[Reliability] Harden operator reconciliation and deployment workflows

.github/actions/checks/action.yml

@@ -12,32 +12,22 @@ runs:
     - name: pre_env
       uses: ./.github/actions/dev_env
 
-    - name: check_license_header
-      uses: apache/skywalking-eyes/header@v0.6.0
-      env:
-        GITHUB_TOKEN: ${{ inputs.github_token }}
-      with:
-        log: info
-        config: .licenserc.yml
-
-    - name: setup go version
-      uses: actions/setup-go@v3
-      with:
-        check-latest: true
-        go-version:
-          ${{ env.golang-version }}
-
     - name: verify
       shell: bash
       run: make verify
 
-    # disable action cache due to https://github.com/golangci/golangci-lint-action/issues/244
-    # upgrade due to https://github.com/golangci/golangci-lint/issues/2374
-    # skip cache due to https://github.com/golangci/golangci-lint-action/issues/23
     - name: golangci_lint
-      uses: golangci/golangci-lint-action@v3.1.0
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # tag=v9.3.0
       with:
-        version: v1.50.0
+        version: v2.1.6
         args: --timeout 10m0s
-        skip-pkg-cache: true
-        skip-build-cache: true
+
+    # The header action installs its own Go toolchain while building license-eye,
+    # so keep it last to avoid changing the toolchain used by repository checks.
+    - name: check_license_header
+      uses: apache/skywalking-eyes/header@a196742f472feaffafea537ce5a2a4c3c53a8de4 # tag=v0.9.0
+      env:
+        GITHUB_TOKEN: ${{ inputs.github_token }}
+      with:
+        log: info
+        config: .licenserc.yml

.github/actions/dev_env/action.yml

@@ -6,12 +6,14 @@ runs:
 
   steps:
     - name: import env variables
+      id: versions
       shell: bash
-      run: cat ".github/env" >> $GITHUB_ENV
+      run: |
+        cat ".github/env" >> "$GITHUB_ENV"
+        sed -n 's/^golang-version=/go_version=/p' ".github/env" >> "$GITHUB_OUTPUT"
 
     - name: setup go version
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # tag=v7.0.0
       with:
-        check-latest: true
-        go-version:
-          ${{ env.golang-version }}
+        check-latest: false
+        go-version: ${{ steps.versions.outputs.go_version }}

.github/actions/e2e/action.yml

@@ -13,14 +13,14 @@ runs:
       uses: ./.github/actions/dev_env
 
     - name: setup helm
-      uses: azure/setup-helm@v1
+      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # tag=v5.0.1
       with:
         version: '${{ env.helm-version }}'
 
     - name: setup kind
-      uses: engineerd/setup-kind@v0.5.0
+      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # tag=v1.14.0
       with:
-        skipClusterCreation: true
+        install_only: true
         version: v0.15.0
 
     - name: Run kind test

.github/env

@@ -1,4 +1,4 @@
-golang-version=1.22
+golang-version=1.23.1
 kind-version=v0.11.1
 kind-image=kindest/node:v1.23.0
 helm-version=v3.8.1

.github/workflows/compatibility.yml

@@ -10,7 +10,7 @@ on:
         default: '["0.8.0", "1.0.0-rc1"]'
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event-name }}
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:
@@ -21,7 +21,7 @@ jobs:
       matrix:
         moVersion: ${{ fromJSON(github.event.inputs.moVersions)}}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
     - name: run
       uses: ./.github/actions/e2e
       with:

.github/workflows/merge.yml

@@ -8,10 +8,10 @@ jobs:
   add_labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-ecosystem/action-add-labels@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
+      - uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # tag=v1.1.3
         if: ${{ startsWith(github.event.comment.body, '/merge') }}
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           labels: |
-            can-merge
+            can-merge

.github/workflows/release_chart.yml

@@ -18,12 +18,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
         with:
           fetch-depth: 0
 
       - name: Install Helm
-        uses: azure/setup-helm@f382f75448129b3be48f8121b9857be18d815a82 # tag=v3.4
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # tag=v5.0.1
 
       - name: Configure Git
         run: |
@@ -32,13 +32,10 @@ jobs:
 
       - name: Package charts
         run: |
-          mkdir -p charts/matrixone-operator/charts .cr-release-packages .cr-index
+          mkdir -p .cr-release-packages .cr-index
           helm package charts/kruise \
-            --destination charts/matrixone-operator/charts
-          helm package charts/kruise \
-            --destination .cr-release-packages
-          helm package charts/matrixone-operator \
             --destination .cr-release-packages
+          ./hack/package-chart.sh .cr-release-packages
 
       - name: Run Artifact Hub lint
         run: |
@@ -47,7 +44,7 @@ jobs:
           rm -f ./ah
 
       - name: Install chart-releaser
-        uses: helm/chart-releaser-action@98bccfd32b0f76149d188912ac8e45ddd3f8695f # tag=v1.4.1
+        uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # tag=v1.7.0
         with:
           install_only: true
         env:

.github/workflows/release_image.yml

@@ -14,12 +14,12 @@ jobs:
     name: push_image
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
         with:
           fetch-depth: 0
 
       - name: Docker meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # tag=v6.2.0
         id: meta
         with:
           images: |
@@ -31,42 +31,42 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@master
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # tag=v4.3.0
         with:
           image: tonistiigi/binfmt:latest
           platforms: linux/amd64,linux/arm64
 
       - name: Set up Docker Buildx
         id: buildx
-        uses:  docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # tag=v4.3.0
 
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # tag=v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to Alicloud Container Registry
         id: login_alicr
-        uses: docker/login-action@v2
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # tag=v4.6.0
         with:
           registry: registry.cn-hangzhou.aliyuncs.com
           username: ${{ secrets.ACR_USERNAME }}
           password: ${{ secrets.ACR_TOKEN }}
 
       - name: Go Build Cache for Docker
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # tag=v4.3.0
         with:
           path: go-build-cache
           key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
 
       - name: inject go-build-cache into docker
-        uses: reproducible-containers/buildkit-cache-dance@v3.1.0
+        uses: reproducible-containers/buildkit-cache-dance@5b81f4d29dc8397a7d341dba3aeecc7ec54d6361 # tag=v3.3.0
         with:
           cache-source: go-build-cache
 
       - name: Build
-        uses: docker/build-push-action@v2
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # tag=v7.3.0
         env:
           # Alicloud ACR rejects the provenance attestation manifest that buildx
           # attaches by default since BuildKit v0.11 ("unknown manifest class for

.github/workflows/test_workflows.yml

@@ -6,15 +6,15 @@ on:
       - main
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event-name }}
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
   cancel-in-progress: true
 
 jobs:
   checks:
     name: checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
       - uses: ./.github/actions/checks
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -23,7 +23,7 @@ jobs:
     name: e2e
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # tag=v7.0.1
       - name: run
         uses: ./.github/actions/e2e
         with:

.gitignore

@@ -19,5 +19,10 @@ charts/matrixone-operator/charts/
 *.tgz
 e2e*.xml
 e2e.test
-docs/troubleshooting/
-docs/draft
+# Operational troubleshooting documents are versioned as reviewed, top-level
+# Markdown files. Ignore evidence, logs, tools, and other generated subtrees by
+# default so environment data cannot be committed accidentally.
+docs/troubleshooting/*
+!docs/troubleshooting/*.md
+docs/troubleshooting/*.draft.md
+docs/draft/

.golangci.yml

@@ -1,42 +1,47 @@
+version: "2"
 run:
-  timeout: 30m
-  go: '1.21'
-  skip-files:
-    - "^zz_generated.*"
-
-output:
-  sort-results: true
-
+  go: "1.23"
 linters:
-  disable-all: true
+  default: none
   enable:
     - revive
-
-issues:
-  exclude-rules:
-    - path: _test\.go
-      linters:
-        - errcheck
-
-linters-settings:
-  staticcheck:
-    go: "1.19"
-    checks: [
-      "all",
-      "-S1*",
-      "-ST1*",
-      "-SA5011",
-      "-SA1019",
-      "-SA2002"
-    ]
-
-  revive:
+  settings:
+    revive:
+      rules:
+        - name: unused-parameter
+          arguments:
+            - allowRegex: ^_
+          severity: warning
+          disabled: false
+    staticcheck:
+      checks:
+        - all
+        - -S1*
+        - -SA1019
+        - -SA2002
+        - -SA5011
+        - -ST1*
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
     rules:
-    - name: unused-parameter
-      severity: warning
-      disabled: false
-      arguments:
-      - allowRegex: "^_"
-
-  unused:
-    go: "1.19"
+      - linters:
+          - errcheck
+        path: _test\.go
+    paths:
+      - ^zz_generated.*
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - ^zz_generated.*
+      - third_party$
+      - builtin$
+      - examples$