Promoter dependency. - $(MAKE) -C argocd-operator update-dependencies-gitops-promoter + hack/update-dependencies-script/gitops-promoter/run.sh .PHONY: test-all test-all: manifests generate fmt vet ## Run all tests. diff --git a/argocd-operator/Makefile b/argocd-operator/Makefile index 792bd6ba252..4dc249255a6 100644 --- a/argocd-operator/Makefile +++ b/argocd-operator/Makefile @@ -5,13 +5,6 @@ # - use environment variables to overwrite this value (e.g export VERSION=0.0.2) VERSION ?= 0.20.0 -# ARGO_CD_TARGET_VERSION is the target version that argocd-operator will install. -# Update this when you upgrade the Argo CD dependencies of the project. -# After updating, call 'make update-dependencies'. -# Notes: -# - String should NOT begin with 'v' prefix, e.g. 'v3.1.1' -ARGO_CD_TARGET_VERSION ?= 3.5.6 - # Try to detect Docker or Podman CONTAINER_RUNTIME := $(shell command -v docker 2> /dev/null || command -v podman 2> /dev/null) @@ -192,18 +185,3 @@ GINKGO_MOD_VERSION = $(shell go list -m -f '{{.Version}}' github.com/onsi/ginkgo ginkgo: ## Download ginkgo locally if necessary. $(call go-install-tool,$(GINKGO_CLI),github.com/onsi/ginkgo/v2/ginkgo@$(GINKGO_MOD_VERSION)) -# Updates upstream dependencies throughout the repository -.PHONY: update-dependencies -update-dependencies: - hack/update-dependencies-script/run.sh - -# Updates only Argo CD dependencies -.PHONY: update-dependencies-argocd -update-dependencies-argocd: - hack/update-dependencies-script/argocd/run.sh - -# Updates only Argo CD dependencies -.PHONY: update-dependencies-gitops-promoter -update-dependencies-gitops-promoter: - hack/update-dependencies-script/gitops-promoter/run.sh - diff --git a/argocd-operator/hack/update-dependencies-script/README.md b/hack/update-dependencies-script/README.md similarity index 100% rename from argocd-operator/hack/update-dependencies-script/README.md rename to hack/update-dependencies-script/README.md diff --git a/argocd-operator/hack/update-dependencies-script/argocd/main.go b/hack/update-dependencies-script/argocd/main.go similarity index 98% rename from argocd-operator/hack/update-dependencies-script/argocd/main.go rename to hack/update-dependencies-script/argocd/main.go index 994984a604a..9d6420b0439 100644 --- a/argocd-operator/hack/update-dependencies-script/argocd/main.go +++ b/hack/update-dependencies-script/argocd/main.go @@ -33,7 +33,7 @@ func main() { return } - argocdOperatorRoot, err := filepath.Abs(wd + "/../../..") + argocdOperatorRoot, err := filepath.Abs(wd + "../../../../argocd-operator/") if err != nil { utils.ExitWithError(fmt.Errorf("unable to get absolute dir: %v", err)) return @@ -44,7 +44,7 @@ func main() { gitopsOperatorRoot := filepath.Dir(argocdOperatorRoot) // Version variable is in the form of 'v3.1.1', note the 'v' prefix - targetArgoCDVersion := readTargetVersionFromMakefile(argocdOperatorRoot) + targetArgoCDVersion := readTargetVersionFromMakefile(gitopsOperatorRoot) fmt.Println() fmt.Println("Target Argo CD version from Makefile is", targetArgoCDVersion) @@ -90,11 +90,11 @@ func main() { fmt.Println() } -func readTargetVersionFromMakefile(argocdOperatorRoot string) string { +func readTargetVersionFromMakefile(operatorRoot string) string { // Target version in Makefile looks like this: // ARGO_CD_TARGET_VERSION ?= 3.1.1 - fileToRead := filepath.Join(argocdOperatorRoot, "Makefile") + fileToRead := filepath.Join(operatorRoot, "Makefile") bytes, err := os.ReadFile(fileToRead) if err != nil { diff --git a/argocd-operator/hack/update-dependencies-script/argocd/run.sh b/hack/update-dependencies-script/argocd/run.sh similarity index 100% rename from argocd-operator/hack/update-dependencies-script/argocd/run.sh rename to hack/update-dependencies-script/argocd/run.sh diff --git a/argocd-operator/hack/update-dependencies-script/gitops-promoter/main.go b/hack/update-dependencies-script/gitops-promoter/main.go similarity index 99% rename from argocd-operator/hack/update-dependencies-script/gitops-promoter/main.go rename to hack/update-dependencies-script/gitops-promoter/main.go index b54d1a0da59..6a8616c0bcb 100644 --- a/argocd-operator/hack/update-dependencies-script/gitops-promoter/main.go +++ b/hack/update-dependencies-script/gitops-promoter/main.go @@ -32,7 +32,7 @@ func main() { return } - argocdOperatorRoot, err := filepath.Abs(wd + "/../../..") + argocdOperatorRoot, err := filepath.Abs(wd + "/../../../argocd-operator/") if err != nil { utils.ExitWithError(fmt.Errorf("unable to get absolute dir: %v", err)) return diff --git a/argocd-operator/hack/update-dependencies-script/gitops-promoter/run.sh b/hack/update-dependencies-script/gitops-promoter/run.sh similarity index 100% rename from argocd-operator/hack/update-dependencies-script/gitops-promoter/run.sh rename to hack/update-dependencies-script/gitops-promoter/run.sh diff --git a/argocd-operator/hack/update-dependencies-script/go.mod b/hack/update-dependencies-script/go.mod similarity index 100% rename from argocd-operator/hack/update-dependencies-script/go.mod rename to hack/update-dependencies-script/go.mod diff --git a/argocd-operator/hack/update-dependencies-script/go.sum b/hack/update-dependencies-script/go.sum similarity index 100% rename from argocd-operator/hack/update-dependencies-script/go.sum rename to hack/update-dependencies-script/go.sum diff --git a/argocd-operator/hack/update-dependencies-script/run.sh b/hack/update-dependencies-script/run.sh similarity index 100% rename from argocd-operator/hack/update-dependencies-script/run.sh rename to hack/update-dependencies-script/run.sh diff --git a/argocd-operator/hack/update-dependencies-script/utils/utils.go b/hack/update-dependencies-script/utils/utils.go similarity index 98% rename from argocd-operator/hack/update-dependencies-script/utils/utils.go rename to hack/update-dependencies-script/utils/utils.go index caeab2e8ffd..714f9a36718 100644 --- a/argocd-operator/hack/update-dependencies-script/utils/utils.go +++ b/hack/update-dependencies-script/utils/utils.go @@ -160,6 +160,7 @@ func CloneRepoIntoTempDir(repoURL, latestReleaseVersionTag string) (string, erro "--branch", latestReleaseVersionTag, "--single-branch", "--no-tags", + "-c", "advice.detachedHead=false", repoURL, outputDir); err != nil { return "", err From 2fcb3a9db4355c9e813a3dd7842b0b5a8b1f0060 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20Gond=C5=BEa?= Date: Wed, 4 Nov 2026 10:34:09 +0100 Subject: [PATCH 3/6] chore: Drop unused stuff from argocd-operator/hack/ MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Oliver Gondža --- argocd-operator/hack/boilerplate.go.txt | 15 --- argocd-operator/hack/pods.sh | 13 --- argocd-operator/hack/sync-e2e-tests/README.md | 69 ------------- argocd-operator/hack/sync-e2e-tests/go.mod | 7 -- argocd-operator/hack/sync-e2e-tests/main.go | 99 ------------------- 5 files changed, 203 deletions(-) delete mode 100644 argocd-operator/hack/boilerplate.go.txt delete mode 100755 argocd-operator/hack/pods.sh delete mode 100644 argocd-operator/hack/sync-e2e-tests/README.md delete mode 100644 argocd-operator/hack/sync-e2e-tests/go.mod delete mode 100644 argocd-operator/hack/sync-e2e-tests/main.go diff --git a/argocd-operator/hack/boilerplate.go.txt b/argocd-operator/hack/boilerplate.go.txt deleted file mode 100644 index 45dbbbbcf09..00000000000 --- a/argocd-operator/hack/boilerplate.go.txt +++ /dev/null @@ -1,15 +0,0 @@ -/* -Copyright 2021. - -Licensed under the Apache License, Version 2.0 (the "License"); -you may not use this file except in compliance with the License. -You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - -Unless required by applicable law or agreed to in writing, software -distributed under the License is distributed on an "AS IS" BASIS, -WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -See the License for the specific language governing permissions and -limitations under the License. -*/ \ No newline at end of file diff --git a/argocd-operator/hack/pods.sh b/argocd-operator/hack/pods.sh deleted file mode 100755 index b710d329cee..00000000000 --- a/argocd-operator/hack/pods.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/sh - -set -e - -kubectl get po -n $1 -pods=$(kubectl get po -n $1 -o=name) -for pod in $pods; do - echo "====================" - kubectl describe -n $1 $pod -done -echo "====================" -echo "Secrets:" -kubectl get secrets -n $1 diff --git a/argocd-operator/hack/sync-e2e-tests/README.md b/argocd-operator/hack/sync-e2e-tests/README.md deleted file mode 100644 index c216db548b4..00000000000 --- a/argocd-operator/hack/sync-e2e-tests/README.md +++ /dev/null @@ -1,69 +0,0 @@ -# sync-e2e-tests - -An experimental utility that can be used to make it easier to keep argocd-operator and gitops-operator Ginkgo tests in sync. - -This utility will strip the imports from a tree of go files. This allows for easy comparison of argocd-operator and gitops-operator E2E tests (since the imports are mainly all that differs between them). - - -## 1) Setup directories for comparison -``` -mkdir /tmp/compare -cd /tmp/compare -git clone git@github.com:argoproj-labs/argocd-operator -cd argocd-operator -git checkout '(branch you want to compare)' - -cd /tmp/compare -git clone git@github.com:redhat-developer/gitops-operator -cd gitops-operator -git checkout '(branch you want to compare)' -``` - -## 2) Strip imports from directories and commit - -``` -go run . "/tmp/compare/argocd-operator" -go run . "/tmp/compare/gitops-operator" - -cd /tmp/compare/argocd-operator -git add --all -git commit -m "hi" - -cd /tmp/compare/gitops-operator -git add --all -git commit -m "hi" -``` - -## 3) Compare using meld -`meld /tmp/compare/gitops-operator/test/openshift/e2e/ginkgo /tmp/compare/argocd-operator/tests/ginkgo` - -## 4) Generate patches for each repository - -``` -cd /tmp/compare/argocd-operator -git add --all -git commit -m "hi" -git diff HEAD~1 HEAD > /tmp/compare/argocd-operator/argocd-operator-patch.patch -``` -# If the patch file contains the removed imports, you likely forgot to `git add`/`git commit` in previous steps - -``` -cd /tmp/compare/gitops-operator -git add --all -git commit -m "hi" -git diff HEAD~1 HEAD > /tmp/compare/gitops-operator/gitops-operator-patch.patch -``` - -## 5) Apply patch to parent repository - -``` -cd "(gitops-operator repository you will use to commit patch)" -git apply /tmp/compare/gitops-operator/gitops-operator-patch.patch -``` - -``` -cd "(argocd-operator repository you will use to commit patch)" -git apply /tmp/compare/argocd-operator/argocd-operator-patch.patch -``` - -NOTE: If you see `patch does not apply` error, you can use `git apply --reject` instead, to apply only parts of the patch that succeed. Rejected patch segments will be stored with `.rej` file suffix, and can be manually applied. \ No newline at end of file diff --git a/argocd-operator/hack/sync-e2e-tests/go.mod b/argocd-operator/hack/sync-e2e-tests/go.mod deleted file mode 100644 index b5ac5da1fea..00000000000 --- a/argocd-operator/hack/sync-e2e-tests/go.mod +++ /dev/null @@ -1,7 +0,0 @@ -module github.com/argoproj-labs/sync-e2e-tests - -go 1.24.4 - -require ( - -) diff --git a/argocd-operator/hack/sync-e2e-tests/main.go b/argocd-operator/hack/sync-e2e-tests/main.go deleted file mode 100644 index c846b2cfdef..00000000000 --- a/argocd-operator/hack/sync-e2e-tests/main.go +++ /dev/null @@ -1,99 +0,0 @@ -package main - -import ( - "fmt" - "io/fs" - "os" - "path/filepath" - "strings" -) - -func main() { - - if len(os.Args) != 2 { - fmt.Println("args: (path to modify)") - return - } - - pathToModify := os.Args[1] - - err := filepath.WalkDir(pathToModify, func(path string, d fs.DirEntry, err error) error { - - if strings.Contains(path, "..") { - return fmt.Errorf("no path traversal") - } - - // Safety check: Avoid walking any absolute paths which do not contain either gitops-operator or argocd-operator - if !(strings.Contains(path, "gitops-operator") || strings.Contains(path, "argocd-operator")) { - return fmt.Errorf("unrecognized path") - } - - if !strings.HasPrefix(path, pathToModify) { - return fmt.Errorf("missing prefix") - } - - if d.IsDir() { - return nil - } - - if !strings.HasSuffix(path, ".go") { - return nil - } - - fmt.Println(path) - - if err := stripImportsFromFile(path); err != nil { - return err - } - - return nil - }) - - if err != nil { - fmt.Println(err) - return - } - -} - -func stripImportsFromFile(path string) error { - contents, err := os.ReadFile(path) - if err != nil { - fmt.Println(err) - return nil - } - - var newContents string - - importSeen := false - for _, line := range strings.Split(string(contents), "\n") { - - if strings.HasPrefix(line, "import (") { - newContents += line + "\n" - importSeen = true - continue - } else if importSeen && strings.HasPrefix(line, ")") { - - newContents += line + "\n" - importSeen = false - continue - } - - if importSeen { - - line = "" - - } else { - newContents += line + "\n" - } - } - - newContents = strings.TrimSuffix(newContents, "\n") - - if err := os.WriteFile(path, ([]byte)(newContents), 0600); err != nil { - fmt.Println("unable to write", path, err) - return err - } - - return nil -} From e815b517e953730a83e15912afc9ebf2e2e5567f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20Gond=C5=BEa?= Date: Wed, 4 Nov 2026 14:43:17 +0100 Subject: [PATCH 4/6] fix(gh-actions): Do not presist the creds after checkout MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Oliver Gondža --- .github/workflows/codegen.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/codegen.yaml b/.github/workflows/codegen.yaml index 95e6c19a7d6..518c2135cd6 100644 --- a/.github/workflows/codegen.yaml +++ b/.github/workflows/codegen.yaml @@ -95,6 +95,8 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v7 + with: + persist-credentials: false - name: Set up Go uses: actions/setup-go@v7 with: From 50ba20c967f7cbc648ed107bd5dba2ea0410fb74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20Gond=C5=BEa?= Date: Wed, 4 Nov 2026 19:56:56 +0100 Subject: [PATCH 5/6] feat: Restrict GITHUB_TOKEN for all workflows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Oliver Gondža --- .github/workflows/codegen.yaml | 3 +++ .github/workflows/kind-e2e-job.yaml | 3 +++ .github/workflows/openshift-ci-automation.yaml | 4 ++++ 3 files changed, 10 insertions(+) diff --git a/.github/workflows/codegen.yaml b/.github/workflows/codegen.yaml index 518c2135cd6..d94980defca 100644 --- a/.github/workflows/codegen.yaml +++ b/.github/workflows/codegen.yaml @@ -7,6 +7,9 @@ on: branches: - '*' +permissions: + contents: read + jobs: check-go-modules: name: "Check for go.mod/go.sum synchronicity" diff --git a/.github/workflows/kind-e2e-job.yaml b/.github/workflows/kind-e2e-job.yaml index 4e5c05e366c..576ebc9339a 100644 --- a/.github/workflows/kind-e2e-job.yaml +++ b/.github/workflows/kind-e2e-job.yaml @@ -12,6 +12,9 @@ env: IMG: gitops-operator:test LOG_DIR: /tmp/kind-ci-artifacts +permissions: + contents: read + jobs: ci-e2e: name: Run E2E tests (${{ inputs.test-type }}) on xKS diff --git a/.github/workflows/openshift-ci-automation.yaml b/.github/workflows/openshift-ci-automation.yaml index 99adb4491ef..862c2d5071c 100644 --- a/.github/workflows/openshift-ci-automation.yaml +++ b/.github/workflows/openshift-ci-automation.yaml @@ -1,6 +1,10 @@ name: Trigger openshift-ci automation on: create + +permissions: + contents: read + jobs: build: runs-on: ubuntu-latest From d0059890db02c83dc1c3836281ccc1454f3a5066 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20Gond=C5=BEa?= Date: Wed, 4 Nov 2026 22:18:24 +0100 Subject: [PATCH 6/6] Address gosec - was not previously analyzed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Oliver Gondža --- hack/update-dependencies-script/argocd/main.go | 4 ++-- hack/update-dependencies-script/utils/utils.go | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/hack/update-dependencies-script/argocd/main.go b/hack/update-dependencies-script/argocd/main.go index 9d6420b0439..bb4d8efb345 100644 --- a/hack/update-dependencies-script/argocd/main.go +++ b/hack/update-dependencies-script/argocd/main.go @@ -96,7 +96,7 @@ func readTargetVersionFromMakefile(operatorRoot string) string { fileToRead := filepath.Join(operatorRoot, "Makefile") - bytes, err := os.ReadFile(fileToRead) + bytes, err := os.ReadFile(fileToRead) // #nosec G304 -- File is read with a trusted source if err != nil { utils.ExitWithError(fmt.Errorf("unable to read %s: %v", fileToRead, err)) return "" @@ -172,7 +172,7 @@ func upgradeCommonDefaultsGo(argoCDRepoRoot string, argocdOperatorRoot string) ( // Parse install YAML fileToParse := filepath.Join(argoCDRepoRoot, "manifests/ha/install.yaml") - installYamlBytes, err := os.ReadFile(fileToParse) + installYamlBytes, err := os.ReadFile(fileToParse) // #nosec G304 -- File is read with a trusted source if err != nil { utils.ExitWithError(fmt.Errorf("unable to read Argo CD install yaml")) return nil, nil diff --git a/hack/update-dependencies-script/utils/utils.go b/hack/update-dependencies-script/utils/utils.go index 714f9a36718..5ba251de662 100644 --- a/hack/update-dependencies-script/utils/utils.go +++ b/hack/update-dependencies-script/utils/utils.go @@ -28,7 +28,7 @@ func RunCommandListWithWorkDir(workingDir string, commands [][]string) error { func RunCommandWithWorkDir(workingDir string, cmdList ...string) (string, string, error) { fmt.Printf("%v:\n", cmdList) - cmd := exec.Command(cmdList[0], cmdList[1:]...) + cmd := exec.Command(cmdList[0], cmdList[1:]...) // #nosec G204 -- Command is used with a trusted source var stdout bytes.Buffer var stderr bytes.Buffer cmd.Dir = workingDir @@ -91,13 +91,13 @@ func RemoveDuplicateLines(in []string) []string { } func CopyFile(srcParam, dstParam string) (err error) { - srcFile, err := os.Open(srcParam) + srcFile, err := os.Open(srcParam) // #nosec G304 -- File is opened with a trusted source if err != nil { return fmt.Errorf("could not open source file %s: %w", srcParam, err) } defer srcFile.Close() - destFile, err := os.Create(dstParam) + destFile, err := os.Create(dstParam) // #nosec G304 -- File is created with a trusted source if err != nil { return fmt.Errorf("could not create destination file %s: %w", dstParam, err) } @@ -132,7 +132,7 @@ func FileExists(filename string) (bool, error) { } func GetFileContentsAsLines(filePath string) []string { - bytes, err := os.ReadFile(filePath) + bytes, err := os.ReadFile(filePath) // #nosec G304 -- File is read with a trusted source if err != nil { ExitWithError(fmt.Errorf("unable to get "+filePath+": %v", err)) return nil