Align go repository

.github/dependabot.yaml

@@ -3,17 +3,36 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
-    # Group all GitHub Action updates into a single PR, ignoring minor/patch
-    # this seems to be the most pragmatic approach for this repo, given that
-    # we only have a single workflow so far.
+      interval: "weekly"
+      day: "monday"
     groups:
-      github-actions:
-        applies-to: version-updates
+      actions:
         patterns:
           - "*"
-    ignore:
-      - dependency-name: "*"
-        update-types: ["version-update:semver-minor", "version-update:semver-patch"]
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      k8s:
+        patterns:
+          - "k8s.io/*"
+          - "sigs.k8s.io/*"
+      all-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
     cooldown:
       default-days: 7

.github/workflows/ccm-integration-tests.yml

@@ -18,61 +18,7 @@ on:
 permissions:
   contents: read
 
-env:
-  GO_VERSION: 1.25
-
 jobs:
-  lint:
-    name: "Run Linters"
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: '${{ env.GO_VERSION }}'
-
-      - name: Restore cache
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.cache/golangci-lint
-            ~/.cache/go-build
-          key: lint-${{ hashFiles('go.mod') }}
-
-      - name: Install go tools
-        run: go mod tidy -modfile tool.mod
-
-      - name: Run Linter
-        run: make lint
-
-      - name: Save cache
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.cache/golangci-lint
-            ~/.cache/go-build
-          key: lint-${{ hashFiles('go.mod') }}
-
-  unit:
-    name: "Run Unit Tests"
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version: '${{ env.GO_VERSION }}'
-
-      - name: Run Unit Tests
-        run: make test
-
   test-matrix:
     name: "Get Kubernetes Releases"
     runs-on: ubuntu-latest
@@ -102,7 +48,14 @@ jobs:
         run: 'helpers/image-from-ref >> $GITHUB_ENV'
 
       - name: Build image
-        run: 'docker build --platform=linux/amd64 --tag "$IMAGE" .'
+        run: |
+          docker build \
+            --platform=linux/amd64 \
+            --tag "$IMAGE" \
+            --build-arg=VERSION=v0.0.0-integration \
+            --build-arg=GIT_COMMIT=${{ github.sha }} \
+            --build-arg=BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') \
+            .
 
       - name: Export image
         run: 'docker image save "$IMAGE" -o image.tar'
@@ -151,8 +104,6 @@ jobs:
     runs-on: ubuntu-latest
 
     needs:
-      - lint
-      - unit
       - test-matrix
       - build-image
       - check-ccm-integration
@@ -171,6 +122,8 @@ jobs:
       SUBNET: '${{ matrix.subnet }}'
       CLUSTER_PREFIX: '${{ matrix.cluster_prefix }}'
       IMAGE_SOURCE: import
+      CONTROL_COUNT: 1
+      WORKER_COUNT: 2
 
     # Prevent integration tests from running in parallel. Ideally this should
     # be seuqential, but that won't work due to the following issue:
@@ -197,7 +150,7 @@ jobs:
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: '${{ env.GO_VERSION }}'
+          go-version-file: go.mod
 
       - name: Evaluate image name
         run: 'helpers/image-from-ref >> $GITHUB_ENV'
@@ -209,37 +162,28 @@ jobs:
       - name: Create Test Cluster
         run: helpers/run-in-test-cluster
 
-      - name: Wait For CCM Startup
-        run: sleep 60
-
       - name: Run Integration Tests
         run: make integration
 
+      - name: Collect Debug Information
+        if: failure()
+        run: |
+          export KUBECONFIG=k8test/cluster/admin.conf
+          helpers/debug-ccm "k8s-${{ matrix.kubernetes }}-run-${{ github.run_id }}" _artifacts
+
+      - name: Upload Debug Artifacts
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: debug-k8s-${{ matrix.kubernetes }}-run-${{ github.run_id }}
+          path: _artifacts/
+          retention-days: 14d
+          if-no-files-found: ignore
+
       - name: Wait For Kubernetes-Internal Cleanup
         if: always()
         run: sleep 30
 
       - name: Destroy Test Cluster
         if: always()
         run: helpers/cleanup
-
-  validate-workflows:
-    name: Validate GitHub Workflows
-    runs-on: ubuntu-latest
-
-    # More Information:
-    # https://github.com/zizmorcore/zizmor-action?tab=readme-ov-file#usage-with-github-advanced-security-recommended
-    #
-    # Use `uvx zizmor .github/` for a local preview using the latest zizmor version.
-
-    permissions:
-      contents: read
-      security-events: write
-
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0

.github/workflows/govulncheck.yml

@@ -0,0 +1,30 @@
+name: govulncheck
+
+permissions: {}
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 6 * * 1'
+
+jobs:
+  govulncheck:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run govulncheck
+        run: make govulncheck

.github/workflows/lint.yml

@@ -0,0 +1,29 @@
+name: Lint
+
+permissions: {}
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    permissions:
+      contents: read
+    name: Run on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Run linter
+        run: make lint