Bump k8s-bake, k8s-deploy, and action-release-workflows - #1
Open
bosesuneha wants to merge 5 commits into
Open
Conversation
…e#772) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Suneha Bose <123775811+bosesuneha@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Updates both the repo's own integration CI and the workflow templates
(plus their golden-file fixtures) that draft generates for users.
- .github/workflows/integration-per-language.yml (SHA-pinned):
k8s-bake v4.1.0 -> v4.1.1, k8s-deploy v6 -> v7.0.0
- template/workflows/kustomize: k8s-bake@v3 -> v4, k8s-deploy@v5 -> v7
- template/workflows/manifests: k8s-deploy@v5 -> v7
- pkg/fixtures/workflows/github/{kustomize,manifests}: kept in sync
k8s-deploy v7.0.0 confines `manifests:` paths to GITHUB_WORKSPACE, which
is a breaking change for manifests written outside the workspace.
k8s-bake v4.1.1 pairs with this by writing the baked manifest into the
workspace, so bake -> deploy handoffs keep working. The manifests
template passes a repo-relative DEPLOYMENT_MANIFEST_PATH and is
unaffected.
The previous pin (3c677ba, tagged v1, Jun 2025) predates the addition of check_signed_commits.yaml to action-release-workflows, so the reusable workflow reference could not resolve and the Check Signed Commits job failed on every PR with "This run likely failed because of a workflow file issue." v1.1.0 (2ff0844) contains check_signed_commits.yaml. Its interface is unchanged from the caller's perspective: `on: workflow_call` with no inputs or secrets, and it still needs only `pull-requests: write`. Note the floating v1 tag still points at the older 3c677ba and has not been moved forward to v1.1.0, so pinning to the v1.1.0 commit is required rather than relying on the major tag.
bosesuneha
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
k8s-bake,k8s-deploy, andAzure/action-release-workflowsto their latest releases..github/workflows/integration-per-language.ymlazure/k8s-bakev4.1.0→v4.1.1.github/workflows/integration-per-language.ymlAzure/k8s-deployv6→v7.0.0.github/workflows/check-signed-commits.ymlAzure/action-release-workflowsv1→v1.1.0template/workflows/kustomize/...k8s-bake@v3→@v4,k8s-deploy@v5→@v7template/workflows/manifests/...Azure/k8s-deploy@v5→@v7pkg/fixtures/workflows/github/{kustomize,manifests}/...Templates keep major-version tags (matching existing style); repo CI stays SHA-pinned with a version comment, consistent with Azure#779.
Resolved SHAs:
azure/k8s-bake@bf8bfd33b007edea820fe80983239bca24012239(v4.1.1)Azure/k8s-deploy@51ca02a8b7225fbd0924aac359c5b336a5f1e5b4(v7.0.0)Azure/action-release-workflows@2ff084415c5af591fd13d95ddbfc4cdb5ed2012e(v1.1.0)Fixes a currently-broken CI job
The
Check Signed Commitsworkflow is failing on every PR onmaintoday.The pin
@3c677ba # v1dates to Jun 2025, which is beforecheck_signed_commits.yamlwas even added toaction-release-workflows. The reusable-workflow reference therefore cannot resolve, and runs fail withThis run likely failed because of a workflow file issue.Verified against run history on
Azure/draft: every recentCheck Signed Commitsrun fails, except the one on the dependabot branch that had already bumped this pin to2ff0844 # v1.1.0— that run passed. This PR applies the same pin.Interface is unchanged for the caller:
on: workflow_callwith no inputs or secrets, still needs onlypull-requests: write.Worth noting: the floating
v1tag still points at the older3c677baand was never moved forward to v1.1.0 — so pinning to the v1.1.0 commit is required; relying on the major tag would not fix this.k8s-deploy v7 breaking change
k8s-deploy v7.0.0 confines
manifests:paths toGITHUB_WORKSPACE— manifests outside the workspace now fail.k8s-bake v4.1.1 pairs with this by writing the baked manifest into the workspace, so every
bake → deployhandoff (passingsteps.bake.outputs.manifestsBundle) keeps working. This is why both are bumped together rather than separately.The
manifeststemplate has no bake step and passes a repo-relativeDEPLOYMENT_MANIFEST_PATH, so it is already workspace-safe.Test plan
go build ./...go test ./...— all passpkg/handlers/templatetestskustomize/helm workflow tests pass, confirmingtemplate/andpkg/fixtures/stayed in synck8s-bake@v3/k8s-deploy@v5/k8s-deploy@v6references remaincheck_signed_commits.yamlconfirmed present at the new SHA and absent at the old one