Fetch upstream

.github/dependabot.yml

@@ -1,3 +1,4 @@
+---
 version: 2
 updates:
   - package-ecosystem: gomod
@@ -17,6 +18,11 @@ updates:
       # Ignore k8s and its transitives modules as they are upgraded manually
       # together with controller-runtime.
       - dependency-name: "k8s.io/*"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"
 
   - package-ecosystem: "docker"
     directory: "/"
@@ -26,3 +32,23 @@ updates:
       - "area/dependency"
       - "release-note-none"
       - "ok-to-test"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: daily
+    open-pull-requests-limit: 10
+    labels:
+      - "area/dependency"
+      - "release-note-none"
+      - "ok-to-test"
+    groups:
+      all:
+        update-types:
+          - "minor"
+          - "patch"

.github/workflows/codespell.yml

@@ -1,15 +1,18 @@
 # Helps catch spelling errors
 name: Codespell
-on: [ pull_request ]
+
+on:
+  pull_request:
 
 jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v2.5.0
-      - uses: codespell-project/actions-codespell@22ff5a2e4b591290baf82d47c9feadac31c65441 # v1.0
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - uses: codespell-project/actions-codespell@94259cd8be02ad2903ba34a22d9c13de21a74461 # v2.0
         with:
-          skip: .git,_artifacts,*.sum
+          skip: .git,_artifacts,*.sum,.golangci.yml
           ignore_words_file: .codespellignore
           check_filenames: true
           check_hidden: true

.github/workflows/cover.yaml

@@ -1,15 +1,20 @@
 # add public code coverage reports
+name: coverage
+
 on:
   push:
     branches:
     - main
+
 jobs:
   coverage:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@master
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
     - run: "make test-cover"
-    - uses: codecov/codecov-action@v2
-    with:
-      file: ./coverage.out
-      fail_ci_if_error: true
+
+    - uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+      with:
+        file: ./coverage.out
+        fail_ci_if_error: true

.github/workflows/link-check.yml

@@ -1,5 +1,6 @@
 # Check for broken links
 name: Link-check
+
 on:
   push:
     paths:
@@ -8,13 +9,16 @@ on:
       - main
   pull_request:
     paths: "docs/**"
+
 jobs:
   lint_docs:
     name: Broken Links
     runs-on: ubuntu-latest
+
     steps:
-    - uses: actions/checkout@v2
-    - uses: gaurav-nelson/github-action-markdown-link-check@v1
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+    - uses: gaurav-nelson/github-action-markdown-link-check@d53a906aa6b22b8979d33bc86170567e619495ec # v1.0.15
       with:
         use-quiet-mode: 'yes'
         config-file: ".markdownlinkcheck.json"

.github/workflows/lint.yml

@@ -1,5 +1,7 @@
 name: Lint
-on: [pull_request]
+
+on:
+  pull_request:
 
 permissions:
   contents: read
@@ -8,14 +10,17 @@ jobs:
   golangci:
     name: lint
     runs-on: ubuntu-latest
+
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+
+      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
           go-version: "1.21"
           check-latest: true
           cache: false
+
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@a4f60bb28d35aeee14e6880718e0c85ff1882e64 # v6.0.1
         with:
-          version: "v1.55"
+          version: v1.58

.github/workflows/pr-gh-workflow-approve.yaml

@@ -11,13 +11,17 @@ on:
 jobs:
   approve:
     name: Approve ok-to-test
+
     if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+
     runs-on: ubuntu-latest
+
     permissions:
       actions: write
+
     steps:
       - name: Update PR
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         continue-on-error: true
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -37,4 +41,4 @@ jobs:
                 repo: context.repo.repo,
                 run_id: run.id
               });
-            }
+            }