Merge pull request #96 from ceph/devel

Sync upstream devel to downstream devel

.github/dependabot.yml

@@ -49,3 +49,13 @@ updates:
       - ci/skip/e2e
     commit-message:
       prefix: "rebase"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
+    rebase-strategy: disabled
+    labels:
+      - rebase
+      - ci/skip/e2e
+    commit-message:
+      prefix: rebase

.github/workflows/build-multi-stage.yaml

@@ -5,14 +5,23 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   codespell:
     name: multi-arch-build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: multi-arch-build
+        # yamllint disable-line rule:line-length
+        if: ${{ ! contains(github.event.pull_request.labels.*.name, 'ci/skip/multi-arch-build') }}
         # podman cannot pull images with both tag and digest
         # https://github.com/containers/buildah/issues/1407
         # use docker to build images
         run: CONTAINER_CMD=docker ./scripts/build-multi-arch-image.sh
+      - name: single-arch-build
+        # yamllint disable-line rule:line-length
+        if: ${{ contains(github.event.pull_request.labels.*.name, 'ci/skip/multi-arch-build') }}
+        run: make containerized-build

.github/workflows/codespell.yaml

@@ -7,11 +7,14 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   codespell:
     name: codespell
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: codespell
         run: CONTAINER_CMD=docker make containerized-test TARGET=codespell

.github/workflows/commitlint.yaml

@@ -5,13 +5,16 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   commitlint:
     name: commitlint
     if: ${{ github.actor != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: commitlint

.github/workflows/dependency-review.yaml

@@ -0,0 +1,20 @@
+---
+name: 'Dependency Review'
+# yamllint disable-line rule:truthy
+on:
+  pull_request:
+    branches:
+      - '*'
+
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Checkout Repository'
+        uses: actions/checkout@v3
+      - name: 'Dependency Review'
+        uses: actions/dependency-review-action@v1

.github/workflows/go-test.yaml

@@ -5,18 +5,21 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   go-test:
     name: go-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: go-test
         run: CONTAINER_CMD=docker make containerized-test TARGET=go-test
   go-test-api:
     name: go-test-api
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: go-test-api
         run: CONTAINER_CMD=docker make containerized-test TARGET=go-test-api

.github/workflows/golangci-lint.yaml

@@ -5,11 +5,14 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   golangci-lint:
     name: golangci-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: golangci-lint
         run: CONTAINER_CMD=docker make containerized-test TARGET=go-lint

.github/workflows/lint-extras.yaml

@@ -5,11 +5,14 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   lint-extras:
     name: lint-extras
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: lint-extras
         run: CONTAINER_CMD=docker make containerized-test TARGET=lint-extras

.github/workflows/mod-check.yaml

@@ -5,11 +5,14 @@ on:
   pull_request:
     branches:
       - '*'
+permissions:
+  contents: read
+
 jobs:
   mod-check:
     name: mod-check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - name: mod-check
         run: CONTAINER_CMD=docker make containerized-test TARGET=mod-check

.github/workflows/publish-artifacts.yaml

@@ -9,16 +9,19 @@ on:
       - devel
       # Push events to branches matching refs/heads/release-v*
       - 'release-v*'
+permissions:
+  contents: read
+
 jobs:
   push:
     name: Publish artifacts
     runs-on: ubuntu-latest
     if: github.repository == 'ceph/ceph-csi'
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Login to Quay
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_IO_USERNAME }}

.github/workflows/retest.yaml

@@ -5,6 +5,10 @@ on:
   schedule:
     # Run the retest action every 30 minutes
     - cron: "30 * * * *"
+
+permissions:
+  contents: read
+
 jobs:
   retest:
     runs-on: ubuntu-latest

.github/workflows/stale.yaml

@@ -7,12 +7,18 @@ on:
     # Run the stalebot every day at 9pm UTC
     - cron: "00 21 * * *"
 # yamllint disable rule:line-length
+permissions:
+  contents: read
+
 jobs:
   stale:
+    permissions:
+      issues: write  # for actions/stale to close stale issues
+      pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-18.04
     if: github.repository == 'ceph/ceph-csi'
     steps:
-      - uses: actions/stale@v3
+      - uses: actions/stale@v5
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-issue-stale: 30

.github/workflows/test-retest-action.yaml

@@ -5,11 +5,14 @@ on:
   pull_request:
     branches: [devel]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Docker build
         # Run cd to avoid loading complete cephcsi directory in docker context