Prepare release 4.8.0 (#1340)

Author: BraisVQ

.github/workflows/continuous-integration-workflow.yml

@@ -90,10 +90,10 @@ jobs:
         name: Checkout repository
         uses: actions/checkout@v4.1.6
       -
-        name: Setup Go 1.23
+        name: Setup Go 1.24
         uses: actions/setup-go@v5
         with:
-          go-version: 1.23
+          go-version: 1.24
       -
         name: Download goimports
         run: |
@@ -102,7 +102,7 @@ jobs:
         name: Download golangci-lint
         run: |
           curl -sSfL --output /tmp/golangci-lint.sh https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh
-          cat /tmp/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.60.1
+          cat /tmp/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.64.7
       -
         name: Run linter
         working-directory: jenkins/webhook-proxy

CHANGELOG.md

@@ -4,10 +4,31 @@
 
 ### Added
 
+
+### Changed
+
+
+### Fixed
+
+
+## [4.8.0] - 2025-4-10
+
+### Added
+
+- Update CODEOWNERS ([#1329](https://github.com/opendevstack/ods-core/issues/1329))
+- Add packages carvel/imgpkg and yg ([#1322](https://github.com/opendevstack/ods-core/issues/1322))
+- Adde mask-passwords and office 365 connector plugins in Jenkins ([#1313](https://github.com/opendevstack/ods-core/issues/1313)) and ([#1316](https://github.com/opendevstack/ods-core/issues/1316))
+- Add package cosign ([#1323](https://github.com/opendevstack/ods-core/issues/1323))
+
 ### Changed
+- Updated Aqua CLI ([#1325](https://github.com/opendevstack/ods-core/pull/1325)) & ([#1332](https://github.com/opendevstack/ods-core/pull/1332))
+- Fix Jenkins pipeline removal issue and update to golang 1.24 ([#1331](https://github.com/opendevstack/ods-core/issues/1331))
 
 ### Fixed
 
+- Webhook proxy BC recretion issue ([#1265](https://github.com/opendevstack/ods-core/issues/1265))
+- Fix Go version without 1.N.P syntax ([#1337](https://github.com/opendevstack/ods-core/pull/1337))
+
 ## [4.7.0] - 2025-1-27
 
 ### Changed

CODEOWNERS

@@ -1,7 +1,9 @@
-tests/ @clemensutschig @hugowschneider
-jenkins/ @michaelsauter @oalyman
-scripts/ @michaelsauter
+tests/ @clemensutschig
+jenkins/ @oalyman @BraisVQ
+sonarqube/ @BraisVQ
+nexus/ @BraisVQ
+scripts/ 
 ods-provisioning-app/ @stitakis
 ods-document-generation-svc/ @metmajer
-infrastructure-setup/ @tjaeschke
+infrastructure-setup/ 
 

configuration-sample/ods-core.env.sample

@@ -250,8 +250,8 @@ JENKINS_AGENT_BASE_SNYK_DISTRIBUTION_URL=https://github.com/snyk/snyk/releases/d
 # Releases are published at https://download.aquasec.com/scanner
 # Check Aqua versions backward compatibility at https://docs.aquasec.com/docs/version-compatibility-of-components#section-backward-compatibility-across-two-major-versions
 # To Download the aquaSec scanner cli and check their documentaion requires a valid account on aquasec.com
-# Latest tested version is 2022.4.588
-# Example: https://<USER>:<PASSWORD>@download.aquasec.com/scanner/2022.4.588/scannercli
+# Latest tested version is 2022.4.720
+# Example: https://<USER>:<PASSWORD>@download.aquasec.com/scanner/2022.4.759/scannercli
 JENKINS_AGENT_BASE_AQUASEC_SCANNERCLI_URL=
 
 # Repository of shared library

jenkins/agent-base/Dockerfile.ubi8

@@ -4,13 +4,16 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 ENV SONAR_SCANNER_VERSION=6.2.1.4610 \
     CNES_REPORT_VERSION=5.0.0 \
+    COSIGN_VERSION=2.4.3 \
     TAILOR_VERSION=1.3.4 \
     SOPS_VERSION=3.9.0 \
     HELM_VERSION=3.15.4 \
     HELM_PLUGIN_DIFF_VERSION=3.9.9 \
     HELM_PLUGIN_SECRETS_VERSION=4.6.1 \
     GIT_LFS_VERSION=3.5.1 \
+    IMGPKG_VERSION=0.44.0 \
     TRIVY_VERSION=0.54.1 \
+    YQ_VERSION=4.45.1 \
     JAVA_GC_OPTS="-XX:+UseParallelGC -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90"
 
 ARG APP_DNS
@@ -61,6 +64,13 @@ RUN cd /tmp \
     && mv cnesreport.jar /usr/local/cnes/cnesreport.jar \
     && chmod 777 /usr/local/cnes/cnesreport.jar
 
+# Install sigstore/cosign
+RUN cd /tmp \
+    && curl -sSLO https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64 \
+    && mv /tmp/cosign-linux-amd64 /usr/local/bin/cosign \
+    && chmod 755 /usr/local/bin/cosign \
+    && cosign version
+
 # Install Tailor.
 RUN cd /tmp \
     && curl -sSLO https://github.com/opendevstack/tailor/releases/download/v${TAILOR_VERSION}/tailor-linux-amd64 \
@@ -83,6 +93,20 @@ RUN cd /tmp \
     && sops --version \
     && rm -rf /tmp/helm /tmp/helm-v${HELM_VERSION}-linux-amd64.tar.gz
 
+# Install imgpkg.
+RUN cd /tmp \
+    && curl -sSLO https://github.com/carvel-dev/imgpkg/releases/download/v${IMGPKG_VERSION}/imgpkg-linux-amd64 \
+    && mv imgpkg-linux-amd64 /usr/local/bin/imgpkg \
+    && chmod a+x /usr/local/bin/imgpkg \
+    && imgpkg --version
+
+# Install yq.
+RUN cd /tmp \
+    && curl -sSLO https://github.com/mikefarah/yq/releases/download/v${YQ_VERSION}/yq_linux_amd64 \
+    && mv yq_linux_amd64 /usr/local/bin/yq \
+    && chmod a+x /usr/local/bin/yq \
+    && yq --version
+
 # Install GIT-LFS extension https://git-lfs.github.com/.
 RUN cd /tmp \
     && mkdir -p /tmp/git-lfs \

jenkins/master/plugins.ubi8.txt

@@ -3,6 +3,11 @@ greenballs:1.15.1
 sonar:2.17.2
 ansicolor:1.0.4
 audit-trail:361.v82cde86c784e
+Office-365-Connector:5.0.0
+mask-passwords:173.v6a_077a_291eb_5
+
+# Plugins updated to fix dependecy errors (can be removed in next version)
+workflow-step-api:657.v03b_e8115821b_
 
 # Bundled plugins
 token-macro:400.v35420b_922dcb_

jenkins/ocp-config/deploy/jenkins-webhook-proxy.yml

@@ -20,6 +20,9 @@ parameters:
   required: true
 - name: ODS_BITBUCKET_PROJECT
   required: true
+- name: MAX_DELETION_CHECKS
+  value: '10'
+  required: true
 - name: WEBHOOK_PROXY_CPU_REQUEST
   value: 25m
 - name: WEBHOOK_PROXY_CPU_LIMIT
@@ -96,6 +99,10 @@ objects:
             value: ${REPO_BASE}
           - name: ALLOWED_EXTERNAL_PROJECTS
             value: ${ODS_BITBUCKET_PROJECT}
+          - name: OPENSHIFT_APP_DOMAIN
+            value: ${OPENSHIFT_APPS_BASEDOMAIN}
+          - name: MAX_DELETION_CHECKS
+            value: ${MAX_DELETION_CHECKS}
           - name: TRIGGER_SECRET
             valueFrom:
               secretKeyRef:

jenkins/webhook-proxy/Dockerfile

@@ -1,28 +1,34 @@
-# Ideally we would us a very small image like plain alpine and just copy the
-# pre-built binary into it, but due to e.g. multistage builds not available in
-# OpenShift yet, for now the easiest is to build the binary in this image.
-FROM golang:1.23-alpine
+# Build stage
+FROM public.ecr.aws/docker/library/golang:1.24-alpine AS builder
+
+RUN apk update  && \
+    apk -i upgrade && \
+    apk cache clean && \
+    mkdir -p /home/webhook-proxy
+
+COPY main.go /home/webhook-proxy/main.go
+COPY go.mod /home/webhook-proxy/go.mod
+
+WORKDIR /home/webhook-proxy
+
+RUN CGO_ENABLED=0 go build -o webhook-proxy
+
+# Final stage
+FROM registry.access.redhat.com/ubi9/ubi-micro:latest
 
 # Set default ALLOWED_EXTERNAL_PROJECTS env var
 ARG allowedExternalProjects=opendevstack
 ENV ALLOWED_EXTERNAL_PROJECTS=$allowedExternalProjects
 
-RUN apk add -i ca-certificates && \
-    apk update  && \
-    apk -i upgrade && \
-    apk cache clean && \
-    mkdir -p /home/webhook-proxy && \
+RUN mkdir -p /home/webhook-proxy && \
     chgrp -R 0 /home/webhook-proxy && \
     chmod g+w /home/webhook-proxy
 
-COPY main.go /home/webhook-proxy/main.go
-COPY go.mod /home/webhook-proxy/go.mod
+COPY --from=builder /home/webhook-proxy/webhook-proxy /home/webhook-proxy/webhook-proxy
 COPY pipeline.json.tmpl /home/webhook-proxy/pipeline.json.tmpl
 
 WORKDIR /home/webhook-proxy
 
-RUN CGO_ENABLED=0 go build -o webhook-proxy
-
 EXPOSE 8080
 
 CMD ./webhook-proxy

jenkins/webhook-proxy/Makefile

@@ -8,7 +8,7 @@ fmt:
 
 lint:
 	golangci-lint --version
-	golangci-lint run --go=1.23
+	golangci-lint run --go=1.24
 
 build: build-linux build-darwin build-windows
 

jenkins/webhook-proxy/go.mod

@@ -1,3 +1,3 @@
 module github.com/opendevstack/ods-core/jenkins/webhook-proxy
 
-go 1.23
+go 1.24.1