Add extension to produced artifacts so that they can be filtered in
later steps
Fixes#3933
Co-authored-by: Carlos A Becker <caarlos0@users.noreply.github.com>
<!--
Hi, thanks for contributing!
Please make sure you read our CONTRIBUTING guide.
Also, add tests and the respective documentation changes as well.
-->
<!-- If applied, this commit will... -->
add kusionstack to Users
<!-- Why is this change being made? -->
<!-- # Provide links to any relevant tickets, URLs or other resources
-->
[//]: # (dependabot-start)
⚠️ **Dependabot is rebasing this PR** ⚠️
Rebasing might not happen immediately, so don't worry if this takes some
time.
Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.
---
[//]: # (dependabot-end)
Bumps [github.com/disgoorg/disgo](https://github.com/disgoorg/disgo)
from 0.16.0 to 0.16.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/disgoorg/disgo/releases">github.com/disgoorg/disgo's
releases</a>.</em></p>
<blockquote>
<h2>v0.16.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Add <code>Channel</code> to interactions by <a
href="https://github.com/caneleex"><code>@caneleex</code></a> in <a
href="https://redirect.github.com/disgoorg/disgo/pull/261">disgoorg/disgo#261</a></li>
<li>Add <code>OnHeartbeatAck</code> to <code>ListenerAdapter</code>
(fixes <a
href="https://redirect.github.com/disgoorg/disgo/issues/263">#263</a>)
by <a href="https://github.com/caneleex"><code>@caneleex</code></a> in
<a
href="250d1c9a92</a></li>
</ul>
<h2>Deprecations</h2>
<ul>
<li><code>ChannelID</code> in interactions has been deprecated. Use
<code>Channel()</code> instead</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/disgoorg/disgo/compare/v0.16.0...v0.16.1">https://github.com/disgoorg/disgo/compare/v0.16.0...v0.16.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="250d1c9a92"><code>250d1c9</code></a>
Add OnHeartbeatAck to ListenerAdapter</li>
<li><a
href="a3e65bd695"><code>a3e65bd</code></a>
Add Channel to interactions (<a
href="https://redirect.github.com/disgoorg/disgo/issues/261">#261</a>)</li>
<li>See full diff in <a
href="https://github.com/disgoorg/disgo/compare/v0.16.0...v0.16.1">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.7.0
to 0.8.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="00fd4ff485"><code>00fd4ff</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="018c28f8a1"><code>018c28f</code></a>
all: fix some comments</li>
<li><a
href="9cd0187c09"><code>9cd0187</code></a>
curve25519: use crypto/ecdh on Go 1.20</li>
<li><a
href="c6a20f9984"><code>c6a20f9</code></a>
ssh: document that ParseRawPrivateKey supports Ed25519 keys</li>
<li>See full diff in <a
href="https://github.com/golang/crypto/compare/v0.7.0...v0.8.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
its too hard to debug docker build issues... sometimes is just a typo in
the binary name, and you might end debugging it for way too long...
this prints the full path to the build context (so, locally at least,
you can cd into it) and also all the files available there when the
error seems to be one of the "file not found" kind.
Hopefully this helps fixing things easier :)
closes#3912
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
We support `.tar.gz` since the beginning, and `.tar.xz` for a long time.
`.tgz` and `.txz` are just commonly used shorthands for the same
formats.
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
This reverts back to using `git archive` for the source archives... but
will keep supporting extra files.
##### How it works:
Basically, we run `git archive` as before.
Then, we make a backup of the generated archive, and create a new one
copying by reading from the backup and writing into the new one.
Finally, we write the extra files to the new one as well.
This only happens if the configuration does have extra files, otherwise,
just the simple `git archive` will be run.
PS: we can't just append to the archive because weird tar format
paddings et al.
---------
Signed-off-by: Carlos Alexandro Becker <caarlos0@users.noreply.github.com>
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.7.0
to 0.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/golang/tools/releases">golang.org/x/tools's
releases</a>.</em></p>
<blockquote>
<h2>gopls/v0.8.0</h2>
<h2>Go version support</h2>
<h3>Support for Go 1.18</h3>
<p>Version 0.8.0 of gopls supports features added to Go 1.18,
specifically:</p>
<ul>
<li>Support for multi-module workspaces using <code>go.work</code>
files.</li>
<li>Diagnostics for Fuzz tests.</li>
<li>Improved support for generics.</li>
</ul>
<p>To use these features, gopls must be installed using Go 1.18. See <a
href="https://go.dev/dl/">go.dev/dl</a> for the latest status of Go 1.18
-- as of writing Go 1.18 is not yet released, but Go 1.18 RC1 may be
used.</p>
<h3>Dropped support for Go 1.12</h3>
<p>Version 0.8.0 of gopls no longer supports building at Go 1.12. See <a
href="https://redirect.github.com/golang/go/issues/50827">golang/go#50827</a>
for more details.</p>
<h2>New Features</h2>
<h3><code>go.work</code> integration</h3>
<p>Gopls now supports multi-module workspaces using <code>go.work</code>
files. To use this feature, create a <code>go.work</code> file that
includes the modules you want to work on, and then open your editor to
the directory containing <code>go.work</code>. For more information, see
the <a href="https://go.dev/ref/mod#workspaces"><code>go.work</code>
reference</a>, or the <a
href="https://github.com/golang/tools/blob/master/gopls/doc/workspace.md">gopls
documentation</a> for multi-module workspaces.</p>
<h3>Diagnostics for Fuzz tests</h3>
<p>When writing <a href="https://go.dev/doc/fuzz/">Fuzz tests</a>, gopls
provides diagnostics for invalid arguments to <code>Fuzz</code>.
<img
src="https://user-images.githubusercontent.com/57144380/156475335-0a277e11-c113-460a-837b-d066b42898a6.png"
alt="image" /></p>
<h3>Improved support for generics</h3>
<h4>Honor the language version configured in <code>go.mod</code></h4>
<p>gopls now provides diagnostics for language features based on the <a
href="https://go.dev/ref/mod#go-mod-file-go"><code>go</code>
directive</a> in the applicable <code>go.mod</code> file for a
package.</p>
<p>For some errors related to incompatible language versions, gopls
offers a quick-fix to update the <code>go.mod</code> Go version. (note
that if the <code>go.mod</code> file is open, it may need to be saved in
order for language version changes to take effect)
<img
src="https://user-images.githubusercontent.com/57144380/156476752-7aacf34b-2835-41cb-b80d-7bf5103a43a0.gif"
alt="gomodedit" /></p>
<h4>Improved completion with type parameters</h4>
<p>Gopls autocompletion is improved in several contexts when using
generic types.</p>
<p><img
src="https://user-images.githubusercontent.com/57144380/156477933-a1aab4c7-06cd-4cac-85e6-a847b6515b91.gif"
alt="genericvarcompl" /></p>
<h3>New code action to add missing method stubs</h3>
<p>Gopls now provides a code action to implement missing methods.</p>
<p><img
src="https://user-images.githubusercontent.com/57144380/156479262-482958e2-69a3-4a97-81a5-5dd27ac250ba.gif"
alt="implementiface" /></p>
<h3>Improved performance and accuracy for workspace symbol requests</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="5ef3193183"><code>5ef3193</code></a>
gopls/internal/lsp/source/typerefs: reexpress tests wrt
ExternalRefs</li>
<li><a
href="c5f768a46c"><code>c5f768a</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="7c33a56129"><code>7c33a56</code></a>
gopls/internal/lsp/source: show both the original declaration and the
value o...</li>
<li><a
href="4d205d81b5"><code>4d205d8</code></a>
gopls/doc: add instructions for using go.work with the Go
distribution</li>
<li><a
href="d5076cc64d"><code>d5076cc</code></a>
gopls/internal/lsp/cache: don't trace a region for MetadataForFile</li>
<li><a
href="f79636135d"><code>f796361</code></a>
gopls/internal/lsp: add tracing instrumentation for all Server
methods</li>
<li><a
href="e10450195e"><code>e104501</code></a>
gopls/internal/astutil: TestPurgeFuncBodies requires source code for
std</li>
<li><a
href="6520870190"><code>6520870</code></a>
gopls/internal/lsp/source/typerefs: allow for duplicate decls</li>
<li><a
href="902fdcadc1"><code>902fdca</code></a>
gopls/internal/lsp/source/typerefs: purge func bodies before
parsing</li>
<li><a
href="58c9a6328c"><code>58c9a63</code></a>
go/packages/internal/nodecount: count ast.Node frequency</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.7.0...v0.8.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.6.0
to 0.7.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="36075149c5"><code>3607514</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="4abfd87339"><code>4abfd87</code></a>
google: add CredentialsParams.EarlyTokenRefresh</li>
<li><a
href="1e7f329364"><code>1e7f329</code></a>
oauth2: add ReuseTokenSourceWithExpiry</li>
<li><a
href="86850e0723"><code>86850e0</code></a>
oauth2: fix typo</li>
<li><a
href="a6e37e7441"><code>a6e37e7</code></a>
google: Updating 3pi documentation</li>
<li><a
href="54b70c833f"><code>54b70c8</code></a>
google: update missing auth help URL</li>
<li><a
href="2fc4ef5a6f"><code>2fc4ef5</code></a>
README: encourage issues and proposals before changes</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.6.0...v0.7.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.8.0 to
0.9.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="48e4a4a957"><code>48e4a4a</code></a>
all: fix some comments</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.8.0...v0.9.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
closes#3485
also fixed a bug in file creation for github: it was always searching
for the file in the default branch
also, we don't need to create the file first, update does both create
and update.
TODO: implement the for krew, scoop, etc...
---------
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab)
from 0.81.0 to 0.82.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="20cdbe7f77"><code>20cdbe7</code></a>
Merge pull request <a
href="https://redirect.github.com/xanzy/go-gitlab/issues/1682">#1682</a>
from timofurrer/variables-raw</li>
<li><a
href="197113e10b"><code>197113e</code></a>
Implement raw field for instance variables API</li>
<li><a
href="b88a1b2a51"><code>b88a1b2</code></a>
Merge pull request <a
href="https://redirect.github.com/xanzy/go-gitlab/issues/1680">#1680</a>
from bmsareias/fix-UptadeProtectedBranch</li>
<li><a
href="71bce5a6b6"><code>71bce5a</code></a>
Merge pull request <a
href="https://redirect.github.com/xanzy/go-gitlab/issues/1673">#1673</a>
from chenggui53/update-project-event-struct</li>
<li><a
href="34980c231f"><code>34980c2</code></a>
Fix tests</li>
<li><a
href="cb40c20b4a"><code>cb40c20</code></a>
add push data</li>
<li><a
href="febd628d67"><code>febd628</code></a>
Merge pull request <a
href="https://redirect.github.com/xanzy/go-gitlab/issues/1678">#1678</a>
from MakingPRs/issue-field</li>
<li><a
href="295e7008ab"><code>295e700</code></a>
Merge pull request <a
href="https://redirect.github.com/xanzy/go-gitlab/issues/1677">#1677</a>
from MakingPRs/master</li>
<li><a
href="c70482aa21"><code>c70482a</code></a>
Change order of Epic fields to reflect docs</li>
<li><a
href="3f5e72f6f5"><code>3f5e72f</code></a>
Change order of Issue fields to reflect docs</li>
<li>Additional commits viewable in <a
href="https://github.com/xanzy/go-gitlab/compare/v0.81.0...v0.82.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This would allow to, when multiple tokens are set in the environment,
force which one you want to use.
The need for this comes from the fact gitea sets both `GITHUB_TOKEN` and
`GITEA_TOKEN`, and doesn't allow to easily disable either.
With this, users can add a `GORELEASER_FORCE_TOKEN=gitea` to force the
gitea client to be used.
I'm not sure what's the best name for this env yet, happy to hear
suggestions.
Also improved the `env_test.go` file a bit, as it was kinda messy with
env vars...
refs https://github.com/orgs/goreleaser/discussions/3900
---------
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
Bumps [github.com/docker/docker](https://github.com/docker/docker) from
23.0.1+incompatible to 23.0.3+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/docker/docker/releases">github.com/docker/docker's
releases</a>.</em></p>
<blockquote>
<h2>v23.0.3</h2>
<h2>23.0.3</h2>
<blockquote>
<p><strong>Note</strong></p>
<p>Due to an issue with CentOS 9 Stream's package repositories, packages
for
CentOS 9 are currently unavailable. Packages for CentOS 9 may be added
later,
or as part of the next (23.0.4) patch release.</p>
</blockquote>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Fixed a number of issues that can cause Swarm encrypted overlay
networks
to fail to uphold their guarantees, addressing <a
href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28841">CVE-2023-28841</a>,
<a
href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28840">CVE-2023-28840</a>,
and
<a
href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28842">CVE-2023-28842</a>.
<ul>
<li>A lack of kernel support for encrypted overlay networks now reports
as an error.</li>
<li>Encrypted overlay networks are eagerly set up, rather than waiting
for
multiple nodes to attach.</li>
<li>Encrypted overlay networks are now usable on Red Hat Enterprise
Linux 9
through the use of the <code>xt_bpf</code> kernel module.</li>
<li>Users of Swarm overlay networks should review <a
href="https://github.com/moby/moby/security/advisories/GHSA-vwm3-crmr-xfxw">GHSA-vwm3-crmr-xfxw</a>
to ensure that unintentional exposure has not occurred.</li>
</ul>
</li>
</ul>
<h3>Packaging Updates</h3>
<ul>
<li>Update containerd to <a
href="https://github.com/containerd/containerd/releases/tag/v1.6.20">v1.6.20</a>.</li>
<li>Update runc to <a
href="https://github.com/opencontainers/runc/releases/tag/v1.1.5">v1.1.5</a>.</li>
</ul>
<h2>v23.0.2</h2>
<h2>23.0.2</h2>
<p>For a full list of pull requests and changes in this release, refer
to the relevant GitHub milestones:</p>
<ul>
<li><a
href="https://github.com/docker/cli/milestone/75?closed=1">docker/cli,
23.0.2 milestone</a></li>
<li><a
href="https://github.com/moby/moby/milestone/114?closed=1">moby/moby,
23.0.2 milestone</a></li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Fully resolve missing checks for <code>apparmor_parser</code> when
an AppArmor enabled kernel is detected. <a
href="https://redirect.github.com/containerd/containerd/pull/8087">containerd/containerd#8087</a>,
<a
href="https://redirect.github.com/moby/moby/pull/45043">moby/moby#45043</a></li>
<li>Ensure that credentials are redacted from Git URLs when generating
BuildKit buildinfo. Fixes <a
href="https://github.com/moby/buildkit/security/advisories/GHSA-gc89-7gcr-jxqc">CVE-2023-26054</a>.
<a
href="https://redirect.github.com/moby/moby/pull/45110">moby/moby#45110</a></li>
<li>Fix anonymous volumes created by a <code>VOLUME</code> line in a
Dockerfile being excluded from volume prune. <a
href="https://redirect.github.com/moby/moby/pull/45159">moby/moby#45159</a></li>
<li>Fix a failure to properly propagate errors during removal of volumes
on a Swarm node. <a
href="https://redirect.github.com/moby/moby/pull/45155">moby/moby#45155</a></li>
<li>Temporarily work around a bug in BuildKit <code>COPY --link</code>
by disabling mergeop/diffop optimization. <a
href="https://redirect.github.com/moby/moby/pull/45112">moby/moby#45112</a></li>
<li>Properly clean up child tasks when a parent Swarm job is removed. <a
href="https://redirect.github.com/moby/swarmkit/pull/3112">moby/swarmkit#3112</a>,
<a
href="https://redirect.github.com/moby/moby/pull/45107">moby/moby#45107</a></li>
<li>Fix Swarm service creation logic so that both a GenericResource and
a non-default network can be used together. <a
href="https://redirect.github.com/moby/swarmkit/pull/3082">moby/swarmkit#3082</a>,
<a
href="https://redirect.github.com/moby/moby/pull/45107">moby/moby#45107</a></li>
<li>Fix Swarm CSI support requiring the CSI plugin to offer staging
endpoints in order to publish a volume. <a
href="https://redirect.github.com/moby/swarmkit/pull/3116">moby/swarmkit#3116</a>,
<a
href="https://redirect.github.com/moby/moby/pull/45107">moby/moby#45107</a></li>
<li>Fix a panic caused by log buffering in some configurations. <a
href="https://redirect.github.com/containerd/fifo/pull/47">containerd/fifo#47</a>,
<a
href="https://redirect.github.com/moby/moby/pull/45051">moby/moby#45051</a></li>
<li>Log errors in the REST to Swarm gRPC API translation layer at the
debug level to reduce redundancy and noise. <a
href="https://redirect.github.com/moby/moby/pull/45016">moby/moby#45016</a></li>
<li>Fix a DNS resolution issue affecting containers created with
<code>--dns-opt</code> or <code>--dns-search</code> when
<code>systemd-resolved</code> is used outside the container. <a
href="https://redirect.github.com/moby/moby/pull/45000">moby/moby#45000</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="59118bff50"><code>59118bf</code></a>
Merge pull request from GHSA-232p-vwff-86mp</li>
<li><a
href="219f21bf07"><code>219f21b</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/docker/issues/45196">#45196</a>
from vvoland/integration-restart-race-23</li>
<li><a
href="b87f7f18b8"><code>b87f7f1</code></a>
libnet/d/overlay: insert the input-drop rule</li>
<li><a
href="c6bf3071fe"><code>c6bf307</code></a>
StartWithLogFile: Fix d.cmd race</li>
<li><a
href="7f49ca259b"><code>7f49ca2</code></a>
TestDaemonRestartKillContainers: Fix loop capture</li>
<li><a
href="98cbcb8003"><code>98cbcb8</code></a>
libnet/d/overlay: add BPF-powered VNI matcher</li>
<li><a
href="5c5fac2374"><code>5c5fac2</code></a>
libnet/d/overlay: extract VNI match rule builder</li>
<li><a
href="c492a22287"><code>c492a22</code></a>
libn/d/overlay: enforce encryption on sandbox init</li>
<li><a
href="018edb0284"><code>018edb0</code></a>
libnet/d/overlay: document some encryption code</li>
<li><a
href="a1fd2f22f6"><code>a1fd2f2</code></a>
Merge pull request <a
href="https://redirect.github.com/docker/docker/issues/45157">#45157</a>
from thaJeztah/23.0_backport_update_shfmt</li>
<li>Additional commits viewable in <a
href="https://github.com/docker/docker/compare/v23.0.1...v23.0.3">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/goreleaser/goreleaser/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps golang from 1.20.2-alpine to 1.20.3-alpine.
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
<!--
Hi, thanks for contributing!
Please make sure you read our CONTRIBUTING guide.
Also, add tests and the respective documentation changes as well.
-->
Currently Goreleaser uses `runtime.NumCPU()` as the default value if
`--parallelism` is not set.
However, this will get the number of CPUs on the host even when
Goreleaser is run in a container with a limit on the maximum number of
CPUs that can be used (typically in a Kubernetes pod).
Actually, `docker run --cpus=1 goreleaser/goreleaser --debug` shows
`parallelism: 4` on my machine.
This behavior causes CPU throttling, which increases execution time and,
in the worst case, terminates with an error.
I ran into this problem with Jenkins where the agent runs on pod
([Kubernetes plugin for
Jenkins](https://plugins.jenkins.io/kubernetes/)).
This commit introduces
[automaxprocs](https://github.com/uber-go/automaxprocs) to fix this
issue.
This library sets `GOMAXPROCS` to match Linux container CPU quota.
I have also looked for a library that can get CPU quota more directly,
but this seems to be the best I could find.
The reason it is set in a different notation from the automaxprocs
README is to prevent logs from being displayed
([comment](https://github.com/uber-go/automaxprocs/issues/18#issuecomment-511330567)).
I would have liked to write a test, but this change is dependent on the
number of CPUs in the execution environment, so I could not.
Instead, I wrote a Dockerfile for testing
```Dockerfile
FROM golang:1.20.2
WORKDIR /go/app
RUN sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin
COPY . .
RUN task build
```
and confirmed built binary shows expected parallelism by following
commands:
```sh
docker build --file Dockerfile.test . -t test-goreleaser
docker run --cpus=1 test-goreleaser ./goreleaser build --snapshot --debug # parallelism: 1
docker run test-goreleaser ./goreleaser build --snapshot --debug # parallelism: 4
```
I also ran the built binary on my Macbook and it was fine.
- [x] if the default is the zero-value for the field, do not specify
- [ ] TODO: add a "how to read this docs" section somewhere explaining
that
- [x] if the change was introduced in a v1.x.0, say only v1.x
- [x] drop trail ending `.` from Since, Default, etc
- [x] wording: always use `Default: ` instead of `Defaults to` and
others
- [x] add a note to templateable fields
- [x] default value of a field, if its a string, always between single
quotes `'`
---------
Signed-off-by: Carlos A Becker <caarlos0@users.noreply.github.com>
Bumps
[github.com/opencontainers/runc](https://github.com/opencontainers/runc)
from 1.1.2 to 1.1.5.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/opencontainers/runc/releases">github.com/opencontainers/runc's
releases</a>.</em></p>
<blockquote>
<h2>runc 1.1.5 -- "囚われた屈辱は 反撃の嚆矢だ"</h2>
<p>This is the fifth patch release in the 1.1.z series of runc, which
fixes
three CVEs found in runc.</p>
<ul>
<li>
<p>CVE-2023-25809 is a vulnerability involving rootless containers where
(under specific configurations), the container would have write access
to the /sys/fs/cgroup/user.slice/... cgroup hierarchy. No other
hierarchies on the host were affected. This vulnerability was
discovered by Akihiro Suda.
<a
href="https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc">https://github.com/opencontainers/runc/security/advisories/GHSA-m8cg-xc2p-r3fc</a></p>
</li>
<li>
<p>CVE-2023-27561 was a regression which effectively re-introduced
CVE-2019-19921. This bug was present from v1.0.0-rc95 to v1.1.4. This
regression was discovered by <a
href="https://github.com/Beuc"><code>@Beuc</code></a>.
<a
href="https://github.com/advisories/GHSA-vpvm-3wq2-2wvm">https://github.com/advisories/GHSA-vpvm-3wq2-2wvm</a></p>
</li>
<li>
<p>CVE-2023-28642 is a variant of CVE-2023-27561 and was fixed by the
same
patch. This variant of the above vulnerability was reported by Lei
Wang.
<a
href="https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c">https://github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c</a></p>
</li>
</ul>
<p>In addition, the following other fixes are included in this
release:</p>
<ul>
<li>Fix the inability to use <code>/dev/null</code> when inside a
container. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3620">#3620</a>)</li>
<li>Fix changing the ownership of host's <code>/dev/null</code> caused
by fd redirection
(a regression in 1.1.1). (<a
href="https://redirect.github.com/opencontainers/runc/issues/3674">#3674</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3731">#3731</a>)</li>
<li>Fix rare runc exec/enter unshare error on older kernels, including
CentOS < 7.7. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3776">#3776</a>)</li>
<li>nsexec: Check for errors in <code>write_log()</code>. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3721">#3721</a>)</li>
</ul>
<h3>Static Linking Notices</h3>
<p>The <code>runc</code> binary distributed with this release are
<em>statically linked</em> with
the following <a
href="https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html">GNU
LGPL-2.1</a> licensed libraries, with <code>runc</code> acting
as a "work that uses the Library":</p>
<ul>
<li><a href="https://github.com/seccomp/libseccomp">libseccomp</a></li>
</ul>
<p>The versions of these libraries were not modified from their upstream
versions,
but in order to comply with the LGPL-2.1 (§6(a)), we have attached the
complete source code for those libraries which (when combined with the
attached
runc source code) may be used to exercise your rights under the
LGPL-2.1.</p>
<p>However we strongly suggest that you make use of your distribution's
packages
or download them from the authoritative upstream sources, especially
since
these libraries are related to the security of your containers.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/opencontainers/runc/blob/v1.1.5/CHANGELOG.md">github.com/opencontainers/runc's
changelog</a>.</em></p>
<blockquote>
<h2>[1.1.5] - 2023-03-29</h2>
<blockquote>
<p>囚われた屈辱は
反撃の嚆矢だ</p>
</blockquote>
<h3>Fixed</h3>
<ul>
<li>Prohibit container's <code>/proc</code> and <code>/sys</code> to be
symlinks (CVE-2019-19921,
CVE-2023-27561, CVE-2023-28642, <a
href="https://redirect.github.com/opencontainers/runc/issues/3785">#3785</a>)</li>
<li>rootless: rework /sys/fs/cgroup mounts to avoid exposing the host's
cgroup
hierarchy into the container. (CVE-2023-25809)</li>
<li>Fix the inability to use <code>/dev/null</code> when inside a
container. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3620">#3620</a>)</li>
<li>Fix changing the ownership of host's <code>/dev/null</code> caused
by fd redirection
(a regression in 1.1.1). (<a
href="https://redirect.github.com/opencontainers/runc/issues/3674">#3674</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3731">#3731</a>)</li>
<li>Fix rare runc exec/enter unshare error on older kernels, inlcuding
CentOS < 7.7. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3776">#3776</a>)</li>
<li>nsexec: Check for errors in <code>write_log()</code>. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3721">#3721</a>)</li>
<li>Various CI fixes and updates. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3618">#3618</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3630">#3630</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3640">#3640</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3729">#3729</a>)</li>
</ul>
<h2>[1.1.4] - 2022-08-24</h2>
<blockquote>
<p>If you look for perfection, you'll never be content.</p>
</blockquote>
<h3>Fixed</h3>
<ul>
<li>Fix mounting via wrong proc fd.
When the user and mount namespaces are used, and the bind mount is
followed by
the cgroup mount in the spec, the cgroup was mounted using the bind
mount's
mount fd. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3511">#3511</a>)</li>
<li>Switch <code>kill()</code> in <code>libcontainer/nsenter</code> to
<code>sane_kill()</code>. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3536">#3536</a>)</li>
<li>Fix "permission denied" error from <code>runc run</code>
on <code>noexec</code> fs. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3541">#3541</a>)</li>
<li>Fix failed exec after <code>systemctl daemon-reload</code>.
Due to a regression in v1.1.3, the <code>DeviceAllow=char-pts rwm</code>
rule was no
longer added and was causing an error <code>open /dev/pts/0: operation
not permitted: unknown</code>
when systemd was reloaded. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3554">#3554</a>)</li>
<li>Various CI fixes. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3538">#3538</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3558">#3558</a>,
<a
href="https://redirect.github.com/opencontainers/runc/issues/3562">#3562</a>)</li>
</ul>
<h2>[1.1.3] - 2022-06-09</h2>
<blockquote>
<p>In the beginning there was nothing, which exploded.</p>
</blockquote>
<h3>Fixed</h3>
<ul>
<li>Our seccomp <code>-ENOSYS</code> stub now correctly handles
multiplexed syscalls on
s390 and s390x. This solves the issue where syscalls the host kernel did
not
support would return <code>-EPERM</code> despite the existence of the
<code>-ENOSYS</code> stub
code (this was due to how s390x does syscall multiplexing). (<a
href="https://redirect.github.com/opencontainers/runc/issues/3478">#3478</a>)</li>
<li>Retry on dbus disconnect logic in libcontainer/cgroups/systemd now
works as
intended; this fix does not affect runc binary itself but is important
for
libcontainer users such as Kubernetes. (<a
href="https://redirect.github.com/opencontainers/runc/issues/3476">#3476</a>)</li>
<li>Inability to compile with recent clang due to an issue with
duplicate</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="f19387a6be"><code>f19387a</code></a>
VERSION: release v1.1.5</li>
<li><a
href="58a9abee21"><code>58a9abe</code></a>
Merge pull request from GHSA-m8cg-xc2p-r3fc</li>
<li><a
href="27fb72c7ff"><code>27fb72c</code></a>
merge branch 'pr-3776' into release-1.1</li>
<li><a
href="8ec02ea1b1"><code>8ec02ea</code></a>
nsexec: retry unshare on EINVAL</li>
<li><a
href="059d7730fc"><code>059d773</code></a>
merge branch 'pr-3785' into release-1.1</li>
<li><a
href="0abab45c9b"><code>0abab45</code></a>
Prohibit /proc and /sys to be symlinks</li>
<li><a
href="0e6b818a2b"><code>0e6b818</code></a>
rootless: fix /sys/fs/cgroup mounts</li>
<li><a
href="c6781d100a"><code>c6781d1</code></a>
Merge pull request <a
href="https://redirect.github.com/opencontainers/runc/issues/3721">#3721</a>
from kinvolk/rata/nsfixes-backport</li>
<li><a
href="f6e2cd3baf"><code>f6e2cd3</code></a>
nsexec: Check for errors in write_log()</li>
<li><a
href="3775df9fcb"><code>3775df9</code></a>
Merge pull request <a
href="https://redirect.github.com/opencontainers/runc/issues/3731">#3731</a>
from kolyshkin/1.1-fix-dev-null</li>
<li>Additional commits viewable in <a
href="https://github.com/opencontainers/runc/compare/v1.1.2...v1.1.5">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/goreleaser/goreleaser/network/alerts).
</details>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
