merge latest upstream main

.github/renovate.json5

@@ -5,8 +5,8 @@
   ],
   'pip-compile': {
     enabled: true,
-    fileMatch: [
-      '(^|/)requirements\\.txt$',
+    managerFilePatterns: [
+      '/(^|/)requirements\\.txt$/',
     ],
   },
   pip_requirements: {
@@ -16,8 +16,8 @@
     python: '~=3.11.0',
   },
   kubernetes: {
-    fileMatch: [
-      '\\.yaml$',
+    managerFilePatterns: [
+      '/\\.yaml$/',
     ],
     ignorePaths: [
       'release/**',

.github/terraform/main.tf

@@ -32,7 +32,7 @@ terraform {
 # Enable Google Cloud APIs.
 module "enable_google_apis" {
   source                      = "terraform-google-modules/project-factory/google//modules/project_services"
-  version                     = "~> 17.0"
+  version                     = "~> 18.0"
   disable_services_on_destroy = false
   activate_apis = [
     "cloudresourcemanager.googleapis.com",

.github/terraform/versions.tf

@@ -19,7 +19,7 @@ terraform {
   required_providers {
     google = {
       source  = "hashicorp/google"
-      version = "~> 6.0"
+      version = "~> 7.0"
     }
   }
 }

.github/workflows/ci-main.yaml

@@ -31,15 +31,15 @@ jobs:
   code-tests:
     runs-on: [self-hosted, is-enabled]
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-dotnet@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-dotnet@v5
       env:
         DOTNET_INSTALL_DIR: "./.dotnet"
       with:
-        dotnet-version: '9.0'
-    - uses: actions/setup-go@v5
+        dotnet-version: '10.0'
+    - uses: actions/setup-go@v6
       with:
-        go-version: '1.23'
+        go-version: '1.26'
     - name: Go Unit Tests
       timeout-minutes: 10
       run: |
@@ -61,14 +61,14 @@ jobs:
         profile: ["local-code"]
       fail-fast: true
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
     - name: Build + Deploy PR images to GKE
       timeout-minutes: 20
       run: |
         PR_NUMBER=$(echo $GITHUB_REF | awk 'BEGIN { FS = "/" } ; { print $3 }')
         NAMESPACE="pr${PR_NUMBER}"
-        echo "::set-env name=NAMESPACE::$NAMESPACE"
-        echo "::set-env name=PR_NUMBER::$PR_NUMBER"
+        echo "NAMESPACE=$NAMESPACE" >> $GITHUB_ENV
+        echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
 
         yes | gcloud auth configure-docker us-docker.pkg.dev
         gcloud container clusters get-credentials $PR_CLUSTER --region $REGION --project $PROJECT_ID
@@ -82,7 +82,6 @@ jobs:
         skaffold config set --global local-cluster false
         skaffold run --default-repo=us-docker.pkg.dev/$PROJECT_ID/$GITHUB_REF --tag=$GITHUB_SHA --namespace=$NAMESPACE -p network-policies
       env:
-        ACTIONS_ALLOW_UNSECURE_COMMANDS: true
         PROJECT_ID: "online-boutique-ci"
         PR_CLUSTER: "prs-gke-cluster"
         REGION: "us-central1"

.github/workflows/ci-pr.yaml

@@ -35,15 +35,15 @@ jobs:
   code-tests:
     runs-on: [self-hosted, is-enabled]
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-dotnet@v4
+    - uses: actions/checkout@v6
+    - uses: actions/setup-dotnet@v5
       env:
         DOTNET_INSTALL_DIR: "./.dotnet"
       with:
-        dotnet-version: '9.0'
-    - uses: actions/setup-go@v5
+        dotnet-version: '10.0'
+    - uses: actions/setup-go@v6
       with:
-        go-version: '1.23'
+        go-version: '1.26'
     - name: Go Unit Tests
       timeout-minutes: 10
       run: |
@@ -66,14 +66,14 @@ jobs:
         profile: ["local-code"]
       fail-fast: true
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
       with:
         ref: ${{github.event.pull_request.head.sha}}
     - name: Build + Deploy PR images to GKE
       timeout-minutes: 20
       run: |
         NAMESPACE="pr${PR_NUMBER}"
-        echo "::set-env name=NAMESPACE::$NAMESPACE"
+        echo "NAMESPACE=$NAMESPACE" >> $GITHUB_ENV
 
         yes | gcloud auth configure-docker us-docker.pkg.dev
         gcloud container clusters get-credentials $PR_CLUSTER --region $REGION --project $PROJECT_ID
@@ -87,7 +87,6 @@ jobs:
         skaffold config set --global local-cluster false
         skaffold run --default-repo=us-docker.pkg.dev/$PROJECT_ID/refs/pull/$PR_NUMBER --tag=$PR_NUMBER --namespace=$NAMESPACE -p network-policies
       env:
-        ACTIONS_ALLOW_UNSECURE_COMMANDS: true
         PR_NUMBER: ${{ github.event.pull_request.number }}
         PROJECT_ID: "online-boutique-ci"
         PR_CLUSTER: "prs-gke-cluster"
@@ -122,9 +121,8 @@ jobs:
         sleep 3
         done
         EXTERNAL_IP=$(get_externalIP)
-        echo "::set-env name=EXTERNAL_IP::$EXTERNAL_IP"
+        echo "EXTERNAL_IP=$EXTERNAL_IP" >> $GITHUB_ENV
       env:
-        ACTIONS_ALLOW_UNSECURE_COMMANDS: true
         PR_NUMBER: ${{ github.event.pull_request.number }}
     - name: Smoke Test
       timeout-minutes: 5

.github/workflows/helm-chart-ci.yaml

@@ -28,7 +28,7 @@ jobs:
   helm-chart-ci:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: helm lint
         run: |
           cd helm-chart/

.github/workflows/install-dependencies.sh

@@ -30,16 +30,16 @@ sudo chown root:root /etc/apt/sources.list.d/microsoft-prod.list
 
 sudo apt-get install -y apt-transport-https && \
 sudo apt-get update && \
-sudo apt-get install -y dotnet-sdk-8.0
+sudo apt-get install -y dotnet-sdk-10.0
 echo "✅ dotnet installed"
 
 # install kubectl
 sudo apt-get install -yqq kubectl git
 echo "✅ kubectl installed"
 
 # install go
-wget https://golang.org/dl/go1.19.linux-amd64.tar.gz
-sudo tar -C /usr/local -xzf go1.19.linux-amd64.tar.gz
+wget https://golang.org/dl/go1.25.linux-amd64.tar.gz
+sudo tar -C /usr/local -xzf go1.25.linux-amd64.tar.gz
 echo 'export GOPATH=$HOME/go' >> ~/.profile
 echo 'export PATH=$PATH:/usr/local/go/bin:$GOPATH/bin' >> ~/.profile
 source ~/.profile

.github/workflows/kubevious-manifests-ci.yaml

@@ -33,24 +33,24 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Validate kubernetes-manifests
         id: kubernetes-manifests-validation
-        uses: kubevious/cli@v1.0.62
+        uses: kubevious/cli@v1.0.64
         with:
           manifests: kubernetes-manifests
           skip_rules: container-latest-image
 
       - name: Validate helm-chart
         id: helm-chart-validation
-        uses: kubevious/cli@v1.0.62
+        uses: kubevious/cli@v1.0.64
         with:
           manifests: helm-chart
 
       - name: Validate kustomize
         id: kustomize-validation
-        uses: kubevious/cli@v1.0.62
+        uses: kubevious/cli@v1.0.64
         with:
           manifests: kustomize
           skip_rules: container-latest-image

.github/workflows/kustomize-build-ci.yaml

@@ -28,7 +28,7 @@ jobs:
   kustomize-build-ci:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: kustomize build base
         run: |
           cd kustomize/

.github/workflows/terraform-validate-ci.yaml

@@ -28,8 +28,8 @@ jobs:
   terraform-validate-ci:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v4
-      - uses: hashicorp/setup-terraform@v3
+      - uses: actions/checkout@v6
+      - uses: hashicorp/setup-terraform@v4
       - name: terraform init & validate
         run: |
           cd terraform/

README.md

@@ -140,6 +140,8 @@ Find **Protocol Buffers Descriptions** at the [`./protos` directory](/protos).
 
 ## Demos featuring Online Boutique
 
+- [Security hardening of the OnlineBoutique sample apps with the Docker Hardened Images (DHI)](https://medium.com/google-cloud/security-hardening-of-the-onlineboutique-sample-apps-with-docker-hardened-images-dhi-ca1fad348343)
+- [alpine, distroless or scratch?](https://medium.com/google-cloud/alpine-distroless-or-scratch-caac35250e0b)
 - [Platform Engineering in action: Deploy the Online Boutique sample apps with Score and Humanitec](https://medium.com/p/d99101001e69)
 - [The new Kubernetes Gateway API with Istio and Anthos Service Mesh (ASM)](https://medium.com/p/9d64c7009cd)
 - [Use Azure Redis Cache with the Online Boutique sample on AKS](https://medium.com/p/981bd98b53f8)
@@ -164,3 +166,4 @@ Find **Protocol Buffers Descriptions** at the [`./protos` directory](/protos).
   - [Introduction to Service Management with Istio](https://www.youtube.com/watch?v=wCJrdKdD6UM&feature=youtu.be&t=586)
 - [Google Cloud Next'18 London – Keynote](https://youtu.be/nIq2pkNcfEI?t=3071)
   showing Stackdriver Incident Response Management
+- [Microservices demo showcasing Go Micro](https://github.com/go-micro/demo)

cloudbuild.yaml

@@ -27,7 +27,7 @@
 
 steps:
 - id: 'Deploy application to cluster'
-  name: 'gcr.io/k8s-skaffold/skaffold:v2.13.2'
+  name: 'gcr.io/k8s-skaffold/skaffold:v2.16.1'
   entrypoint: 'bash'
   args:
   - '-c'

docs/adding-new-microservice.md

@@ -0,0 +1,61 @@
+# Adding a new microservice
+
+This document outlines the steps required to add a new microservice to the Online Boutique application.
+
+## 1. Create a new directory
+
+Create a new directory for your microservice within the `src/` directory. The directory name should be the name of your microservice.
+
+## 2. Add source code
+
+Place your microservice's source code inside the newly created directory. The structure of this directory should follow the conventions of the existing microservices. For example, a Python-based service would include at minimum the following files:
+
+- `README.md`: The service's description and documentation.
+- `main.py`: The application's entry point.
+- `requirements.in`: A list of Python dependencies.
+- `Dockerfile`: To containerize the application.
+
+Take a look at existing microservices for inspiration.
+
+## 3. Create a Dockerfile
+
+Create a `Dockerfile` in your microservice's directory. This file will define the steps to build a container image for your service.
+
+Refer to this example and tweak based on your new service's needs: https://github.com/GoogleCloudPlatform/microservices-demo/blob/main/src/frontend/Dockerfile
+
+## 4. Create Kubernetes manifests
+
+Create a new directory under `kustomize/components/` in the root of the repository for your microservice. Inside this directory, add the necessary Kubernetes YAML files for your new microservice. This typically includes:
+
+- A **Deployment** to manage your service's pods.
+- A **Service** to expose your microservice to other services within the cluster.
+
+Ensure you follow the existing naming conventions and that the container image specified in the Deployment matches the one built by your `cloudbuild.yaml` and `skaffold.yaml` files.
+
+Refer to this example and tweak based on your new service's needs: https://github.com/GoogleCloudPlatform/microservices-demo/tree/main/kustomize/components/shopping-assistant
+
+## 5. Update the root `kustomization.yaml` file
+
+Add your newly created component to the root kustomization file so it gets picked up by the deployment cycle.
+
+The file is available here: https://github.com/GoogleCloudPlatform/microservices-demo/blob/main/kustomize/kustomization.yaml
+
+## 6. Update the root `skaffold.yaml`
+
+Add your newly created service to the root skaffold file so the images build correctly.
+
+The file is available here: https://github.com/GoogleCloudPlatform/microservices-demo/blob/main/skaffold.yaml
+
+## 7. Update the Helm chart
+
+Add your newly created service to the Helm chart templates and default values.
+
+The chart is available here: https://github.com/GoogleCloudPlatform/microservices-demo/tree/main/helm-chart
+
+## 8. Update the documentation
+
+Finally, update the project's documentation to reflect the addition of your new microservice. This may include:
+
+- Adding a section to the main `README.md` if the service introduces significant new functionality.
+- Updating the architecture diagrams in the `docs/img` directory.
+- Adding a new document in the `docs` directory if the service requires detailed explanation.

docs/development-guide.md

@@ -54,14 +54,19 @@ This doc explains how to build and run the Online Boutique source code locally u
     gcloud auth configure-docker -q 
     ```
 
-3.  In the root of this repository, run `skaffold run --default-repo=us-docker.pkg.dev/[PROJECT_ID]/microservices-demo`,
-    where [PROJECT_ID] is your GCP project ID.
+3.  In the root of this repository, run:
+
+    ```
+    skaffold run --default-repo=us-docker.pkg.dev/PROJECT_ID/microservices-demo
+    ```
+
+    Where `PROJECT_ID` is replaced by your Google Cloud project ID.
 
     This command:
 
-    - builds the container images
-    - pushes them to AR
-    - applies the `./kubernetes-manifests` deploying the application to
+    - Builds the container images.
+    - Pushes them to AR.
+    - Applies the `./kubernetes-manifests` deploying the application to
       Kubernetes.
 
     **Troubleshooting:** If you get "No space left on device" error on Google
@@ -114,6 +119,11 @@ This doc explains how to build and run the Online Boutique source code locally u
 
 6. Navigate to `localhost:8080` to access the web frontend.
 
+## Adding a new microservice
+
+In general, the set of core microservices for Online Boutique is fairly complete and unlikely to change in the future, but it can be useful to add an additional optional microservice that can be deployed to complement the core services.
+
+See the [Adding a new microservice](adding-new-microservice.md) guide for instructions on how to add a new microservice.
 
 ## Cleanup
 

docs/releasing/license_header.txt

@@ -1,4 +1,4 @@
-# Copyright 2018 Google LLC
+# Copyright 2025 Google LLC
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.

helm-chart/Chart.yaml

@@ -29,10 +29,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.10.2
+version: 0.10.5
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v0.10.2"
+appVersion: "v0.10.5"

helm-chart/templates/adservice.yaml

@@ -55,11 +55,11 @@ spec:
         runAsGroup: 1000
         runAsNonRoot: true
         runAsUser: 1000
-      {{- end }}
         {{- if .Values.seccompProfile.enable }}
         seccompProfile:
           type: {{ .Values.seccompProfile.type }}
         {{- end }}
+      {{- end }}
       containers:
       - name: server
         securityContext:

helm-chart/templates/cartservice.yaml

@@ -237,11 +237,11 @@ spec:
         runAsGroup: 1000
         runAsNonRoot: true
         runAsUser: 1000
-      {{- end }}
         {{- if .Values.seccompProfile.enable }}
         seccompProfile:
           type: {{ .Values.seccompProfile.type }}
         {{- end }}
+      {{- end }}
       containers:
       - name: redis
         securityContext:
@@ -252,7 +252,7 @@ spec:
           privileged: false
           readOnlyRootFilesystem: true
         {{- if .Values.cartDatabase.inClusterRedis.publicRepository }}
-        image: redis:alpine@sha256:de13e74e14b98eb96bdf886791ae47686c3c5d29f9d5f85ea55206843e3fce26
+        image: redis:alpine@sha256:c5e375abb885e6b2021c0377879e4890bf76f9065b8922ffc113f2b226b9fc17
         {{- else }}
         image: {{ .Values.images.repository }}/redis:alpine
         {{- end }}