github/distribution
1
0
Fork 0
mirror of https://github.com/distribution/distribution.git synced 2026-01-30 05:58:28 +00:00
Code Issues Projects Releases Wiki Activity
5,453 Commits 28 Branches 6 Tags
753d64b6775ee456abcb9f273108b541a122fc8e
Commit Graph

111 Commits

Author SHA1 Message Date
Milos Gajdos
bc6e81e1b9 Add Go 1.22 support to CI (#4314) 2024-04-08 12:15:39 +01:00
Milos Gajdos
0d1792f55f build(deps): bump fossa-contrib/fossa-action from 2 to 3 (#4232) 2024-04-02 10:11:05 +01:00
Austin Vazquez
21c718d58c Add Go 1.22 support to CI 
This change adds Go 1.22 to the Go version matrix in CI and updates all
Dockerfiles to use Go 1.21.8.

Signed-off-by: Austin Vazquez <macedonv@amazon.com>
 2024-03-27 15:59:13 +00:00
Joyce Brum
fdbb3a8288 fix: upgrade scorecard version 
Signed-off-by: Joyce Brum <joycebrum@google.com>
 2024-03-26 11:28:03 -03:00
Ismail Alidzhikov
1cb89e3e0e Update go versions 
Signed-off-by: Ismail Alidzhikov <i.alidjikov@gmail.com>
 2024-03-15 10:57:53 +02:00
dependabot[bot]
939061d102 build(deps): bump codecov/codecov-action from 3 to 4 
Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3 to 4.
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v3...v4)

---
updated-dependencies:
- dependency-name: codecov/codecov-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-02-01 01:51:49 +00:00
dependabot[bot]
e5f5ff7a11 build(deps): bump peter-evans/dockerhub-description from 3 to 4 
Bumps [peter-evans/dockerhub-description](https://github.com/peter-evans/dockerhub-description) from 3 to 4.
- [Release notes](https://github.com/peter-evans/dockerhub-description/releases)
- [Commits](https://github.com/peter-evans/dockerhub-description/compare/v3...v4)

---
updated-dependencies:
- dependency-name: peter-evans/dockerhub-description
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-26 02:05:37 +00:00
dependabot[bot]
ee58e3438f build(deps): bump actions/upload-artifact from 4.1.0 to 4.3.0 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.1.0 to 4.3.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v4.1.0...v4.3.0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-24 01:42:26 +00:00
Milos Gajdos
01b4555d59 docs: add rendering hook and fix broken links (#4247) 2024-01-17 08:18:02 +07:00
Erez Rokah
c78c156139 Update labeler.yml 
Signed-off-by: Erez Rokah <erezrokah@users.noreply.github.com>
 2024-01-16 18:55:32 +02:00
Erez Rokah
65c6a6d377 Update .github/labeler.yml 
Co-authored-by: James Hewitt <james.hewitt@gmail.com>
Signed-off-by: Erez Rokah <erezrokah@users.noreply.github.com>
 2024-01-16 18:54:54 +02:00
erezrokah
b1d1be8e87 chore: Migrate PR labeler config to v5 
Signed-off-by: erezrokah <erezrokah@users.noreply.github.com>
 2024-01-16 15:22:02 +00:00
erezrokah
a626871f12 chore: Sort entries 
Signed-off-by: erezrokah <erezrokah@users.noreply.github.com>
 2024-01-16 14:07:24 +00:00
erezrokah
d2c57396e0 chore: Remove area/config duplicate entry in labeler.yml 
Signed-off-by: erezrokah <erezrokah@users.noreply.github.com>
 2024-01-16 13:34:45 +00:00
Erez Rokah
45cea887eb chore: Remove duplicate area/ci entry in PR labeler 
Signed-off-by: Erez Rokah <erezrokah@users.noreply.github.com>
 2024-01-16 15:07:19 +02:00
Milos Gajdos
bf6f5c3f74 fix: add labeler action (#4213) 2024-01-16 17:23:39 +07:00
dependabot[bot]
ef1db8ac26 build(deps): bump actions/upload-artifact from 3.0.0 to 4.1.0 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 3.0.0 to 4.1.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v3...v4.1.0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-15 09:40:46 +00:00
David Karlsson
5e75227fb2 docs: fix broken links and improve link resolution 
Update the formatting of links and add a Markdown render hook for
handling relative internal links. Cross-references between markdown
files are now resolved the same way in both GitHub and Hugo.

Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
 2024-01-14 21:33:55 +01:00
CrazyMax
6b14735dbf ci: disable provenance when generating docs 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2024-01-12 12:35:51 +01:00
CrazyMax
f09bf31f3e ci: handle provenance for built artifacts 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2024-01-12 12:35:51 +01:00
dependabot[bot]
f4a3149a2f build(deps): bump docker/bake-action from 2 to 4 
Bumps [docker/bake-action](https://github.com/docker/bake-action) from 2 to 4.
- [Release notes](https://github.com/docker/bake-action/releases)
- [Commits](https://github.com/docker/bake-action/compare/v2...v4)

---
updated-dependencies:
- dependency-name: docker/bake-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-12 10:03:05 +00:00
Wang Yan
9dfead3d9a build(deps): bump docker/setup-buildx-action from 2 to 3 (#4230) 2024-01-12 18:01:57 +08:00
dependabot[bot]
5c585db74e build(deps): bump docker/metadata-action from 4 to 5 
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 4 to 5.
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Upgrade guide](https://github.com/docker/metadata-action/blob/master/UPGRADE.md)
- [Commits](https://github.com/docker/metadata-action/compare/v4...v5)

---
updated-dependencies:
- dependency-name: docker/metadata-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-04 01:55:09 +00:00
dependabot[bot]
5c5d8d3ddd build(deps): bump docker/login-action from 2 to 3 
Bumps [docker/login-action](https://github.com/docker/login-action) from 2 to 3.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-03 02:03:24 +00:00
David Karlsson
fc992dfef7 build(deps): bump actions/upload-pages-artifact from 2 to 3 
Fixes artifact fetching failure by ensuring compatibility with actions/artifact@v4

Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
 2024-01-02 13:17:06 +01:00
dependabot[bot]
87ae3eb8d4 build(deps): bump fossa-contrib/fossa-action from 2 to 3 
Bumps [fossa-contrib/fossa-action](https://github.com/fossa-contrib/fossa-action) from 2 to 3.
- [Release notes](https://github.com/fossa-contrib/fossa-action/releases)
- [Changelog](https://github.com/fossa-contrib/fossa-action/blob/master/CHANGELOG.md)
- [Commits](https://github.com/fossa-contrib/fossa-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: fossa-contrib/fossa-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-01 01:54:25 +00:00
dependabot[bot]
f234296646 build(deps): bump docker/setup-buildx-action from 2 to 3 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 2 to 3.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/v2...v3)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-01-01 01:54:07 +00:00
Milos Gajdos
a808a5bb0e build(deps): bump actions/configure-pages from 3 to 4 (#4227) 2023-12-30 09:54:08 +00:00
Milos Gajdos
ec0a477324 build(deps): bump actions/setup-go from 3 to 5 (#4228) 2023-12-30 09:53:57 +00:00
Milos Gajdos
51a7c2bdf8 build(deps): bump actions/checkout from 3 to 4 (#4226) 2023-12-30 09:53:48 +00:00
Milos Gajdos
8ab33dd8ad build(deps): bump actions/deploy-pages from 2 to 4 (#4224) 2023-12-30 09:53:37 +00:00
dependabot[bot]
78a6be85ee build(deps): bump actions/setup-go from 3 to 5 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3 to 5.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](https://github.com/actions/setup-go/compare/v3...v5)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-29 23:06:07 +00:00
dependabot[bot]
f0a669540e build(deps): bump actions/configure-pages from 3 to 4 
Bumps [actions/configure-pages](https://github.com/actions/configure-pages) from 3 to 4.
- [Release notes](https://github.com/actions/configure-pages/releases)
- [Commits](https://github.com/actions/configure-pages/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/configure-pages
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-29 23:06:03 +00:00
dependabot[bot]
38a2d53c7b build(deps): bump actions/checkout from 3 to 4 
Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-29 23:06:01 +00:00
dependabot[bot]
ba702e1d7c build(deps): bump github/codeql-action from 1.0.26 to 3.22.12 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1.0.26 to 3.22.12.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Commits](https://github.com/github/codeql-action/compare/v1.0.26...v3.22.12)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-29 23:05:55 +00:00
dependabot[bot]
af2fa0ff4d build(deps): bump actions/deploy-pages from 2 to 4 
Bumps [actions/deploy-pages](https://github.com/actions/deploy-pages) from 2 to 4.
- [Release notes](https://github.com/actions/deploy-pages/releases)
- [Commits](https://github.com/actions/deploy-pages/compare/v2...v4)

---
updated-dependencies:
- dependency-name: actions/deploy-pages
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-12-29 23:05:37 +00:00
Milos Gajdos
ea02d9c42e fix: add labeler action 
Whilst we had added labeles to GHA config, we forgot to add the actual
action doing the labeling.

Co-authored-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-12-23 20:39:31 +00:00
CrazyMax
7838a369a3 chore: dependabot to keep gha up to date 
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
 2023-12-23 15:10:52 +01:00
Milos Gajdos
012adcae7d feat: add PR labeler (#4205) 2023-12-22 09:35:39 +00:00
Milos Gajdos
e96fce1703 feat: add PR labeler 
This is an initial commit to kickstart a conversation about how we want
the new PRs to be labeled. TBC.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-12-22 09:22:15 +00:00
Milos Gajdos
535b65869b feat: add GH issue template 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-12-20 14:24:15 +00:00
Milos Gajdos
f3ba0acd24 update: bump Go runtime to 1.21.5 and the rest to latest 1.20 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-12-06 10:32:40 +00:00
Milos Gajdos
2cf416400e update: missed the CI workflow 
Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-12-01 08:58:46 +00:00
Milos Gajdos
ecb475a232 feat: push distribution images to GHCR (#4130) 2023-10-31 21:29:16 +00:00
Milos Gajdos
da92c34ae9 ci: add cloud storage driver integration tests to CI 
* include storage integration tests in the build matrix
* add a new CI job that runs E2E tests backed by S3 storage driver

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-10-25 17:17:50 +01:00
Milos Gajdos
3831c8ccb4 feat: push distribution images to GHCR 
This addition enables pushing distribution images into GHCR.
This is in addition to the Docker Hub push which remains in place.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-10-25 11:37:01 +01:00
Sebastiaan van Stijn
46d13ff75b update to go1.20.10, test go1.21.3 
go1.20.10 (released 2023-10-10) includes a security fix to the net/http package.
See the Go 1.20.10 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.10+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.20.9...go1.20.10

From the security mailing:

[security] Go 1.21.3 and Go 1.20.10 are released

Hello gophers,

We have just released Go versions 1.21.3 and 1.20.10, minor point releases.

These minor releases include 1 security fixes following the security policy:

- net/http: rapid stream resets can cause excessive work

  A malicious HTTP/2 client which rapidly creates requests and
  immediately resets them can cause excessive server resource consumption.
  While the total number of requests is bounded to the
  http2.Server.MaxConcurrentStreams setting, resetting an in-progress
  request allows the attacker to create a new request while the existing
  one is still executing.

  HTTP/2 servers now bound the number of simultaneously executing
  handler goroutines to the stream concurrency limit. New requests
  arriving when at the limit (which can only happen after the client
  has reset an existing, in-flight request) will be queued until a
  handler exits. If the request queue grows too large, the server
  will terminate the connection.

  This issue is also fixed in golang.org/x/net/http2 v0.17.0,
  for users manually configuring HTTP/2.

  The default stream concurrency limit is 250 streams (requests)
  per HTTP/2 connection. This value may be adjusted using the
  golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams
  setting and the ConfigureServer function.

  This is CVE-2023-39325 and Go issue https://go.dev/issue/63417.
  This is also tracked by CVE-2023-44487.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-10-19 10:45:12 +02:00
Sebastiaan van Stijn
9cc6e5b27f update to go1.20.9, test go1.21.2 
go1.20.9 (released 2023-10-05) includes one security fixes to the cmd/go package,
as well as bug fixes to the go command and the linker. See the Go 1.20.9
milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.9+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.20.8...go1.20.9

From the security mailing:

[security] Go 1.21.2 and Go 1.20.9 are released

Hello gophers,

We have just released Go versions 1.21.2 and 1.20.9, minor point releases.

These minor releases include 1 security fixes following the security policy:

- cmd/go: line directives allows arbitrary execution during build

  "//line" directives can be used to bypass the restrictions on "//go:cgo_"
  directives, allowing blocked linker and compiler flags to be passed during
  compliation. This can result in unexpected execution of arbitrary code when
  running "go build". The line directive requires the absolute path of the file in
  which the directive lives, which makes exploting this issue significantly more
  complex.

  This is CVE-2023-39323 and Go issue https://go.dev/issue/63211.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
 2023-10-19 10:44:38 +02:00
Milos Gajdos
1d410148ef Update dockerhub-readme GH Action (#4105) 2023-10-16 19:10:39 +01:00
Milos Gajdos
777ad03208 Update docs GHA 
Add missing steps to the job, pick up the path automatically, trigger
the job on config file changes.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
 2023-10-15 11:03:23 +01:00