Skip to content

Commit b6b0d8a

Browse files
myasnikovdaniilmyasnikovdaniil
committed
Merge remote-tracking branch 'origin/main' into feat/vap-deletion-protection
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com> # Conflicts: # packages/core/platform/images/migrations/migrations/40 # packages/core/platform/values.yaml
2 parents cc107fe + 1810263 commit b6b0d8a

116 files changed

Lines changed: 6640 additions & 11477 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/pre-commit.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
4848
- name: Install generate
4949
run: |
50-
curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.3.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
50+
curl -sSL https://github.com/cozystack/cozyvalues-gen/releases/download/v1.4.0/cozyvalues-gen-linux-amd64.tar.gz | tar -xzvf- -C /usr/local/bin/ cozyvalues-gen
5151
5252
- name: Run pre-commit hooks
5353
run: |

‎.github/workflows/pull-requests.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,7 @@ jobs:
163163
permissions:
164164
contents: read
165165
packages: read
166+
checks: write
166167
needs: ["build", "resolve_assets"]
167168
if: ${{ always() && (needs.build.result == 'success' || needs.resolve_assets.result == 'success') }}
168169

@@ -313,6 +314,55 @@ jobs:
313314
name: image-list
314315
path: /tmp/${{ env.SANDBOX_NAME }}/_out/images.txt
315316

317+
# ▸ Open an SSH breakpoint to the failing sandbox so maintainers can attach,
318+
# inspect Talos/Cozystack state and resume with `breakpoint resume`.
319+
#
320+
# Gated by the `debug` or `release` label (release PRs are bot-created,
321+
# so their presence implies maintainer authorship). authorized-users is
322+
# kept as a second defense layer at the breakpoint level.
323+
#
324+
# Uses cozystack/breakpoint-action (fork of namespacelabs/breakpoint-action)
325+
# pinned by SHA. The fork adds: pause-idle mode (initial grace period for
326+
# the first SSH connection, idle-aware exit afterwards), endpoint output
327+
# and ::notice:: annotation, and a dedicated Check Run "Breakpoint Open"
328+
# that carries the SSH endpoint in output.summary while the breakpoint is
329+
# paused (conclusion=failure → standard ✗ in `gh pr checks`; updated to
330+
# conclusion=success when the breakpoint exits).
331+
#
332+
# Configured via the BREAKPOINT_ENDPOINT repository variable — in fork
333+
# PRs repository variables are not exposed, so the step is skipped and
334+
# forks cannot reach the self-hosted rendezvous server.
335+
- name: Breakpoint on E2E failure
336+
if: |
337+
failure() &&
338+
vars.BREAKPOINT_ENDPOINT != '' &&
339+
(contains(github.event.pull_request.labels.*.name, 'debug')
340+
|| contains(github.event.pull_request.labels.*.name, 'release'))
341+
# cozystack/breakpoint-action v2-cozy.1
342+
# mode: pause-idle defaults: grace-period=20m, idle-timeout=10m
343+
uses: cozystack/breakpoint-action@a6f3a6f87be398ad63b6577351e3398e53f578e4
344+
with:
345+
mode: pause-idle
346+
endpoint: ${{ vars.BREAKPOINT_ENDPOINT }}
347+
authorized-users: androndo, Arsolitt, IvanHunters, kvaps, lexfrei, lllamnyp, mattia-eleuteri, matthieu-robin, myasnikovdaniil, sircthulhu, tym83
348+
check-run-name: "Breakpoint Open"
349+
github-token: ${{ github.token }}
350+
check-run-summary-template: |
351+
## 🔴 SSH breakpoint open — paused for debug
352+
353+
```
354+
{endpoint}
355+
```
356+
357+
Enter the e2e sandbox after SSH:
358+
```
359+
docker exec -ti $(docker ps --filter name=cozy-e2e-sandbox -q | head -1) bash
360+
export KUBECONFIG=/workspace/kubeconfig
361+
```
362+
363+
Resume from inside: `breakpoint resume`. Otherwise the breakpoint
364+
exits 10 minutes after the last SSH session disconnects.
365+
316366
# ▸ Tear down environment (always runs)
317367
- name: Tear down sandbox
318368
if: always()

‎.github/workflows/scorecard.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: OpenSSF Scorecard
2+
3+
on:
4+
branch_protection_rule:
5+
schedule:
6+
# Run weekly on Mondays at 06:00 UTC.
7+
- cron: '0 6 * * 1'
8+
push:
9+
branches: [main]
10+
workflow_dispatch:
11+
12+
# Declare default permissions as read-only.
13+
permissions: read-all
14+
15+
jobs:
16+
analysis:
17+
name: Scorecard analysis
18+
runs-on: ubuntu-latest
19+
permissions:
20+
# Needed to upload the results to the GitHub code-scanning dashboard.
21+
security-events: write
22+
# Needed to publish results to the public scorecard.dev API
23+
# (OIDC token allows publish without storing long-lived credentials).
24+
id-token: write
25+
# Needed to read repository contents.
26+
contents: read
27+
# Needed to read workflow definitions for the Dangerous-Workflow check.
28+
actions: read
29+
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
33+
with:
34+
persist-credentials: false
35+
36+
- name: Run analysis
37+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
38+
with:
39+
results_file: results.sarif
40+
results_format: sarif
41+
# Publish the results to the OpenSSF Scorecard public API so the
42+
# project appears at https://scorecard.dev/viewer/?uri=github.com/cozystack/cozystack
43+
publish_results: true
44+
45+
- name: Upload SARIF as artifact
46+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
47+
with:
48+
name: scorecard-sarif
49+
path: results.sarif
50+
retention-days: 5
51+
52+
- name: Upload SARIF to code-scanning
53+
uses: github/codeql-action/upload-sarif@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3
54+
with:
55+
sarif_file: results.sarif

‎.github/workflows/tags.yaml‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -246,6 +246,8 @@ jobs:
246246
contents: write
247247
pull-requests: write
248248
if: needs.prepare-release.result == 'success'
249+
# Non-blocking: failure here must not prevent update-website-docs from running.
250+
continue-on-error: true
249251
steps:
250252
- name: Generate GitHub App token
251253
id: app-token
@@ -445,7 +447,9 @@ jobs:
445447
name: Update Website Docs
446448
runs-on: [self-hosted]
447449
needs: [generate-changelog, prepare-release]
448-
if: needs.generate-changelog.result == 'success' && needs.prepare-release.outputs.skip != 'true'
450+
# generate-changelog is non-blocking — run as long as prepare-release succeeded.
451+
# `always()` is needed so this job runs even if generate-changelog failed/skipped.
452+
if: always() && needs.prepare-release.result == 'success' && needs.prepare-release.outputs.skip != 'true'
449453
permissions:
450454
contents: read
451455
steps:
@@ -530,7 +534,7 @@ jobs:
530534
run: |
531535
git config user.name "cozystack-ci[bot]"
532536
git config user.email "274107086+cozystack-ci[bot]@users.noreply.github.com"
533-
git add content hugo.yaml
537+
git add content hugo.yaml data/versions
534538
if git diff --cached --quiet; then
535539
echo "No changes to commit"
536540
echo "changed=false" >> $GITHUB_OUTPUT

‎.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,3 +84,12 @@ tmp/
8484
# build revision marker (generated by make image-packages)
8585
packages/core/platform/.build-revision
8686
.claude/
87+
88+
# Credentials and runtime state minted by the backup/restore demo scripts
89+
# under examples/backups/*/. Files are written by 00-helpers.sh +
90+
# 02-create-bucket.sh + 04-create-backupjob.sh; cleanup.sh deletes them
91+
# on teardown. Keep them out of git so a tenant who runs the demo and
92+
# then `git add .` does not accidentally commit S3 keys.
93+
examples/backups/*/.bucket-info.env
94+
examples/backups/*/.sentinel.env
95+
examples/backups/*/.backup-name.env

‎CONTRIBUTOR_LADDER.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,5 +147,22 @@ If and when contributors' commitment levels change, contributors can consider st
147147

148148
Contact the Maintainers about changing to Emeritus status, or reducing your contributor level.
149149

150+
### How the Emeritus transition is recorded
151+
152+
1. A pull request is opened against `MAINTAINERS.md` that moves the maintainer's row from the `Active Maintainers` section to the `Emeritus Maintainers` section. The PR is opened by the maintainer stepping down or, if they have already become unresponsive, by another maintainer with their prior notification.
153+
2. The PR is reviewed under the standard rules in this document — for a voluntary transition, acknowledgement by at least one other maintainer is sufficient; for involuntary transitions, the majority vote described in [Involuntary Removal or Demotion](#involuntary-removal-or-demotion) applies.
154+
3. After the PR is merged, the project performs the following technical offboarding within five business days:
155+
- Removes the user from any GitHub team that grants write or admin permissions on project repositories (currently the `engineering` team in the `cozystack` GitHub organization).
156+
- Downgrades GitHub organization role from `admin` (Owner) to `member`, unless the user explicitly remains an organization admin in another capacity.
157+
- Removes any direct repository-collaborator entries that granted elevated permissions beyond default organization membership.
158+
- Updates `CODEOWNERS` if the user appeared there.
159+
- Audits repository and organization Actions secrets; rotates any shared credentials that the user could have known (for example, registry tokens, CI bot keys, organization-level App private keys).
160+
- Updates internal communication channels (private maintainer rooms, calendar invites) as appropriate. Emeritus maintainers remain welcome in public community channels.
161+
4. The Emeritus maintainer keeps default organization membership unless they ask to be removed. Their contribution history, commit attributions, and credits in past release notes are preserved unchanged.
162+
163+
### Returning to active status
164+
165+
An Emeritus maintainer who wishes to return to active maintainership opens a pull request moving their row back to the `Active Maintainers` section, with an updated affiliation if needed. The reactivation is treated like a new maintainer addition under [Becoming a Maintainer](#contributor-ladder) — the same review and approval flow applies. Past contributions count toward the new application; the contributor does not need to re-prove the full ladder.
166+
150167
## Contact
151168
* For inquiries, please reach out to: @kvaps, @tym83

‎MAINTAINERS.md‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,23 @@
11
# The Cozystack Maintainers
22

3+
## Active Maintainers
4+
35
| Maintainer | GitHub Username | Company | Responsibility |
46
| ---------- | --------------- | ------- | --------------------------------- |
57
| Andrei Kvapil | [@kvaps](https://github.com/kvaps) | Ænix | Core Maintainer |
6-
| George Gaál | [@gecube](https://github.com/gecube) | Ænix | DevOps Practices in Platform, Developers Advocate |
8+
| George Gaál | [@gecube](https://github.com/gecube) | Independent | DevOps Practices in Platform, Developers Advocate |
79
| Kingdon Barrett | [@kingdonb](https://github.com/kingdonb) | Urmanac | FluxCD and flux-operator |
8-
| Timofei Larkin | [@lllamnyp](https://github.com/lllamnyp) | 3commas | Etcd-operator Lead |
9-
| Artem Bortnikov | [@aobort](https://github.com/aobort) | Timescale | Etcd-operator Lead |
10+
| Timofei Larkin | [@lllamnyp](https://github.com/lllamnyp) | Ænix | Core Maintainer |
1011
| Timur Tukaev | [@tym83](https://github.com/tym83) | Ænix | Cozystack Website, Marketing, Community Management |
11-
| Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) | Ænix | Core Maintainer |
12-
| Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Ænix | Maintainer of ARM and stuff |
12+
| Nikita Bykov | [@nbykov0](https://github.com/nbykov0) | Independent | Maintainer of ARM and stuff |
1313
| Matthieu Robin | [@matthieu-robin](https://github.com/matthieu-robin) | Hidora | Managed Applications, Platform Quality & Benchmarking |
1414
| Mattia Eleuteri | [@mattia-eleuteri](https://github.com/mattia-eleuteri) | Hidora | CSI, Storage, Networking & Security |
15+
16+
## Emeritus Maintainers
17+
18+
We thank the following former maintainers for their contributions to Cozystack.
19+
20+
| Maintainer | GitHub Username |
21+
| ---------- | --------------- |
22+
| Artem Bortnikov | [@aobort](https://github.com/aobort) |
23+
| Kirill Klinchenkov | [@klinch0](https://github.com/klinch0) |

‎api/apps/v1alpha1/postgresql/types.go‎

Lines changed: 3 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/apps/v1alpha1/postgresql/zz_generated.deepcopy.go‎

Lines changed: 2 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)