Upgrade makefile-modules and move to Go 1.27.1

.golangci.yaml

@@ -60,6 +60,7 @@ linters:
     - nilerr
     - nilnil
     - noctx
+    - nolintlint
     - nosprintfhostport
     - predeclared
     - promlinter

klone.yaml

@@ -10,55 +10,55 @@ targets:
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/generate-verify
     - folder_name: go
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/go
     - folder_name: helm
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/helm
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/help
     - folder_name: kind
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/kind
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/klone
     - folder_name: licenses
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/licenses
     - folder_name: oci-build
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/oci-build
     - folder_name: oci-publish
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/oci-publish
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: aef3f64fa51b7c1097eaa4102d325b0a08be938c
+      repo_hash: 3802a0061cb3bfd165e13e1d41c9d1b81f4665a0
       repo_path: modules/tools

make/_shared/go/.golangci.override.yaml

@@ -51,6 +51,7 @@ linters:
     - nilerr
     - nilnil
     - noctx
+    - nolintlint
     - nosprintfhostport
     - predeclared
     - promlinter

make/_shared/go/base/.github/workflows/govulncheck.yaml

@@ -20,7 +20,7 @@ jobs:
     if: github.repository == '{{REPLACE:GH-REPOSITORY}}'
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
@@ -30,7 +30,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

make/_shared/helm/helm.mk

@@ -44,6 +44,8 @@ helm_chart_sources := $(shell find $(helm_chart_source_dir) -maxdepth 1 -type f)
 helm_chart_archive := $(bin_dir)/scratch/helm/$(helm_chart_name)-$(helm_chart_version).tgz
 helm_digest_path := $(bin_dir)/scratch/helm/$(helm_chart_name)-$(helm_chart_version).digests
 helm_digest = $(shell head -1 $(helm_digest_path) 2> /dev/null)
+HELM_IGNORE_FIELDS ?= ^Pulled:|^Digest:|app.kubernetes.io/version|helm.sh/chart|chart:|appVersion:|managed-by:|meta.helm.sh/release-namespace
+helm_chart_old_version ?=
 
 $(bin_dir)/scratch/helm:
 	@mkdir -p $@
@@ -195,3 +197,19 @@ verify-helm-kubeconform: $(helm_chart_archive) | $(NEEDS_KUBECONFORM)
 		-strict
 
 shared_verify_targets_dirty += verify-helm-kubeconform
+
+## Diff the locally built Helm chart against a released version,
+## ignoring version-label noise. Set helm_chart_old_version to the
+## previously released chart version to compare against.
+## @category [shared] Helm Chart
+.PHONY: helm-diff
+helm-diff: $(helm_chart_archive) | $(NEEDS_HELM)
+	@if [ -z "$(helm_chart_old_version)" ]; then \
+		echo "Usage: make helm-diff helm_chart_old_version=<version>"; \
+		exit 1; \
+	fi
+	@$(HELM) show chart "oci://$(helm_chart_image_registry)$(helm_chart_name)" --version "$(helm_chart_old_version)" > /dev/null
+	@diff -u \
+		<($(HELM) template "oci://$(helm_chart_image_registry)$(helm_chart_name)" --version "$(helm_chart_old_version)" $(INSTALL_OPTIONS) | grep -vE -- '$(HELM_IGNORE_FIELDS)') \
+		<($(HELM) template "$(helm_chart_archive)" $(INSTALL_OPTIONS) | grep -vE -- '$(HELM_IGNORE_FIELDS)') \
+		|| [ $$? -eq 1 ]

make/_shared/kind/00_kind_image_versions.mk

@@ -15,16 +15,16 @@
 # This file is auto-generated by the learn_kind_images.sh script in the makefile-modules repo.
 # Do not edit manually.
 
-kind_image_kindversion := v0.32.0
+kind_image_kindversion := v0.33.0
 
-kind_image_kube_1.33_amd64 := docker.io/kindest/node:v1.33.12@sha256:c899edd3a9766ac69d5cccc9c8ee342e1920434a2d8eab0e02f461d36df96b41
-kind_image_kube_1.33_arm64 := docker.io/kindest/node:v1.33.12@sha256:0155d6fe15912ea2db47168aa91b2b1f880276a96dba320602d80ed3d1dd16dc
-kind_image_kube_1.34_amd64 := docker.io/kindest/node:v1.34.8@sha256:e9f9fd553828988bcae9c852223fb99f83380f251722a9313aa99f370bde7bfd
-kind_image_kube_1.34_arm64 := docker.io/kindest/node:v1.34.8@sha256:d413a5edd9be36fc8ea52529672fac7fdedb6708e84448b2029a37ad8e771c23
-kind_image_kube_1.35_amd64 := docker.io/kindest/node:v1.35.5@sha256:397bcc4ab091b9632fb3639d5cf020943ca40e90fe7bcc38409738a4a0d056ee
-kind_image_kube_1.35_arm64 := docker.io/kindest/node:v1.35.5@sha256:625f4633a546aba1e159ab56e52f9111b1b5044a165cc64ffe46d15d3dd0b0bf
-kind_image_kube_1.36_amd64 := docker.io/kindest/node:v1.36.1@sha256:21c46cf61fd45873f89e6a1bfcba4b7904dffa84c2bec88aeeca9a0409af4725
-kind_image_kube_1.36_arm64 := docker.io/kindest/node:v1.36.1@sha256:8d85371a247dc0fddce0d585d3de1ce40f2ee43f97fc0d0b6ee37b158771109e
+kind_image_kube_1.34_amd64 := docker.io/kindest/node:v1.34.11@sha256:c877abb73bf8c803233baa63e9629334aa153cf4b3e83c038f6bc76b82ea942e
+kind_image_kube_1.34_arm64 := docker.io/kindest/node:v1.34.11@sha256:2ddcf275136744ef219498fe56ffe858f7c5c6281fa7304d6298c5c75c8a9998
+kind_image_kube_1.35_amd64 := docker.io/kindest/node:v1.35.8@sha256:0c58cebbb66d7fa5fd497235dfae1e4e722ff84104e24a6f736ce8cd607cbe7c
+kind_image_kube_1.35_arm64 := docker.io/kindest/node:v1.35.8@sha256:b38a25576c835bfedc9d06368f87ec40863459a4d5dcbdbab2fd5f58ecf97466
+kind_image_kube_1.36_amd64 := docker.io/kindest/node:v1.36.4@sha256:597367624b4748b74b98e4fe2d661cd78063d02ecdaca702fd90572375b83e67
+kind_image_kube_1.36_arm64 := docker.io/kindest/node:v1.36.4@sha256:10210eabcf5dc4b585756bbd3f7fbb60cc0a12a252f28aeba269d93e0070c025
+kind_image_kube_1.37_amd64 := docker.io/kindest/node:v1.37.0@sha256:1aac8018c42eb5d48fae5be507caaee789fc6d9b9b3f560359dd4157ac00d4f6
+kind_image_kube_1.37_arm64 := docker.io/kindest/node:v1.37.0@sha256:6a3345f517a7df05185c648f83d18d464f2a94ea4a69eaee39b7e1de02611e59
 
-kind_image_latest_amd64 := $(kind_image_kube_1.36_amd64)
-kind_image_latest_arm64 := $(kind_image_kube_1.36_arm64)
+kind_image_latest_amd64 := $(kind_image_kube_1.37_amd64)
+kind_image_latest_arm64 := $(kind_image_kube_1.37_arm64)

make/_shared/oci-build/00_mod.mk

@@ -14,11 +14,11 @@
 
 # Use distroless as minimal base image to package the manager binary
 # To get latest SHA run "crane digest quay.io/jetstack/base-static:latest"
-base_image_static := quay.io/jetstack/base-static@sha256:fc47ae209bb67bc8433e61e75fbf3ed836772cc5a9f6d37990184c6eb9a011a3
+base_image_static := quay.io/jetstack/base-static@sha256:dc719ea428e9b88843862bd8de896bbe974088bc838d000a33f091a835744c33
 
 # Use custom apko-built image as minimal base image to package the manager binary
 # To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest"
-base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:70ddf94fe35edb4715744b278889b0465c1b3ef67a18c9d04fff09d6650af610
+base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:83a2ffc4266da49036b08fef76e8f424a76b12ab870a702231bb4132ae3dbb88
 
 # Utility functions
 fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set))

make/_shared/repository-base/01_mod.mk

@@ -24,13 +24,11 @@ repository_base_dir := $(_repository_base_module_dir)base/
 ## @category [shared] Generate/ Verify
 generate-base:
 	cp -r $(repository_base_dir)/. ./
-	cd $(repository_base_dir) && \
-		find . -type f | while read file; do \
-			sed "s|{{REPLACE:GH-REPOSITORY}}|$(repo_name:github.com/%=%)|g" "$$file" > "$(CURDIR)/$$file"; \
-		done
 	if [ ! -e ./.github/renovate.json5 ]; then \
 		mkdir -p ./.github; \
 		cp $(_repository_base_module_dir)/renovate-bootstrap-config.json5 ./.github/renovate.json5; \
 	fi
+	# TODO: Remove when all downstream repos are updated
+	rm -f ./.github/chainguard/make-self-upgrade.sts.yaml ./.github/workflows/make-self-upgrade.yaml
 
 shared_generate_targets += generate-base