Merge https://github.com/topolvm/topolvm:main (401772d) into main

.github/dependabot.yml

@@ -1,3 +1,4 @@
+# ref: https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 version: 2
 updates:
   - package-ecosystem: "github-actions"
@@ -6,6 +7,8 @@ updates:
     schedule:
       interval: "monthly"
     groups:
-      github-actions-update:
+      github-actions-updates:
         patterns:
           - "*"
+    cooldown:
+      default-days: 14

.github/workflows/build-images.yaml

@@ -40,11 +40,11 @@ jobs:
           sudo rm -rf /usr/share/dotnet
           sudo rm -rf /usr/local/lib/android
           df -h
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: Login registry
         if: ${{ inputs.push == 'true' }}
         run: echo ${{ secrets.GITHUB_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin

.github/workflows/create-chart-update-pr.yaml

@@ -10,6 +10,9 @@ on:
         description: chart version (e.g. 0.1.0)
         type: string
 
+permissions:
+  contents: write
+
 jobs:
   create-chart-update-pr:
     runs-on: "ubuntu-latest"
@@ -19,7 +22,7 @@ jobs:
           # The exit code will be 1 if the pattern is not found by grep.
           echo ${{ inputs.app-version }} | grep -E "^[0-9]+.[0-9]+.[0-9]+$"
           echo ${{ inputs.chart-version }} | grep -E "^[0-9]+.[0-9]+.[0-9]+$"
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Configure Git
@@ -41,7 +44,7 @@ jobs:
           sed -r -i "s/ghcr.io\/topolvm\/topolvm:[[:digit:]]+\.[[:digit:]]+\.[[:digit:]]+/ghcr.io\/topolvm\/topolvm:${{ inputs.app-version }}/g" charts/topolvm/Chart.yaml
           make install-helm-docs && make generate-helm-docs
       - name: Issue an access token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         id: app-token
         with:
           app-id: ${{ secrets.PROJECT_APP_ID }}

.github/workflows/e2e-k8s-incluster-lvmd.yaml

@@ -10,28 +10,32 @@ on:
       - "CODEOWNERS"
     branches:
       - "main"
+
+permissions:
+  contents: read
+
 jobs:
   e2e-k8s-incluster-lvmd:
     name: "e2e-k8s-incluster-lvmd"
     runs-on: "ubuntu-22.04"
     strategy:
       fail-fast: false
       matrix:
-        kubernetes_versions: ["1.34.3", "1.33.7", "1.32.11"]
+        kubernetes_versions: ["1.35.4", "1.34.3", "1.33.7"]
         test_lvmd_type: ["daemonset", "embedded"]
     env:
       KUBERNETES_VERSION: ${{ matrix.kubernetes_versions }}
       TEST_LVMD_TYPE: ${{ matrix.test_lvmd_type }}
       TEST_SCHEDULER_EXTENDER_TYPE: "none"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: cache e2e sidecar binaries
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: |
             test/e2e/tmpbin

.github/workflows/e2e-k8s-workflow.yaml

@@ -6,45 +6,33 @@ on:
       test_legacy:
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   e2e-k8s:
     name: "e2e-k8s"
     runs-on: "ubuntu-22.04"
     strategy:
       fail-fast: false
       matrix:
-        kubernetes_versions: ["1.34.3", "1.33.7", "1.32.11"]
+        kubernetes_versions: ["1.35.4", "1.34.3", "1.33.7"]
     env:
       KUBERNETES_VERSION: ${{ matrix.kubernetes_versions }}
       TEST_SCHEDULER_EXTENDER_TYPE: ${{ inputs.test_scheduler_extender_type }}
       TEST_LEGACY: ${{ inputs.test_legacy }}
     steps:
-      - id: check
-        run: |
-          KUBERNETES_MINOR=$(echo "${{ matrix.kubernetes_versions }}" | cut -d'.' -f2)
-          if [ "$KUBERNETES_MINOR" -le 32 ] && [ "$TEST_SCHEDULER_EXTENDER_TYPE" = "none" ]; then
-            echo "Skipping test for Kubernetes version ${{ matrix.kubernetes_versions }} with scheduler extender type 'none'"
-            echo "should_run=false" >> $GITHUB_OUTPUT
-          else
-            echo "should_run=true" >> $GITHUB_OUTPUT
-          fi
-      - if: steps.check.outputs.should_run == 'true'
-        uses: actions/checkout@v6
-      - if: steps.check.outputs.should_run == 'true'
-        uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
-      - if: steps.check.outputs.should_run == 'true'
-        uses: actions/cache/restore@v5
+      - uses: actions/cache/restore@v5.0.5
         with:
           path: |
             bin
             test/e2e/bin
             test/e2e/topolvm.img
           key: e2e-cache-${{ github.sha }}
-      - if: steps.check.outputs.should_run == 'true'
-        run: touch test/e2e/topolvm.img # update timestamp not to rebuild image
-      - if: steps.check.outputs.should_run == 'true'
-        run: make -C test/e2e start-lvmd
-      - if: steps.check.outputs.should_run == 'true'
-        run: make -C test/e2e test
+      - run: touch test/e2e/topolvm.img # update timestamp not to rebuild image
+      - run: make -C test/e2e start-lvmd
+      - run: make -C test/e2e test

.github/workflows/e2e-k8s.yaml

@@ -11,18 +11,21 @@ on:
     branches:
       - "main"
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: "ubuntu-22.04"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - name: cache e2e sidecar binaries
-        uses: actions/cache@v5
+        uses: actions/cache@v5.0.5
         with:
           path: |
             test/e2e/tmpbin
@@ -31,7 +34,7 @@ jobs:
             e2e-sidecars-
       - run: make -C test/e2e setup
       - run: make -C test/e2e topolvm.img
-      - uses: actions/cache/save@v5
+      - uses: actions/cache/save@v5.0.5
         with:
           path: |
             bin

.github/workflows/helm-release.yaml

@@ -2,12 +2,15 @@ name: "Release Charts"
 
 on: "workflow_dispatch"
 
+permissions:
+  contents: write
+
 jobs:
   release:
     runs-on: "ubuntu-latest"
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -19,7 +22,7 @@ jobs:
       # This version is written in `charts/topolvm/README.md`,
       # so do not update it if not necessary.
       - name: "Install Helm"
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@v5
         with:
           version: "v3.5.0"
 

.github/workflows/helm.yaml

@@ -6,18 +6,21 @@ on:
       - "charts/**"
       - "ct.yaml"
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: "ubuntu-22.04"
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: "Setup Go"
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
 

.github/workflows/main.yaml

@@ -4,19 +4,24 @@ on:
   push:
     branches:
       - "main"
+
+permissions:
+  contents: read
+
 jobs:
   build:
     name: "build"
     runs-on: "ubuntu-22.04"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - run: make setup
       - run: make check-uncommitted
+      - run: make test
       - run: make build-topolvm GOARCH=s390x
         name: "Build TopoLVM for s390x architecture"
       - run: make groupname-test
@@ -38,9 +43,9 @@ jobs:
           - "normal"
           - "with-sidecar"
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - run: make install-container-structure-test
       - run: make image-${{ matrix.image }}
       - run: make container-structure-test STRUCTURE_TEST_TARGET=${{ matrix.image }}
@@ -53,11 +58,11 @@ jobs:
       run:
         working-directory: "example"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - run: make setup
       - run: make run

.github/workflows/pr-labeled.yaml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [synchronize, opened, reopened, labeled, unlabeled]
 
+permissions: {}
+
 jobs:
   label-do-not-merge:
     runs-on: ubuntu-latest

.github/workflows/release.yaml

@@ -3,6 +3,11 @@ on:
   push:
     tags:
       - "v*"
+
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   prepare:
     name: "prepare"
@@ -44,12 +49,12 @@ jobs:
     needs: [prepare, build-images]
     runs-on: "ubuntu-22.04"
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6.4.0
         with:
           go-version-file: "go.mod"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
       - run: make build/lvmd TOPOLVM_VERSION=${{ needs.prepare.outputs.version }}
       - run: tar czf lvmd-${{ needs.prepare.outputs.version }}.tar.gz -C ./build lvmd
       - name: "Push branch tag"