🌱 Update Github Actions group to v4.0.0

.builder-image-version.txt

@@ -1 +1 @@
-1.0.23
+1.0.25

.github/actions/e2e/action.yaml

@@ -23,6 +23,8 @@ runs:
   using: "composite"
   steps:
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      with:
+        go-version-file: "go.mod"
 
     - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
       with:
@@ -41,8 +43,11 @@ runs:
     - name: Install hcloud
       shell: bash
       env:
-        hcloudctl_version: 1.40.0
-      run: curl -fsSL https://github.com/hetznercloud/cli/releases/download/v${{ env.hcloudctl_version }}/hcloud-linux-amd64.tar.gz | tar -xzv hcloud ; mv hcloud hack/tools/bin/hcloud
+        hcloudctl_version: v1.52.0
+      run: |
+        curl -fsSL https://github.com/hetznercloud/cli/releases/download/${{ env.hcloudctl_version }}/hcloud-linux-amd64.tar.gz | tar -xzv hcloud
+        mkdir -p hack/tools/bin/
+        mv hcloud hack/tools/bin/hcloud
 
     - name: Generate metadata
       id: meta

.github/actions/fixes/action.yaml

@@ -0,0 +1,25 @@
+name: Fix env var HOME and git permissions
+description: Fix env var HOME and git permissions
+runs:
+  using: "composite"
+  steps:
+  - name: Fix HOME Directory
+    shell: bash
+    run: |
+      # Issue [HOME is overridden for containers](https://github.com/actions/runner/issues/863)
+      h=$(getent passwd $(id -un) | cut -d: -f6)
+      if [ "$h" = "$HOME" ]; then
+        echo "HOME fine: $HOME"
+        exit 0
+      fi
+      echo "HOME=$HOME was broken. Setting it to $h"
+      ls -ld $HOME
+      ls -ld $h
+      echo "USER: $USER"
+      echo "id: $(id)"
+      echo "HOME=$h" >> $GITHUB_ENV
+
+  - name: Fixup git permissions
+    # https://github.com/actions/checkout/issues/766
+    shell: bash
+    run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

.github/actions/test-release/action.yaml

@@ -4,6 +4,8 @@ runs:
   using: "composite"
   steps:
     - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+      with:
+        go-version-file: "go.mod"
 
     - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
       with:

.github/workflows/build.yml

@@ -33,6 +33,8 @@ jobs:
           fetch-depth: 0
 
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: "go.mod"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
@@ -55,7 +57,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Install Bom
         shell: bash

.github/workflows/main-promote-builder-image.yml

@@ -10,7 +10,7 @@ jobs:
     name: Promote Latest tag to Caph Builder Image
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/syself/caph-builder:1.0.23
+      image: ghcr.io/syself/caph-builder:1.0.25
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.github_token }}

.github/workflows/pr-e2e.yaml

@@ -38,9 +38,20 @@ jobs:
     name: Test Release
     if: github.event_name != 'pull_request' || !github.event.pull_request.draft
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/syself/caph-builder:1.0.25
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.github_token }}
+    env:
+      BUILD_IN_CONTAINER: "false"
     steps:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Fix broken env var HOME
+        uses: ./.github/actions/fixes
+
       - name: Test Release
         id: manager-image
         uses: ./.github/actions/test-release

.github/workflows/pr-lint.yml

@@ -22,7 +22,7 @@ jobs:
     name: "Lint Pull Request"
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/syself/caph-builder:1.0.23
+      image: ghcr.io/syself/caph-builder:1.0.25
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.github_token }}

.github/workflows/pr-verify.yml

@@ -10,13 +10,26 @@ jobs:
       pull-requests: write
       issues: write
     runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/syself/caph-builder:1.0.25
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.github_token }}
     name: Verify Pull Request
     steps:
       - name: Checkout repository
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
+      - name: Fix Env Var HOME
+        uses: ./.github/actions/fixes
+        # Fixes:
+        #   fatal: detected dubious ownership in repository at '/__w/clu...
+        #   To add an exception for this directory, call:
+        #   git config --global --add safe.directory /__w...
+
       # Take from https://github.com/kubernetes-sigs/kubebuilder/blob/master/.github/workflows/verify.yml
       - name: Validate PR Title Format
+        shell: bash
         env:
           TITLE: ${{ github.event.pull_request.title }}
         run: |
@@ -48,13 +61,17 @@ jobs:
       - name: Verify Starlark
         run: make verify-starlark
 
+      - name: Verify Generated Files of Git Repo
+        run: make BUILD_IN_CONTAINER=false verify-generated-files
+
       - uses: actions/setup-node@cdca7365b2dadb8aad0a33bc7601856ffabcc48e # v4
         with:
           node-version: "22"
       - name: Install renovate
         run: npm i -g renovate@35.54.0 # TODO update this via renovatebot
 
       - name: Validate config
+        shell: bash
         run: |
           for file in $(find . -name "*.json5"); do
             renovate-config-validator ${file}

.github/workflows/release.yml

@@ -24,6 +24,8 @@ jobs:
           fetch-depth: 0
 
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: "go.mod"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
@@ -46,7 +48,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Cosign
-        uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
+        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
       - name: Install Bom
         shell: bash
@@ -138,6 +140,8 @@ jobs:
           fetch-depth: 0
 
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: "go.mod"
 
       - name: install kustomize
         run: |

.github/workflows/report-bin-size.yml

@@ -17,6 +17,8 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: "go.mod"
 
       - name: Create Binsize Report
         run: make caph report-binsize-treemap-all

.github/workflows/schedule-scan-image.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository == 'syself/cluster-api-provider-hetzner'
     container:
-      image: ghcr.io/syself/caph-builder:1.0.23
+      image: ghcr.io/syself/caph-builder:1.0.25
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.github_token }}

.github/workflows/test.yml

@@ -41,6 +41,8 @@ jobs:
           echo name=${NAME} >> $GITHUB_OUTPUT
 
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
+        with:
+          go-version-file: "go.mod"
 
       - name: Install dependencies
         run: make gotestsum go-cover-treemap setup-envtest

.gitignore

@@ -8,6 +8,7 @@ bin
 hack/tools/bin
 testbin/*
 temp
+/tmp
 # Test binary, build with `go test -c`
 *.test
 .coverage

.golangci.yaml

@@ -83,8 +83,6 @@ linters-settings:
         alias: bootstrapv1
       - pkg: sigs.k8s.io/controller-runtime/pkg/metrics/server
         alias: metricsserver
-      - pkg: sigs.k8s.io/cluster-api/errors
-        alias: capierrors
       - pkg: sigs.k8s.io/controller-runtime/pkg/client/fake
         alias: fakeclient
   nolintlint:

.mockery.yaml

@@ -0,0 +1,18 @@
+# This config was chosen, so that the output matches to old structure (pre config file .mockery.yaml).
+# If you are here to copy this config to a new project, then it might
+# make sense to choose a structure which needs less config by using
+# the default values of Mockery.
+all: True
+filename: "{{.InterfaceName}}.go"
+mockname: "{{.InterfaceName}}"
+outpkg: mocks
+packages:
+  github.com/syself/cluster-api-provider-hetzner/pkg/services/baremetal/client/ssh:
+    config:
+      dir: "{{.InterfaceDir}}/../mocks/ssh"
+  github.com/syself/cluster-api-provider-hetzner/pkg/services/baremetal/client/robot:
+    config:
+      dir: "{{.InterfaceDir}}/../mocks/robot"
+  github.com/syself/cluster-api-provider-hetzner/pkg/services/hcloud/client:
+    config:
+      dir: "{{.InterfaceDir}}/mocks"