Merge pull request #1000 from alexander-demicev/maintenance

✨ Multiple changes to improve code quality

Author: k8s-ci-robot

.github/workflows/golangci-lint.yml

@@ -23,11 +23,11 @@ jobs:
       - name: golangci-lint
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # tag=v9.2.0
         with:
-          version: v2.5.0
+          version: v2.10.1
           args: --timeout 15m
       - name: golangci-lint-test
         uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # tag=v9.2.0
         with:
-          version: v2.5.0
+          version: v2.10.1
           args: --build-tags e2e --timeout 15m
           working-directory: test

.github/workflows/govulncheck.yml

@@ -0,0 +1,24 @@
+name: govulncheck
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+  schedule:
+    # Run weekly on Monday at 07:00 UTC
+    - cron: "0 7 * * 1"
+jobs:
+  govulncheck:
+    name: govulncheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # tag=v4.2.2
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # tag=v6.0.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: Install govulncheck
+        run: go install golang.org/x/vuln/cmd/govulncheck@latest
+      - name: Run govulncheck
+        run: govulncheck ./...

.github/workflows/trivy.yml

@@ -0,0 +1,35 @@
+name: trivy
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+    paths:
+      - "Dockerfile"
+      - "go.mod"
+      - "go.sum"
+  schedule:
+    # Run weekly on Monday at 08:00 UTC
+    - cron: "0 8 * * 1"
+jobs:
+  trivy-scan:
+    name: trivy image scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # tag=v4.2.2
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # tag=v6.0.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: Build image
+        run: |
+          make docker-build CONTROLLER_IMG_TAG=cluster-api-operator:ci
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@97e0b3872f55f89b95b2f65b3dbab56962816478 # tag=0.34.2
+        with:
+          image-ref: "cluster-api-operator:ci"
+          format: "table"
+          exit-code: "1"
+          severity: "CRITICAL,HIGH"
+          ignore-unfixed: true

.golangci.yaml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: "1.24"
+  go: "1.25.7"
   allow-parallel-runners: true
 linters:
   default: none
@@ -55,8 +55,12 @@ linters:
     - usestdlibvars
     - wastedassign
     - whitespace
-    - wsl
+    - wsl_v5
   settings:
+    wsl_v5:
+      allow-first-in-block: true
+      allow-whole-block: false
+      branch-max-lines: 2
     goheader:
       values:
         regexp:
@@ -153,7 +157,7 @@ linters:
       - linters:
           - dogsled
           - gosec
-          - wsl
+          - wsl_v5
         path: internal/envtest/environment.go
       # Not all platforms are supported by this operator, those which aren't
       # supported will be caught by the default case in the switches.

Makefile

@@ -23,7 +23,7 @@ ROOT:=$(shell dirname $(realpath $(firstword $(MAKEFILE_LIST))))
 
 .DEFAULT_GOAL:=help
 
-GO_VERSION ?= 1.24.4
+GO_VERSION ?= 1.25.7
 GO_BASE_CONTAINER ?= docker.io/library/golang
 GO_CONTAINER_IMAGE = $(GO_BASE_CONTAINER):$(GO_VERSION)
 
@@ -83,7 +83,7 @@ CONTROLLER_GEN_VER := v0.19.0
 CONTROLLER_GEN_BIN := controller-gen
 CONTROLLER_GEN := $(TOOLS_BIN_DIR)/$(CONTROLLER_GEN_BIN)-$(CONTROLLER_GEN_VER)
 
-GOLANGCI_LINT_VER := v2.5.0
+GOLANGCI_LINT_VER := v2.10.1
 GOLANGCI_LINT_BIN := golangci-lint
 GOLANGCI_LINT := $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN)-$(GOLANGCI_LINT_VER)
 

api/v1alpha2/addonprovider_wrapper.go

@@ -55,7 +55,7 @@ func (b *AddonProvider) ProviderName() string {
 }
 
 func (b *AddonProviderList) GetItems() []GenericProvider {
-	providers := []GenericProvider{}
+	providers := make([]GenericProvider, 0, len(b.Items))
 
 	for index := range b.Items {
 		providers = append(providers, &b.Items[index])

api/v1alpha2/bootstrapprovider_wrapper.go

@@ -55,7 +55,7 @@ func (b *BootstrapProvider) ProviderName() string {
 }
 
 func (b *BootstrapProviderList) GetItems() []GenericProvider {
-	providers := []GenericProvider{}
+	providers := make([]GenericProvider, 0, len(b.Items))
 
 	for index := range b.Items {
 		providers = append(providers, &b.Items[index])

api/v1alpha2/ipamprovider_wrapper.go

@@ -55,7 +55,7 @@ func (p *IPAMProvider) ProviderName() string {
 }
 
 func (p *IPAMProviderList) GetItems() []GenericProvider {
-	providers := []GenericProvider{}
+	providers := make([]GenericProvider, 0, len(p.Items))
 
 	for index := range p.Items {
 		providers = append(providers, &p.Items[index])

api/v1alpha2/runtimeextensionprovider_wrapper.go

@@ -55,7 +55,7 @@ func (p *RuntimeExtensionProvider) ProviderName() string {
 }
 
 func (p *RuntimeExtensionProviderList) GetItems() []GenericProvider {
-	providers := []GenericProvider{}
+	providers := make([]GenericProvider, 0, len(p.Items))
 
 	for index := range p.Items {
 		providers = append(providers, &p.Items[index])

cmd/main.go

@@ -142,6 +142,7 @@ func main() {
 	pflag.Parse()
 
 	ctrl.SetLogger(textlogger.NewLogger(textlogger.NewConfig()))
+
 	restConfig := ctrl.GetConfigOrDie()
 
 	tlsOptions, metricsOptions, err := flags.GetManagerOptions(managerOptions)