Merge branch 'master' into chore_update_lint

.github/pull_request_template.md

@@ -2,7 +2,7 @@ Checklist:
 
 * [ ] Either (a) I've created an [enhancement proposal](https://github.com/argoproj/argo-rollouts/issues/new/choose) and discussed it with the community, (b) this is a bug fix, or (c) this is a chore.
 * [ ] The title of the PR is (a) [conventional](https://www.conventionalcommits.org/en/v1.0.0/) with a list of types and scopes found [here](https://github.com/argoproj/argo-rollouts/blob/master/.github/workflows/pr-title-check.yml), (b) states what changed, and (c) suffixes the related issues number. E.g. `"fix(controller): Updates such and such. Fixes #1234"`.  
-* [ ] I've signed my commits with [DCO](https://github.com/argoproj/argoproj)
+* [ ] I've signed my commits with [DCO](https://github.com/argoproj/argoproj/blob/main/community/CONTRIBUTING.md#legal)
 * [ ] I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
 * [ ] My builds are green. Try syncing with master if they are not. 
-* [ ] My organization is added to [USERS.md](https://github.com/argoproj/argo-rollouts/blob/master/USERS.md).
+* [ ] My organization is added to [USERS.md](https://github.com/argoproj/argo-rollouts/blob/master/USERS.md).

.github/workflows/gh-pages.yaml

@@ -24,7 +24,7 @@ jobs:
         with:
           python-version: 3.x
       - name: Set up Go
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: '1.22'
       - name: build

.github/workflows/go.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       - name: Checkout code
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: ${{ env.GOLANG_VERSION }}
         id: go
@@ -72,7 +72,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Setup Golang
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: ${{ env.GOLANG_VERSION }}
       # k8s codegen generates files into GOPATH location instead of the GitHub git checkout location

.github/workflows/image-reuse.yaml

@@ -69,17 +69,17 @@ jobs:
         if: ${{ github.ref_type != 'tag'}}
 
       - name: Setup Golang
-        uses: actions/setup-go@v5.0.2 # v3.5.0
+        uses: actions/setup-go@v5.1.0 # v3.5.0
         with:
           go-version: ${{ inputs.go-version }}
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
         with:
           cosign-release: 'v2.2.0'
 
       - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
-      - uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+      - uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
 
       - name: Setup tags for container image as a CSV type
         run: |

.github/workflows/release.yaml

@@ -90,15 +90,15 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Golang
-        uses: actions/setup-go@v5.0.2 # v4.0.1
+        uses: actions/setup-go@v5.1.0 # v4.0.1
         with:
           go-version: ${{ env.GOLANG_VERSION }}
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
+        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
 
       - name: Generate release artifacts
         run: |
@@ -107,7 +107,7 @@ jobs:
           make manifests IMAGE_TAG=${{ github.ref_name }}
 
       - name: Draft release
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v0.1.15
+        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v0.1.15
         with:
           tag_name: ${{ github.event.inputs.tag }}
           draft: true
@@ -163,12 +163,12 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Golang
-        uses: actions/setup-go@v5.0.2 # v4.0.0
+        uses: actions/setup-go@v5.1.0 # v4.0.0
         with:
           go-version: ${{ env.GOLANG_VERSION }}
 
       - name: Install cosign
-        uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
         with:
           cosign-release: 'v2.2.0'
 
@@ -212,7 +212,7 @@ jobs:
             /tmp/sbom.tar.gz
 
       - name: Upload SBOM and signature assets
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v0.1.15
+        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v0.1.15
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/testing.yaml

@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: ${{ env.GOLANG_VERSION }}
         id: go
@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: '1.22'
       - uses: actions/checkout@v4
@@ -165,7 +165,7 @@ jobs:
       - test-e2e
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v5.0.2
+        uses: actions/setup-go@v5.1.0
         with:
           go-version: ${{ env.GOLANG_VERSION }}
         id: go
@@ -184,7 +184,7 @@ jobs:
         run: |
           go tool covdata textfmt -i=coverage-output-unit/,coverage-output-e2e/ -o full-coverage.out
       - name: Upload code coverage information to codecov.io
-        uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4.5.0
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
         with:
           file: full-coverage.out
           fail_ci_if_error: false

USERS.md

@@ -1,4 +1,5 @@
 ## Who uses Argo Rollouts?
+
 Organizations below are **officially** using Argo Rollouts. Please send a PR with your organization name if you are using Argo Rollouts.
 
 1. [Ada](https://www.ada.cx)
@@ -11,6 +12,7 @@ Organizations below are **officially** using Argo Rollouts. Please send a PR wit
 1. [Bucketplace](https://www.bucketplace.co.kr/)
 1. [BukuKas](https://bukukas.co.id/)
 1. [Calm](https://www.calm.com/)
+1. [CarGurus](https://www.cargurus.com/)
 1. [CircleCI](https://circleci.com/)
 1. [Cloudflare](https://cloudflare.com/)
 1. [Codefresh](https://codefresh.io/)
@@ -25,6 +27,7 @@ Organizations below are **officially** using Argo Rollouts. Please send a PR wit
 1. [Gllue](https://gllue.com)
 1. [Groww](https://groww.in/)
 1. [HashiCorp](https://www.hashicorp.com/)
+1. [Hepsiburada](https://hepsiburada.com/)
 1. [Ibotta](https://home.ibotta.com/)
 1. [Intuit](https://www.intuit.com/)
 1. [New Relic](https://newrelic.com/)
@@ -48,7 +51,8 @@ Organizations below are **officially** using Argo Rollouts. Please send a PR wit
 1. [Skillz](https://www.skillz.com)
 1. [Spotify](https://www.spotify.com/)
 1. [Synamedia](https://www.synamedia.com)
-2. [Trustly](https://www.trustly.com/)
+1. [TBC Bank](https://tbcbank.ge/)
+1. [Trustly](https://www.trustly.com/)
 1. [Tuhu](https://www.tuhu.cn/)
 1. [Twilio SendGrid](https://sendgrid.com)
 1. [Ubie](https://ubie.life/)

docs/analysis/plugins.md

@@ -1,14 +1,16 @@
 # Metric Plugins
 
-!!! important
-    Available since v1.5 - Status: Alpha
+!!! warning "Alpha Feature (Since 1.5.0)"
 
-Argo Rollouts supports getting analysis metrics via 3rd party plugin system. This allows users to extend the capabilities of Rollouts
+    This is an experimental, [alpha-quality](https://github.com/argoproj/argoproj/blob/main/community/feature-status.md#alpha)
+    feature that allows you to support metric providers that are not natively supported.
+
+Argo Rollouts supports getting analysis metrics via 3rd party [plugin system](../plugins.md). This allows users to extend the capabilities of Rollouts
 to support metric providers that are not natively supported. Rollout's uses a plugin library called
 [go-plugin](https://github.com/hashicorp/go-plugin) to do this. You can find a sample plugin
 here: [rollouts-plugin-metric-sample-prometheus](https://github.com/argoproj-labs/rollouts-plugin-metric-sample-prometheus)
 
-## Using a Metric Plugin
+## Installing
 
 There are two methods of installing and using an argo rollouts plugin. The first method is to mount up the plugin executable
 into the rollouts controller container. The second method is to use a HTTP(S) server to host the plugin executable.
@@ -18,9 +20,9 @@ into the rollouts controller container. The second method is to use a HTTP(S) se
 There are a few ways to mount the plugin executable into the rollouts controller container. Some of these will depend on your
 particular infrastructure. Here are a few methods:
 
-* Using an init container to download the plugin executable
-* Using a Kubernetes volume mount with a shared volume such as NFS, EBS, etc.
-* Building the plugin into the rollouts controller container
+- Using an init container to download the plugin executable
+- Using a Kubernetes volume mount with a shared volume such as NFS, EBS, etc.
+- Building the plugin into the rollouts controller container
 
 Then you can use the configmap to point to the plugin executable file location. Example:
 
@@ -37,6 +39,19 @@ data:
 
 ### Using a HTTP(S) server to host the plugin executable
 
+!!! warning "Installing a plugin with http(s)"
+
+    Depending on which method you use to install and the plugin, there are some things to be aware of.
+    The rollouts controller will not start if it can not download or find the plugin executable. This means that if you are using
+    a method of installation that requires a download of the plugin and the server hosting the plugin for some reason is not available and the rollouts
+    controllers pod got deleted while the server was down or is coming up for the first time, it will not be able to start until
+    the server hosting the plugin is available again.
+
+    Argo Rollouts will download the plugin at startup only once but if the pod is deleted it will need to download the plugin again on next startup. Running
+    Argo Rollouts in HA mode can help a little with this situation because each pod will download the plugin at startup. So if a single pod gets
+    deleted during a server outage, the other pods will still be able to take over because there will already be a plugin executable available to it. It is the
+    responsibility of the Argo Rollouts administrator to define the plugin installation method considering the risks of each approach.
+
 Argo Rollouts supports downloading the plugin executable from a HTTP(S) server. To use this method, you will need to
 configure the controller via the `argo-rollouts-config` configmap and set `pluginLocation` to a http(s) url. Example:
 
@@ -52,23 +67,15 @@ data:
       sha256: "dac10cbf57633c9832a17f8c27d2ca34aa97dd3d" #optional sha256 checksum of the plugin executable
 ```
 
-## Some words of caution
+## List of Available Plugins (alphabetical order)
 
-Depending on which method you use to install and the plugin, there are some things to be aware of.
-The rollouts controller will not start if it can not download or find the plugin executable. This means that if you are using
-a method of installation that requires a download of the plugin and the server hosting the plugin for some reason is not available and the rollouts
-controllers pod got deleted while the server was down or is coming up for the first time, it will not be able to start until
-the server hosting the plugin is available again.
+If you have created a plugin, please submit a PR to add it to this list.
 
-Argo Rollouts will download the plugin at startup only once but if the pod is deleted it will need to download the plugin again on next startup. Running
-Argo Rollouts in HA mode can help a little with this situation because each pod will download the plugin at startup. So if a single pod gets
-deleted during a server outage, the other pods will still be able to take over because there will already be a plugin executable available to it. It is the
-responsibility of the Argo Rollouts administrator to define the plugin installation method considering the risks of each approach.
+### [rollouts-plugin-metric-opensearch](https://github.com/argoproj-labs/rollouts-plugin-metric-opensearch)
 
-## List of Available Plugins (alphabetical order)
+- The application is an OpenSearch plugin designed for use with the Argo Rollouts plugin system. This plugin enables the integration of OpenSearch metrics into Argo Rollouts, allowing for advanced metric analysis and monitoring during application rollouts.
+
+### [rollouts-plugin-metric-sample-prometheus](https://github.com/argoproj-labs/rollouts-plugin-metric-sample-prometheus)
 
-#### Add Your Plugin Here
-  * If you have created a plugin, please submit a PR to add it to this list.
-#### [rollouts-plugin-metric-sample-prometheus](https://github.com/argoproj-labs/rollouts-plugin-metric-sample-prometheus)
-  * This is just a sample plugin that can be used as a starting point for creating your own plugin.
-It is not meant to be used in production. It is based on the built-in prometheus provider.
+- This is just a sample plugin that can be used as a starting point for creating your own plugin.
+  It is not meant to be used in production. It is based on the built-in prometheus provider.