chore: Rollout various templated changes

.github/workflows/general_daily_security.yml

@@ -15,8 +15,12 @@ permissions: {}
 jobs:
   audit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      # rustsec/audit-check publishes its results as a Check run, which requires this scope
+      checks: write
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0

.github/workflows/integration-test-custom.yaml

@@ -0,0 +1,49 @@
+---
+name: Integration Test (Custom)
+
+on:
+  workflow_dispatch:
+    inputs:
+      test-runner:
+        description: Name of the test runner, eg. `amd64` (see test/interu.yaml)
+        required: true
+      test-suite:
+        description: Name of the test-suite, eg. `openshift`
+      test:
+        description: Name of the test, eg. `smoke`
+
+permissions: {}
+
+jobs:
+  test:
+    name: Run Integration Test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Run Integration Test
+        id: test
+        uses: stackabletech/actions/run-integration-test@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4
+        with:
+          replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }}
+          otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }}
+          test-mode-input: ${{ inputs.test-runner }}
+          test-suite: ${{ inputs.test-suite }}
+          test-mode: custom
+          test: ${{ inputs.test }}
+
+      - name: Send Notification
+        if: ${{ failure() || github.run_attempt > 1 }}
+        uses: stackabletech/actions/send-slack-notification@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4
+        with:
+          slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }}
+          failed-tests: ${{ steps.test.outputs.failed-tests }}
+          test-health: ${{ steps.test.outputs.health }}
+          test-result: ${{ steps.test.conclusion }}
+          channel-id: C07UYJYSMSN # notifications-integration-tests
+          type: integration-test

.github/workflows/integration-test-profile.yaml

@@ -0,0 +1,59 @@
+---
+name: Integration Test (Profile + Schedule)
+
+on:
+  schedule:
+    # At 04:00 on Sunday. See: https://crontab.guru/#0_4_*_*_0
+    - cron: "0 4 * * 0"
+  workflow_dispatch:
+    inputs:
+      test-profile:
+        description: Name of the test runner, eg. `smoke-latest` or `schedule` (see test/interu.yaml)
+        required: true
+
+permissions: {}
+
+jobs:
+  test:
+    name: Run Integration Test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: recursive
+
+      - name: Determine Profile
+        id: profile
+        env:
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          PROFILE_INPUT: ${{ inputs.test-profile }}
+        shell: bash
+        run: |
+          if [ "$EVENT_NAME" = "schedule" ]; then
+            echo "PROFILE=schedule" | tee -a "$GITHUB_OUTPUT"
+          else
+            echo "PROFILE=${PROFILE_INPUT}" | tee -a "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run Integration Test
+        id: test
+        uses: stackabletech/actions/run-integration-test@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4
+        with:
+          replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }}
+          otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }}
+          test-mode-input: ${{ steps.profile.outputs.PROFILE }}
+          test-mode: profile
+
+      - name: Send Notification
+        if: ${{ failure() || github.run_attempt > 1 }}
+        uses: stackabletech/actions/send-slack-notification@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4
+        with:
+          slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }}
+          failed-tests: ${{ steps.test.outputs.failed-tests }}
+          test-health: ${{ steps.test.outputs.health }}
+          test-result: ${{ steps.test.conclusion }}
+          channel-id: C07UYJYSMSN # notifications-integration-tests
+          type: integration-test

.github/workflows/pr_prek.yaml

@@ -17,18 +17,20 @@ env:
 jobs:
   prek:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ubuntu-latest
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           submodules: recursive
           fetch-depth: 0
-      - uses: stackabletech/actions/run-prek@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3
+      - uses: stackabletech/actions/run-prek@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4
         with:
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}
           hadolint: ${{ env.HADOLINT_VERSION }}

Makefile

@@ -28,7 +28,7 @@ docker-build:
 	docker build --force-rm --build-arg VERSION=${VERSION} -t "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}" -f docker/Dockerfile .
 
 ## Chart related targets
-compile-chart: version crds
+compile-chart: version crds crd-annotation
 
 version:
 	cat "deploy/helm/${OPERATOR_NAME}/Chart.yaml" | yq ".version = \"${VERSION}\" | .appVersion = \"${VERSION}\"" > "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new"
@@ -40,6 +40,40 @@ crds:
 	mkdir -p extra
 	cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml
 
+# This adds CRD metadata for artifacthub.io (AH) to Chart.yaml.
+# We don't ship CRDs in our Helm charts (anymore), so we need these annotations to provide details.
+# We only list the storage version as we're unsure if AH supports more than one (docs unclear).
+#
+# It appends a single annotation whose value is a list, one entry per CRD.
+# Example: For the secret-operator that comes out as:
+#
+#   artifacthub.io/crds: |-
+#     - kind: SecretClass
+#       version: v1alpha2
+#       name: secretclasses.secrets.stackable.tech
+#       displayName: SecretClass
+#       description: A SecretClass is a cluster-global Kubernetes resource that defines ...
+#     - kind: TrustStore
+#       version: v1alpha1
+#       name: truststores.secrets.stackable.tech
+#       displayName: TrustStore
+#       description: A TrustStore requests information about how to validate secrets ...
+#
+# The two yq expressions are split out below so it's easier to review and see what's going on.
+
+# READ step: turn every CRD document in extra/crds.yaml into one AH card entry.
+# `[.] | map(...)` collects the documents into a list and maps each one to the format (see above) required by AH.
+# The result of this is a list of these entries.
+CRD_ANNOTATION_READ := [.] | map(.spec.versions |= map(select(.storage == true))) | map({"kind": .spec.names.kind, "version": .spec.versions[0].name, "name": .metadata.name, "displayName": .spec.names.kind, "description": (.spec.versions[0].schema.openAPIV3Schema.description // "")})
+
+# WRITE step: Write that list to Chart.yaml as an annotation value.
+# Literal block scalar so it stays readable in Chart.yaml.
+CRD_ANNOTATION_WRITE := .annotations["artifacthub.io/crds"] = strenv(CRDS) | .annotations["artifacthub.io/crds"] style="literal"
+
+crd-annotation: crds
+	@CRDS="$$(yq ea -o=yaml '$(CRD_ANNOTATION_READ)' extra/crds.yaml)" \
+		yq -i '$(CRD_ANNOTATION_WRITE)' "deploy/helm/${OPERATOR_NAME}/Chart.yaml"
+
 chart-lint: compile-chart
 	docker run -it -v $(shell pwd):/build/helm-charts -w /build/helm-charts quay.io/helmpack/chart-testing:v3.5.0  ct lint --config deploy/helm/ct.yaml
 

deploy/helm/nifi-operator/Chart.yaml

@@ -5,6 +5,10 @@ version: "0.0.0-dev"
 appVersion: "0.0.0-dev"
 description: "Kubernetes operator for Apache NiFi. Deploy and run NiFi clusters with the Stackable Data Platform (SDP)."
 home: https://github.com/stackabletech/nifi-operator
+# One known use of this is the Artifact Hub (AH) listing which shows the logo.
+# AH downloads the logo and re-hosts it.
+# We opted to not use the project logos (e.g. the Apache Spark logo) here due to trademark concerns.
+icon: https://raw.githubusercontent.com/stackabletech/nifi-operator/main/.readme/static/borrowed/Icon_Stackable.svg
 sources:
   - https://github.com/stackabletech/nifi-operator
 keywords: ["apache-nifi", "nifi", "dataflow", "etl", "kubernetes", "operator", "big-data"]
@@ -21,3 +25,9 @@ annotations:
       url: https://docs.stackable.tech/home/stable/nifi/
     - name: support
       url: https://github.com/stackabletech/nifi-operator/issues
+  artifacthub.io/crds: |-
+    - kind: NifiCluster
+      version: v1alpha1
+      name: nificlusters.nifi.stackable.tech
+      displayName: NifiCluster
+      description: A NiFi cluster stacklet. This resource is managed by the Stackable operator for Apache NiFi.

renovate.json

@@ -3,5 +3,5 @@
   "extends": [
     "local>stackabletech/.github:renovate-config"
   ],
-  "ignorePaths": [".github/workflows/build.yaml", ".github/workflows/general_daily_security.yml", ".github/workflows/integration-test.yml", ".github/workflows/pr_prek.yaml"]
+  "ignorePaths": [".github/workflows/build.yaml", ".github/workflows/general_daily_security.yml", ".github/workflows/integration-test-custom.yaml", ".github/workflows/integration-test-profile.yaml", ".github/workflows/pr_prek.yaml"]
 }