Merge branch 'main' of github.com:distribution/distribution

Author: AaronDewes

.github/labeler.yml

@@ -53,6 +53,10 @@ area/storage/s3:
   - changed-files:
     - any-glob-to-any-file:
       - registry/storage/driver/s3-aws/**
+area/client:
+  - changed-files:
+    - any-glob-to-any-file:
+      - internal/client/**
 dependencies:
   - changed-files:
     - any-glob-to-any-file:

.github/workflows/build.yml

@@ -32,28 +32,31 @@ jobs:
       fail-fast: false
       matrix:
         go:
-          - 1.23.7
-          - 1.24.1
+          - 1.25.x
+          - 1.26.2
         target:
           - test-coverage
           - test-s3-storage
           - test-azure-storage
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       -
         name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: ${{ matrix.go }}
+          cache: false
       -
         name: Test
         run: |
           make ${{ matrix.target }}
       -
         name: Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           directory: ./
 
@@ -68,13 +71,14 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6
         with:
           images: |
             ${{ env.GHCR_SLUG }}
@@ -99,19 +103,19 @@ jobs:
             org.opencontainers.image.description=The toolkit to pack, ship, store, and distribute container content
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       -
         name: Log in to GitHub Container registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v3
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          password: ${{ github.token }}
       -
         name: Build artifacts
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           source: .
           targets: artifact-all
@@ -133,14 +137,14 @@ jobs:
           tree -nh ./bin
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: registry
           path: ./bin/*
           if-no-files-found: error
       -
         name: Build image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           source: .
           files: |
@@ -150,7 +154,7 @@ jobs:
           push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
       -
         name: GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         if: startsWith(github.ref, 'refs/tags/')
         with:
           draft: true
@@ -159,4 +163,4 @@ jobs:
             bin/*.provenance.json
             bin/*.sha256
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}

.github/workflows/codeql-analysis.yml

@@ -34,22 +34,23 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 2
+          persist-credentials: false
       -
         name: Checkout HEAD on PR
         if: ${{ github.event_name == 'pull_request' }}
         run: |
           git checkout HEAD^2
       -
         name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.26.5
+        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
         with:
           languages: ${{ matrix.language }}
       -
         name: Autobuild
-        uses: github/codeql-action/autobuild@v3.26.5
+        uses: github/codeql-action/autobuild@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
       -
         name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.26.5
+        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0

.github/workflows/conformance.yml

@@ -17,7 +17,7 @@ jobs:
     steps:
       -
         name: Build image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: image-local
       -
@@ -30,7 +30,7 @@ jobs:
           docker run --rm -p 5000:5000 -e REGISTRY_STORAGE_DELETE_ENABLED=true -idt "registry:local"
       -
         name: Run OCI Distribution Spec conformance tests
-        uses: opencontainers/distribution-spec@v1.0.1
+        uses: opencontainers/distribution-spec@10efb871ee08eb13678fe275e2cf89b3df86542b # v1.0.1
         env:
           OCI_ROOT_URL: ${{ env.OCI_ROOT_URL }}
           OCI_NAMESPACE: oci-conformance/distribution-test
@@ -44,7 +44,7 @@ jobs:
         run: mkdir -p out/ && mv {report.html,junit.xml} out/
       -
         name: Upload test results
-        uses: actions/upload-artifact@v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: oci-test-results-${{ github.sha }}
           path: out/

.github/workflows/docs.yml

@@ -25,13 +25,13 @@ jobs:
     steps:
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Build docs
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           targets: docs-export
           provenance: false
@@ -46,7 +46,7 @@ jobs:
           done
 
       - name: Upload Pages artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./build/docs
 
@@ -71,4 +71,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4 # or the latest "vX.X.X" version tag for this action
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

.github/workflows/e2e.yml

@@ -20,12 +20,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       -
         name: Build image
-        uses: docker/bake-action@v6
+        uses: docker/bake-action@6614cfa25eff9a0b2b2697efb0b6159e7680d584 # v7.2.0
         with:
           source: .
           targets: image-local
@@ -43,9 +44,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       -
         name: Start E2E environment
         run: |

.github/workflows/label.yaml

@@ -5,15 +5,18 @@ concurrency:
   cancel-in-progress: true
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] does not checkout, safe to use pull_request_target
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
 
 jobs:
   labeler:
     permissions:
-      contents: read
-      pull-requests: write
+      contents: read       # same as global permission
+      pull-requests: write # required for writing labels
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/labeler@v5
-      with:
-        dot: true
+      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        with:
+          dot: true

.github/workflows/validate.yml

@@ -30,7 +30,9 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       -
         name: Run
         run: |

.golangci.yml

@@ -1,27 +1,32 @@
-linters:
+version: "2"
+
+formatters:
   enable:
-    - staticcheck
-    - unconvert
     - gofmt
     - goimports
-    - revive
-    - ineffassign
-    - govet
-    - unused
-    - misspell
+
+linters:
+  enable:
     - bodyclose
+    - misspell
     - prealloc
-    - errcheck
+    - revive
+    - staticcheck
     - tparallel
+    - unconvert
 
-linters-settings:
-  revive:
-    rules:
-      # TODO(thaJeztah): temporarily disabled the "unused-parameter" check.
-      # It produces many warnings, and some of those may need to be looked at.
-      - name: unused-parameter
-        disabled: true
+  disable:
+    - errcheck
 
-issues:
-  exclude-dirs:
-    - vendor
+  settings:
+    revive:
+      rules:
+        # TODO(thaJeztah): temporarily disabled the "unused-parameter" check.
+        # It produces many warnings, and some of those may need to be looked at.
+        - name: unused-parameter
+          disabled: true
+    staticcheck:
+      checks:
+        - all
+        - -QF1008 # Omit embedded fields from selector expression; https://staticcheck.dev/docs/checks/#QF1008
+        - -ST1000 # Incorrect or missing package comment; https://staticcheck.dev/docs/checks/#ST1000

ADOPTERS.md

@@ -9,3 +9,5 @@ Harbor, CNCF Graduated project https://goharbor.io/
 VMware Harbor Registry https://docs.pivotal.io/partners/vmware-harbor/index.html
 
 DigitalOcean Container Registry https://www.digitalocean.com/products/container-registry/
+
+Cloudfleet Container Registry https://cloudfleet.ai/docs/container-registry/overview/