fix: upgrade cosign-release to v2.2.3 (Cr 24607 sync v1.9.2)

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @VaibhavPage @whynowy

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "saturday"
+    ignore:
+      - dependency-name: k8s.io/*
+      - dependency-name: sigs.k8s.io/controller-runtime
+      - dependency-name: github.com/aws/aws-sdk-go # too often, and usually not related.
+    open-pull-requests-limit: 10
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "saturday"

.github/workflows/changelog.yaml

@@ -0,0 +1,34 @@
+name: Changelog
+
+on:
+  push:
+    tags:
+      - v*
+      - "!v.0.9"
+
+permissions:
+  contents: read
+
+jobs:
+  generate_changelog:
+    permissions:
+      contents: write  # for peter-evans/create-pull-request to create branch
+      pull-requests: write  # for peter-evans/create-pull-request to create a PR
+    if: github.repository == 'argoproj/argo-events'
+    runs-on: ubuntu-latest
+    name: Generate changelog
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: master
+          fetch-depth: 0
+      - run: git fetch --prune --prune-tags
+      - run: git tag -l 'v*'
+      # avoid invoking `make` to reduce the risk of a Makefile bug failing this workflow
+      - run: ./hack/changelog.sh > CHANGELOG.md
+      - uses: peter-evans/create-pull-request@v6
+        with:
+          title: 'docs: updated CHANGELOG.md'
+          commit-message: 'docs: updated CHANGELOG.md'
+          signoff: true
+

.github/workflows/ci.yaml

@@ -5,33 +5,40 @@ on:
       - "master"
       - "release-*"
   pull_request:
-    branches: [ master ]
+    branches:
+      - "master"
+      - "release-*"
+
+permissions:
+  contents: read
+
 jobs:
   codegen:
     name: Codegen
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 7
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
-      - name: Restore go build cache
-        uses: actions/cache@v1
-        with:
-          path: ~/.cache/go-build
-          key: ${{ runner.os }}-go-build-v1-${{ hashFiles('**/go.mod') }}
+        uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.15.7"
-      - name: Add bins to PATH
-        run: |
-          echo /home/runner/go/bin >> $GITHUB_PATH
-          echo /usr/local/bin >> $GITHUB_PATH
+          go-version: "1.21"
+      - name: Restore go build cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
       - name: Install protoc
         run: |
           set -eux -o pipefail
-          PROTOC_ZIP=protoc-3.11.1-linux-x86_64.zip
-          curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v3.11.1/$PROTOC_ZIP
+          PROTOC_VERSION=3.19.4
+          PROTOC_ZIP=protoc-$PROTOC_VERSION-linux-x86_64.zip
+          curl -OL https://github.com/protocolbuffers/protobuf/releases/download/v$PROTOC_VERSION/$PROTOC_ZIP
           sudo unzip -o $PROTOC_ZIP -d /usr/local bin/protoc
           sudo unzip -o $PROTOC_ZIP -d /usr/local 'include/*'
           sudo chmod +x /usr/local/bin/protoc
@@ -42,17 +49,16 @@ jobs:
       - name: Install pandoc
         run: |
           set -eux -o pipefail
-          PANDOC_ZIP=pandoc-2.11.1-linux-amd64.tar.gz
-          curl -OL https://github.com/jgm/pandoc/releases/download/2.11.1/$PANDOC_ZIP
+          PANDOC_VERSION=2.17.1
+          PANDOC_ZIP=pandoc-$PANDOC_VERSION-linux-amd64.tar.gz
+          curl -OL https://github.com/jgm/pandoc/releases/download/$PANDOC_VERSION/$PANDOC_ZIP
           sudo tar xvzf $PANDOC_ZIP --strip-components 1 -C /usr/local
           rm -f $PANDOC_ZIP
-          echo /usr/local/pandoc-2.11.1/bin >> $GITHUB_PATH
+          echo /usr/local/pandoc-$PANDOC_VERSION/bin >> $GITHUB_PATH
       - name: Get dependencies
         run: go mod download
       - name: Make codegen
-        run: |
-          echo 'GOPATH=/home/runner/go' >> $GITHUB_ENV
-          make -B codegen
+        run: make -B codegen
       - name: Ensure nothing changed
         run: git diff --exit-code
 
@@ -61,58 +67,89 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - name: Set up Go 1.x
-        uses: actions/setup-go@v2
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Setup Golang
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.15.7"
-        id: go
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v2
-      - name: Restore Go build cache
-        uses: actions/cache@v1
+          go-version: "1.21"
+      - name: Restore go build cache
+        uses: actions/cache@v4
         with:
-          path: ~/.cache/go-build
-          key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
       - name: Get dependencies
         run: go mod download
-      - name: Test
+      - name: Run tests
         run: make test
 
-  e2e-tests:
-    name: E2E Tests
+  lint:
+    name: lint
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 10
+    env:
+      GOPATH: /home/runner/go
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+      - name: Setup Golang
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.21"
       - name: Restore go build cache
-        uses: actions/cache@v1
+        uses: actions/cache@v4
         with:
-          path: ~/.cache/go-build
-          key: ${{ runner.os }}-go-build-v2-${{ hashFiles('**/go.mod') }}
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+      - run: make lint
+      - run: git diff --exit-code
+
+  e2e-tests:
+    name: E2E Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    env:
+      KUBECONFIG: /home/runner/.kubeconfig
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        include:
+          - driver: stan
+          - driver: jetstream
+          - driver: kafka
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v5
         with:
-          go-version: "1.15.7"
-      - name: Add bins to PATH
-        run: |
-          echo /home/runner/go/bin >> $GITHUB_PATH
-          echo /usr/local/bin >> $GITHUB_PATH
+          go-version: "1.21"
+      - name: Restore go build cache
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
       - name: Install k3d
         run: curl -sfL https://raw.githubusercontent.com/rancher/k3d/main/install.sh | bash &
-      - name: Create a registry and a cluster
+      - name: Create k3d registry and cluster
         run: |
           k3d registry create e2e-registry --port 5111
-          k3d cluster create e2e --registry-use k3d-e2e-registry:5111
-          k3d kubeconfig get e2e > ~/.kube/argo-events-e2e-config
+          k3d cluster create e2e -i rancher/k3s:v1.21.7-k3s1 --registry-use k3d-e2e-registry:5111
           echo '127.0.0.1 k3d-e2e-registry' | sudo tee -a /etc/hosts
-      - name: Install Argo Events
-        env:
-          GOPATH: /home/runner/go
-        run: |
-          KUBECONFIG=~/.kube/argo-events-e2e-config IMAGE_NAMESPACE=k3d-e2e-registry:5111 VERSION=${{ github.sha }} DOCKER_PUSH=true make start
       - name: Run tests
-        env:
-          GOPATH: /home/runner/go
-        run: KUBECONFIG=~/.kube/argo-events-e2e-config make test-functional
-
+        run: |
+          IMAGE_NAMESPACE=k3d-e2e-registry:5111 VERSION=${{ github.sha }} DOCKER_PUSH=true make start
+          EventBusDriver=${{ matrix.driver }} make test-functional

.github/workflows/default-branch-check.yaml

@@ -0,0 +1,18 @@
+name: PR check
+
+on:
+  pull_request:
+    branches:
+      - "release-*"
+
+jobs:
+  test-default-branch:
+    name: base branch is a default branch
+    runs-on: ubuntu-latest
+    steps:
+    - name: fail if base branch is not default branch
+      if: ${{ github.event.pull_request.base.ref != github.event.repository.default_branch }}
+      uses: actions/github-script@v3
+      with:
+        script: |
+            core.setFailed("Base branch of the PR - ${{ github.event.pull_request.base.ref }} is not a default branch. Please reopen your PR to ${{ github.event.repository.default_branch }}")

.github/workflows/dependabot-reviewer.yml

@@ -0,0 +1,30 @@
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/automating-dependabot-with-github-actions
+name: Approve and enable auto-merge for dependabot
+on: pull_request
+
+permissions:
+  contents: read
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
+    if: ${{ github.actor == 'dependabot[bot]' }}
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/[email protected]
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Approve PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+      - name: Enable auto-merge for Dependabot PRs
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{github.event.pull_request.html_url}}
+          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}

.github/workflows/gh-pages.yaml

@@ -1,29 +1,35 @@
-name: Deploy
+name: gh-pages
 
 on:
   push:
     branches:
       - master
 
+permissions:
+  contents: read
+
 jobs:
   deploy:
+    permissions:
+      contents: write  # for peaceiris/actions-gh-pages to push pages branch
+    if: github.repository == 'argoproj/argo-events'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - name: Setup Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@v5
         with:
-          python-version: 3.x
+          python-version: 3.9
       - name: Setup Golang
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v5
         with:
-          go-version: '1.15.7'
+          go-version: '1.21'
       - name: build
         run: |
-          pip install mkdocs==1.0.4 mkdocs_material==4.1.1
+          pip install mkdocs==1.3.0 mkdocs_material==8.2.9
           mkdocs build
       - name: deploy
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./site