From 6ce25bfb2f3aaa544330702d10d776e0e0eca99b Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Wed, 9 Sep 2026 10:12:30 -0400 Subject: [PATCH 1/3] chore(deps): Upgrade golang to 1.26.7 Co-Authored-By: Claude Opus 4.8 (1M context) (cherry picked from commit 7d3992d27ba67f5e46a02cab4c86aca05bd8901b in release-v0.7 branch PR) --- .tool-versions | 2 +- Dockerfile | 2 +- Dockerfile.dist | 2 +- acceptance/go.mod | 2 +- go.mod | 2 +- tools/go.mod | 2 +- tools/kubectl/go.mod | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.tool-versions b/.tool-versions index 5bc54b156..93fe5c1b5 100644 --- a/.tool-versions +++ b/.tool-versions @@ -1 +1 @@ -golang 1.26.4 +golang 1.26.7 diff --git a/Dockerfile b/Dockerfile index fc546e1a0..0c3832f68 100644 --- a/Dockerfile +++ b/Dockerfile @@ -16,7 +16,7 @@ ## Build -FROM docker.io/library/golang:1.26.4 AS build +FROM docker.io/library/golang:1.26.7 AS build ARG TARGETOS ARG TARGETARCH diff --git a/Dockerfile.dist b/Dockerfile.dist index 8c36cd910..ba372dd2e 100644 --- a/Dockerfile.dist +++ b/Dockerfile.dist @@ -16,7 +16,7 @@ ## Build -FROM registry.access.redhat.com/ubi9/go-toolset:1.26.4@sha256:9748bb0b8e3376e9b155a4db3fbdfbfd20057b449ea9b3aed367b2f967cdfe1b AS build +FROM registry.access.redhat.com/ubi9/go-toolset:1.26.7@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21 AS build ARG TARGETOS ARG TARGETARCH diff --git a/acceptance/go.mod b/acceptance/go.mod index 9e7b24964..e853ca10e 100644 --- a/acceptance/go.mod +++ b/acceptance/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/acceptance -go 1.26.4 +go 1.26.7 require ( cuelang.org/go v0.16.0 diff --git a/go.mod b/go.mod index ef0333bc6..70b4f7a2c 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli -go 1.26.4 +go 1.26.7 require ( cuelang.org/go v0.16.0 diff --git a/tools/go.mod b/tools/go.mod index 8ecf623a8..807aaace0 100644 --- a/tools/go.mod +++ b/tools/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/tools -go 1.26.4 +go 1.26.7 require ( github.com/daixiang0/gci v0.13.7 diff --git a/tools/kubectl/go.mod b/tools/kubectl/go.mod index ef8d834b4..08efeb217 100644 --- a/tools/kubectl/go.mod +++ b/tools/kubectl/go.mod @@ -1,6 +1,6 @@ module github.com/conforma/cli/tools/kubectl -go 1.26.4 +go 1.26.7 require k8s.io/kubernetes v1.34.2 From 7bc9c9acf53f6e19e60a5962c514882c4d067054 Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Wed, 9 Sep 2026 11:29:42 -0400 Subject: [PATCH 2/3] ci: Pin GitHub Actions to commit SHAs Pin all remaining unpinned actions per stricter GitHub policies: - conforma/github-workflows auto-merge and golang-version-check pinned to e049ae95 (main) - jlumbroso/free-disk-space pinned to 54081f13 (v1.3.1) - conforma/pr-size-label-action pinned to 8b1fcdb8 (v1.0.0) Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/auto-merge.yaml | 2 +- .github/workflows/checks-codecov.yaml | 2 +- .github/workflows/label-pr-size.yaml | 2 +- .github/workflows/release.yaml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml index bd7ad08cf..ea19c33d8 100644 --- a/.github/workflows/auto-merge.yaml +++ b/.github/workflows/auto-merge.yaml @@ -22,7 +22,7 @@ name: 'Auto merge' jobs: auto-merge: - uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@main + uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@e049ae95d6a78c4665e88efa667981184394e913 # main secrets: inherit permissions: pull-requests: write diff --git a/.github/workflows/checks-codecov.yaml b/.github/workflows/checks-codecov.yaml index dab13ed36..074f73033 100644 --- a/.github/workflows/checks-codecov.yaml +++ b/.github/workflows/checks-codecov.yaml @@ -61,7 +61,7 @@ jobs: cache: false - name: Check go versions - uses: conforma/github-workflows/golang-version-check@main + uses: conforma/github-workflows/golang-version-check@e049ae95d6a78c4665e88efa667981184394e913 # main - name: Show git sha and commit subject run: git log --oneline -n1 diff --git a/.github/workflows/label-pr-size.yaml b/.github/workflows/label-pr-size.yaml index 9df05b5cd..bf922d28f 100644 --- a/.github/workflows/label-pr-size.yaml +++ b/.github/workflows/label-pr-size.yaml @@ -29,4 +29,4 @@ jobs: runs-on: ubuntu-latest steps: - name: Label PR by size - uses: conforma/pr-size-label-action@v1.0.0 + uses: conforma/pr-size-label-action@8b1fcdb87ab3ef4b79f9708fedf686904375e2d3 # v1.0.0 diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 0be9e971b..a06ec9087 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -73,7 +73,7 @@ jobs: # disable-telemetry: true - name: Free Disk Space (Ubuntu) - uses: jlumbroso/free-disk-space@main + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 with: docker-images: false swap-storage: false From 240c71709865d4159ab25e43179d8092e6776e96 Mon Sep 17 00:00:00 2001 From: Simon Baird Date: Wed, 9 Sep 2026 12:21:51 -0400 Subject: [PATCH 3/3] Pin acceptance test release-v0.8 policy repo ref It's a long story, but the policy repo release branches are not meant to be "real" branches. They're more like tags, and they were created to provide a stable compatible reference for RHTAP. Recently some renovate PRs were merged in the release-v0.8 branch, so the git sha has moved, causing the snapshot data to no longer match. As a workaround to get my PR green, I'm using a git sha in the policy.yaml (rather than changing the snapshot data to the new git ref). --- features/ta_task_validate_image.feature | 8 +++---- features/task_validate_image.feature | 32 ++++++++++++------------- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/features/ta_task_validate_image.feature b/features/ta_task_validate_image.feature index 37f31e5ec..b0e5337c3 100644 --- a/features/ta_task_validate_image.feature +++ b/features/ta_task_validate_image.feature @@ -25,8 +25,8 @@ Feature: Verify Conforma Trusted Artifact Tekton Task "sources": [ { "policy": [ - "git::github.com/conforma/policy//policy/release?ref=release-v0.8", - "git::github.com/conforma/policy//policy/lib?ref=release-v0.8" + "git::github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "git::github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -65,7 +65,7 @@ Feature: Verify Conforma Trusted Artifact Tekton Task When version 0.1 of the task named "verify-conforma-konflux-ta" is run with parameters: | SNAPSHOT_FILENAME | snapshotartifact | | SOURCE_DATA_ARTIFACT | oci:${REGISTRY}/acceptance/snapshotartifact@${BUILD_SNAPSHOT_DIGEST} | - | POLICY_CONFIGURATION | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=release-v0.8","git::github.com/conforma/policy//policy/lib?ref=release-v0.8"],"config":{"include":["slsa_provenance_available"]}}]} | + | POLICY_CONFIGURATION | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a","git::github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"],"config":{"include":["slsa_provenance_available"]}}]} | | STRICT | true | | IGNORE_REKOR | true | | ENABLE_VSA | true | @@ -90,7 +90,7 @@ Feature: Verify Conforma Trusted Artifact Tekton Task When version 0.1 of the task named "verify-conforma-konflux-ta" is run with parameters: | SNAPSHOT_FILENAME | snapshotartifact | | SOURCE_DATA_ARTIFACT | oci:${REGISTRY}/acceptance/snapshotartifact@${BUILD_SNAPSHOT_DIGEST} | - | POLICY_CONFIGURATION | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=release-v0.8","git::github.com/conforma/policy//policy/lib?ref=release-v0.8"],"config":{"include":["slsa_provenance_available"]}}]} | + | POLICY_CONFIGURATION | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a","git::github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"],"config":{"include":["slsa_provenance_available"]}}]} | | STRICT | true | | IGNORE_REKOR | true | | TRUSTED_ARTIFACTS_DEBUG | "true" | diff --git a/features/task_validate_image.feature b/features/task_validate_image.feature index 73b11e2e3..8e7722157 100644 --- a/features/task_validate_image.feature +++ b/features/task_validate_image.feature @@ -16,8 +16,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -47,8 +47,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -78,8 +78,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -110,8 +110,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -147,8 +147,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -182,8 +182,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -356,8 +356,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [ @@ -389,8 +389,8 @@ Feature: Verify Enterprise Contract Tekton Tasks "sources": [ { "policy": [ - "github.com/conforma/policy//policy/release?ref=release-v0.8", - "github.com/conforma/policy//policy/lib?ref=release-v0.8" + "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a", + "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a" ], "config": { "include": [