Merge https://github.com/IBM-Cloud/cloud-provider-ibm:release-1.35

.github/scripts/kube-update.sh

@@ -0,0 +1,105 @@
+#!/bin/bash
+# ******************************************************************************
+# IBM Cloud Kubernetes Service, 5737-D43
+# (C) Copyright IBM Corp. 2025 All Rights Reserved.
+#
+# SPDX-License-Identifier: Apache2.0
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ******************************************************************************
+set -e
+set -x
+
+K8S_CURRENT_VERSION=$(grep "^TAG " Makefile | awk '{ print $3 }')
+if [[ -z "${K8S_CURRENT_VERSION}" ]]; then
+	echo "FAIL: Unable to determine current Kubernetes version in Makefile."
+	exit 1
+fi
+
+# Trim alpha/beta tag off of current release
+K8S_SHORT_VERSION=${K8S_CURRENT_VERSION%-*}
+MAJOR_MINOR=${K8S_SHORT_VERSION%.*}
+
+# Verify TAG from Makefile matches git branch (first run on new release)
+GIT_BRANCH=$(git branch --show-current)
+BRANCH_MAJOR_MINOR="v${GIT_BRANCH#"release-"}"
+if [[ "${MAJOR_MINOR}" != "${BRANCH_MAJOR_MINOR}" ]]; then
+	MAJOR_MINOR=${BRANCH_MAJOR_MINOR}
+fi
+
+K8S_RELEASE_FILE="/tmp/kube-releases.txt"
+if [[ ! -f "${K8S_RELEASE_FILE}" ]]; then
+	curl -L --fail --retry 3 --retry-delay 5 -o $K8S_RELEASE_FILE https://api.github.com/repos/kubernetes/kubernetes/releases
+fi
+
+K8S_TAGS_FILE="/tmp/kube-tags.txt"
+if [[ ! -f "${K8S_TAGS_FILE}" ]]; then
+	curl -L --fail --retry 3 --retry-delay 5 -o $K8S_TAGS_FILE https://api.github.com/repos/kubernetes/kubernetes/tags
+fi
+
+K8S_UPDATE_VERSION=$(cat $K8S_RELEASE_FILE | jq -r ".[].name" | grep "$MAJOR_MINOR" | head -1 | sed 's/^Kubernetes //g')
+MOD_VERSION=$(go mod download -json "k8s.io/api@kubernetes-${K8S_UPDATE_VERSION#v}" | jq -r .Version)
+if [[ -z "${K8S_UPDATE_VERSION}" ]]; then
+	echo "FAIL: Failed to retrieve the kubernetes release, attempt to retrieve the git tag"
+	K8S_UPDATE_VERSION=$(cat $K8S_TAGS_FILE | jq -r ".[].name" | grep "$MAJOR_MINOR" | head -1)
+	MOD_VERSION=$(go mod download -json "k8s.io/api@kubernetes-${K8S_UPDATE_VERSION#v}" | jq -r .Version)
+fi
+if [[ -z "${K8S_UPDATE_VERSION}" ]]; then
+	echo "FAIL: Failed to retrieve latest kubernetes version."
+	exit 1
+fi
+if [[ "${K8S_UPDATE_VERSION}" == "${K8S_CURRENT_VERSION}" ]]; then
+	echo "INFO: No new version available, exiting gracefully"
+	exit 0
+fi
+# Ensure the go modules have also been updated. i.e. k8s.io/api v0.20.3
+if [[ "${MOD_VERSION}" != "v0.${K8S_UPDATE_VERSION#*.}" ]]; then
+	echo "INFO: New go modules are not available, exiting gracefully"
+	exit 0
+fi
+# Ensure that an update for this Kubernetes release was not already started
+if git ls-remote --exit-code --heads "origin" "$K8S_UPDATE_VERSION" >/dev/null; then
+	echo "INFO: Branch $K8S_UPDATE_VERSION has already been created, exiting gracefully"
+	exit 0
+fi
+
+echo "INFO: Starting Kubernetes update from version ${K8S_CURRENT_VERSION} to ${K8S_UPDATE_VERSION} ..."
+
+# Update files that contain the Kubernetes version
+FILES_WITH_K8S_VERSION="ibm/ibm_version.go main.go Makefile README.md"
+for FILE_TO_UPDATE in $FILES_WITH_K8S_VERSION; do
+	sed -i -e "s/${K8S_CURRENT_VERSION}/${K8S_UPDATE_VERSION}/g" "${FILE_TO_UPDATE}"
+	echo "INFO: Updated Kubernetes version in ${FILE_TO_UPDATE}"
+done
+
+# Determine the current and update golang version.
+GO_CURRENT_VERSION=$(grep '^go ' go.mod | awk '{ print $2 }')
+K8S_DIRECTORY="/tmp/kubernetes"
+git clone --filter=blob:none --depth=1 --sparse -b "${K8S_UPDATE_VERSION}" https://github.com/kubernetes/kubernetes.git ${K8S_DIRECTORY}
+git -C ${K8S_DIRECTORY} sparse-checkout add build
+GO_UPDATE_VERSION=$(grep -A 1 "name: \"golang: upstream version" "${K8S_DIRECTORY}/build/dependencies.yaml" | grep "version:" | awk '{ print $2 }')
+echo "INFO: Updated Go version: ${GO_UPDATE_VERSION}"
+rm -rf "${K8S_DIRECTORY}"
+
+if [[ "${GO_CURRENT_VERSION}" != "${GO_UPDATE_VERSION}" ]]; then
+	# Make sure new GO version is newer than the current GO version
+	EARLIER_GO_VERSION=$(printf "%s\n" "${GO_CURRENT_VERSION}" "${GO_UPDATE_VERSION}" | sort -V | head -1)
+	if [[ "${EARLIER_GO_VERSION}" == "${GO_CURRENT_VERSION}" ]]; then
+		sed -i -e "s/go ${GO_CURRENT_VERSION}/go ${GO_UPDATE_VERSION}/g" go.mod
+		go mod tidy
+		echo "INFO: Updated Go version in go.mod from ${GO_CURRENT_VERSION} to ${GO_UPDATE_VERSION}"
+	fi
+fi
+
+echo "SUCCESS: Completed Kubernetes update from version ${K8S_CURRENT_VERSION} to ${K8S_UPDATE_VERSION}."
+exit 0

.github/workflows/actionLint.yml

@@ -0,0 +1,29 @@
+# This workflow will run actionLint against github workflows
+
+name: GitHub Actions Lint
+
+on:
+  push:
+    paths:
+      - '**.yml'
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - '**.yml'
+  workflow_dispatch: # Allow manual triggering
+
+jobs:
+  action-lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Download actionlint
+        id: get_actionlint
+        run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+
+      - name: Check workflow files
+        run: ${{ steps.get_actionlint.outputs.executable }} -color
+        shell: bash

.github/workflows/auto-merge.yml

@@ -0,0 +1,27 @@
+# This workflow will set the "auto-merge" flag on dependabot pull requests
+
+name: Auto-merge Dependabot PR
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "go.mod"
+      - "**.yml"
+
+jobs:
+  automerge:
+    if: github.actor == 'dependabot[bot]'
+    runs-on: ubuntu-latest
+
+    permissions:
+      pull-requests: write
+      contents: write
+
+    steps:
+      - name: Enable auto-merge
+        uses: peter-evans/enable-pull-request-automerge@v3
+        with:
+          pull-request-number: ${{ github.event.pull_request.number }}
+          merge-method: squash
+          token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/copyright-check.yml

@@ -0,0 +1,66 @@
+# This workflow will check the copyright of GO files
+
+name: Copyright Check
+
+on:
+  push:
+    paths:
+      - "**.go"
+      - "**.ini"
+      - ".github/workflows/copyright-check.yml"
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - "**.go"
+      - "**.ini"
+      - ".github/workflows/copyright-check.yml"
+  workflow_dispatch: # Allow manual triggering
+
+jobs:
+  copyright-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0  # Ensure we can diff against base
+
+      - name: Get list of changed Go and INI files
+        id: changed
+        run: |
+          # If event is pull_request, diff against base branch
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            files=$(git diff --name-only origin/${{ github.base_ref }} HEAD | grep -E '\.(go|ini)$' || true)
+          else
+            # For push events, check files changed in the latest commit range
+            files=$(git diff --name-only HEAD^ HEAD | grep -E '\.(go|ini)$' || true)
+          fi
+
+          # Join files into a single space-separated string
+          files="${files//$'\n'/ }"
+          echo ".go/.ini files found: $files"
+
+          echo "files=$files" >> "$GITHUB_OUTPUT"
+
+      - name: Verify copyright notice
+        run: |
+          CURRENT_YEAR=$(date +%Y)
+          COPYRIGHT_KEY="Copyright IBM Corp."
+          missing=false
+
+          for file in ${{ steps.changed.outputs.files }}; do
+            echo "Processing: $file"
+            if [ ! -f "$file" ]; then
+              continue
+            fi
+
+            if ! head -10 "${file}" | grep "${COPYRIGHT_KEY}" | grep -q "${CURRENT_YEAR}"; then
+              echo "     ❌ Missing or incorrect copyright"
+              missing=true
+            fi
+          done
+
+          if [ "$missing" = true ]; then
+            echo "One or more files are missing the correct copyright notice."
+            exit 1
+          fi

.github/workflows/dispatch-pr-create.yml

@@ -0,0 +1,81 @@
+# This workflow will get invoked via "repository_dispatch" and it is based on the Go Lint/Test/Build (go.yml) workflow
+
+name: Dispatch PR Create
+
+on:
+  repository_dispatch:
+    types: [pull-request-created]
+
+jobs:
+  dispatch-pr-create:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.client_payload.pr_branch }}
+
+      - name: Extract Go and golangci-lint versions
+        id: get-ver
+        run: |
+          echo "go_version=$(grep '^go ' go.mod | awk '{ print $2 }')" >> "$GITHUB_OUTPUT"
+          echo "golangci_version=v$(grep '^GOLANGCI_LINT_VERSION ' Makefile | awk '{ print $3 }')" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Go
+        uses: actions/setup-go@v6
+        with:
+          go-version: ${{ steps.get-ver.outputs.go_version }}
+
+      - name: Install golangci-lint v1
+        if: startsWith(steps.get-ver.outputs.golangci_version, 'v1')
+        uses: golangci/golangci-lint-action@v6 # v8 available, but only supports >= v2.1.0
+        with:
+          args: --disable-all --timeout 5m # disable linting, initialize cache
+          version: ${{ steps.get-ver.outputs.golangci_version }}
+
+      - name: Install golangci-lint v2
+        if: startsWith(steps.get-ver.outputs.golangci_version, 'v2')
+        uses: golangci/golangci-lint-action@v8
+        with:
+          version: ${{ steps.get-ver.outputs.golangci_version }}
+
+      - name: Run go fmt (via golangci-lint)
+        run: make fmt
+
+      - name: Run lint (via golangci-lint)
+        run: make lint
+
+      - name: Rnn go vet
+        run: make vet
+
+      - name: Run go test
+        run: make test
+
+      - name: Run go build
+        run: make ccm
+
+      - name: Install GitHub CLI
+        run: sudo apt-get install gh
+
+      - name: Get PR number for branch
+        id: get-pr
+        run: |
+          PR_NUMBER=$(gh pr list --head "${{ github.event.client_payload.pr_branch }}" --json number --jq '.[0].number')
+          echo "pr_number=${PR_NUMBER}" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on PR
+        uses: peter-evans/create-or-update-comment@v5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          issue-number: ${{ steps.get-pr.outputs.pr_number }}
+          body: |
+            ✅ Tests completed successfully
+
+      - name: Enable auto-merge
+        uses: peter-evans/enable-pull-request-automerge@v3
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          pull-request-number: ${{ steps.get-pr.outputs.pr_number }}
+          merge-method: squash

.github/workflows/gatekeeper.yml

@@ -0,0 +1,63 @@
+name: Gatekeeper
+
+on:
+  pull_request:
+    types: [assigned, opened, reopened, synchronize]
+  workflow_dispatch: # Allow manual triggering
+
+jobs:
+  gatekeeper:
+    runs-on: ubuntu-latest
+    permissions:
+      checks: read
+
+    steps:
+      - name: Wait for all other workflows
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // ✅ Works for PRs from forks and same repo
+            const sha = context.payload.pull_request
+              ? context.payload.pull_request.head.sha
+              : context.sha;
+
+            const maxAttempts = 40;
+            const delayMs = 30000; // 30 seconds
+
+            let allDone = false;
+            let attempts = 0;
+
+            await new Promise(r => setTimeout(r, 10000)); // Wait 10 sec before the first check
+            while (!allDone && attempts < maxAttempts) {
+              const { data: { check_runs } } = await github.rest.checks.listForRef({ owner, repo, ref: sha });
+
+              allDone = true;
+              const inProgress = [];
+
+              for (const c of check_runs) {
+                if (c.name.includes("gatekeeper")) continue; // skip self
+
+                if (c.status !== 'completed') {
+                  allDone = false;
+                  inProgress.push(c.name);
+                } else if (['failure','cancelled','timed_out','action_required'].includes(c.conclusion)) {
+                  core.setFailed(`❌ ${c.name} failed. PR cannot be merged.`);
+                  return;
+                }
+              }
+
+              if (!allDone) {
+                console.log(`⏳ Waiting for ${inProgress.length} checks to finish: ${inProgress.join(', ')}. Retrying in 30s...`);
+                await new Promise(r => setTimeout(r, delayMs));
+                attempts++;
+              }
+            }
+
+            if (!allDone) {
+              core.setFailed("⏰ Timeout waiting for workflows to complete.");
+            } else {
+              console.log("✅ All workflows completed successfully.");
+            }