Merge branch 'main' into main

.circleci/config.yml

@@ -2,14 +2,14 @@ version: 2
 jobs:
   e2e:
     docker:
-    - image: cimg/go:1.20 # If you update this, update it in the Makefile too
+    - image: cimg/go:1.21 # If you update this, update it in the Makefile too
       environment:
         # This version of TF will be downloaded before Atlantis is started.
         # We do this instead of setting --default-tf-version because setting
         # that flag starts the download asynchronously so we'd have a race
         # condition.
         # renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp
-        TERRAFORM_VERSION: 1.5.3
+        TERRAFORM_VERSION: 1.5.7
     steps:
     - checkout
     - run: make build-service

.github/release.yml

@@ -2,7 +2,6 @@ changelog:
   exclude:
     labels:
       - ignore-for-release
-      - docs
       - github-actions
     authors:
       - octocat
@@ -22,9 +21,3 @@ changelog:
     - title: Other Changes
       labels:
         - "*"
-    - title: Dependencies
-      labels:
-        - dependencies
-    - title: Build
-      labels:
-        - build

.github/renovate.json5

@@ -25,6 +25,12 @@
     ],
   },
   packageRules: [
+    // For vuepress
+    {
+      "matchPackageNames": ["vuepress", "@vuepress/client", "@vuepress/markdown", "@vuepress/utils"],
+      "groupName": "vuepress",
+      "allowedVersions": "!/pre.*$/",
+    },
     // e2e test depends on testing/Dockefile testing-image which has conftest specific version.
     // to upgrade conftest versions, we need following PRs.
     // 1. update testing/Dockerfile conftest version

.github/workflows/atlantis-image-required.yml

@@ -11,8 +11,6 @@ on:
       - '.github/workflows/atlantis-image.yml'
       - '**.go'
       - 'go.*'
-      - 'yarn.lock'
-      - 'package.json'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}

.github/workflows/atlantis-image.yml

@@ -14,8 +14,6 @@ on:
       - '.github/workflows/atlantis-image.yml'
       - '**.go'
       - 'go.*'
-      - 'yarn.lock'
-      - 'package.json'
   workflow_dispatch:
 
 concurrency:
@@ -35,7 +33,7 @@ jobs:
       PUSH: ${{ github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')) }}
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
 
     # Lint the Dockerfile first before setting anything up
     - name: Lint Dockerfile
@@ -44,13 +42,13 @@ jobs:
         dockerfile: "Dockerfile"
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@v3
       with:
         image: tonistiigi/binfmt:latest
         platforms: arm64,arm
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@v3
       # https://github.com/docker/build-push-action/issues/761#issuecomment-1575006515
       with:
         driver-opts: |
@@ -64,7 +62,7 @@ jobs:
     # if it's v0.10.0 and debian, it will do v0.10.0-debian, latest-debian
     - name: Docker meta
       id: meta
-      uses: docker/metadata-action@v4
+      uses: docker/metadata-action@v5
       env:
         SUFFIX: ${{ format('-{0}', matrix.image_type) }}
       with:
@@ -96,7 +94,7 @@ jobs:
           # Suffix is not used here since there's no way to disable it above
 
     - name: Login to Packages Container registry
-      uses: docker/login-action@v2
+      uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
@@ -109,7 +107,7 @@ jobs:
 
     - name: "Build ${{ env.PUSH == 'true' && 'and push' || '' }} ${{ env.DOCKER_REPO }} image"
       if: contains(fromJson('["push", "pull_request"]'), github.event_name)
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@v5
       with:
         cache-from: type=gha
         cache-to: type=gha,mode=max

.github/workflows/codeql.yml

@@ -53,7 +53,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/lint-required.yml

@@ -15,7 +15,9 @@ on:
     paths-ignore:
       - '**.go'
       - 'go.*'
-      - '.github/workflows/linter.yml'
+      - '.github/workflows/lint.yml'
+      - '.github/workflows/lint-required.yml'
+      - '.golangci.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -28,17 +30,3 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - run: 'echo "No build required"'
-
-  revive:
-    if: github.event.pull_request.draft == false
-    name: runner / revive
-    runs-on: ubuntu-22.04
-    steps:
-      - run: 'echo "No build required"'
-
-  errcheck:
-    if: github.event.pull_request.draft == false
-    name: runner / errcheck
-    runs-on: ubuntu-22.04
-    steps:
-      - run: 'echo "No build required"'

.github/workflows/lint.yml

@@ -12,7 +12,8 @@ on:
     paths:
       - '**.go'
       - 'go.*'
-      - '.github/workflows/linter.yml'
+      - '.github/workflows/lint.yml'
+      - '.golangci.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -24,39 +25,8 @@ jobs:
     name: runner / golangci-lint
     runs-on: ubuntu-22.04
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v4
     - name: golangci-lint
       uses: reviewdog/action-golangci-lint@v2
       with:
-        github_token: ${{ secrets.GITHUB_TOKEN }}
         tool_name: golangci-lint
-
-  # Use revive via golangci-lint binary with "warning" level.
-  revive:
-    if: github.event.pull_request.draft == false
-    name: runner / revive
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-      - name: revive
-        uses: reviewdog/action-golangci-lint@v2
-        with:
-          golangci_lint_flags: "--disable-all -E revive"
-          tool_name: revive # Change reporter name.
-          level: warning # GitHub Status Check won't become failure with this level.
-
-  # You can add more and more supported linters with different config.
-  errcheck:
-    if: github.event.pull_request.draft == false
-    name: runner / errcheck
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Check out code into the Go module directory
-        uses: actions/checkout@v3
-      - name: errcheck
-        uses: reviewdog/action-golangci-lint@v2
-        with:
-          golangci_lint_flags: "--disable-all -E errcheck"
-          tool_name: errcheck
-          level: info

.github/workflows/release.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         submodules: true
 
@@ -22,7 +22,7 @@ jobs:
         go-version-file: go.mod
 
     - name: Run GoReleaser for stable release
-      uses: goreleaser/goreleaser-action@v4
+      uses: goreleaser/goreleaser-action@v5
       if: (!contains(github.ref, 'pre'))
       with:
         version: v1.16.2
@@ -45,7 +45,7 @@ jobs:
         GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
 
     - name: Run GoReleaser for pre-release
-      uses: goreleaser/goreleaser-action@v4
+      uses: goreleaser/goreleaser-action@v5
       if: contains(github.ref, 'pre')
       with:
         version: v1.16.2

.github/workflows/renovate-config.yml

@@ -15,6 +15,6 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: actions/setup-node@v3
       - run: npx --package renovate -c 'renovate-config-validator'

.github/workflows/test.yml

@@ -4,10 +4,6 @@ on:
   push:
     branches:
       - "main"
-    paths:
-      - '**.go'
-      - 'go.*'
-      - '.github/workflows/test.yml'
   pull_request:
     types:
       - opened
@@ -16,60 +12,42 @@ on:
       - ready_for_review
     branches:
       - "main"
-    paths:
-      - '**.go'
-      - 'go.*'
-      - '.github/workflows/test.yml'
-
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-  test:
+  changes:
+    outputs:
+      should-run-tests: ${{ steps.changes.outputs.go == 'true' }}
     if: github.event.pull_request.draft == false
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            go:
+              - '**.go'
+              - 'go.*'
+              - '.github/workflows/test.yml'
+  test:
+    needs: [changes]
+    if: needs.changes.outputs.should-run-tests == 'true'
     name: runner / gotest
     runs-on: ubuntu-22.04
     container: ghcr.io/runatlantis/testing-env:latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: make test-all
       - run: make check-fmt
 
-  # Check that there's no missing links for the website.
-  # This job builds the website, starts a server to serve it, and then uses
-  # muffet (https://github.com/raviqqe/muffet) to perform the link check.
-  website_link_check:
-    if: github.event.pull_request.draft == false
+  skip-test:
+    needs: [changes]
+    if: needs.changes.outputs.should-run-tests == 'false'
+    name: runner / gotest
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v3
-
-      - uses: actions/setup-node@v3
-        with:
-          node-version-file: .node-version
-
-      - name: run http-server
-        env:
-          # renovate: datasource=github-releases depName=raviqqe/muffet
-          MUFFET_VERSION: 2.6.3
-        run: |
-          npm install -g yarn
-          # http-server is used to serve the website locally as muffet checks it.
-          yarn global add http-server
-          # install raviqqe/muffet to check for broken links.
-          curl -L https://github.com/raviqqe/muffet/releases/download/v${MUFFET_VERSION}/muffet_${MUFFET_VERSION}_Linux_x86_64.tar.gz | tar -xz
-          yarn install
-          yarn website:build
-          http-server runatlantis.io/.vuepress/dist &
-
-      - name: wait until server listened
-        run: curl --retry-delay 1 --retry 30 --retry-all-error http://localhost:8080
-
-      - run: |
-          ./muffet \
-            -e 'https://github\.com/runatlantis/atlantis/edit/main/.*' \
-            -e 'https://github.com/runatlantis/helm-charts#customization' \
-            --header 'Accept-Encoding:deflate, gzip' \
-            --buffer-size 8192 \
-            http://localhost:8080/
+      - run: 'echo "No build required"'