Merge branch 'main' into policycheck-success-on-no-projects

.circleci/config.yml

@@ -9,7 +9,7 @@ jobs:
         # that flag starts the download asynchronously so we'd have a race
         # condition.
         # renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp
-        TERRAFORM_VERSION: 1.5.7
+        TERRAFORM_VERSION: 1.6.3
     steps:
     - checkout
     - run: make build-service

.github/cherry-pick-bot.yml

@@ -0,0 +1,2 @@
+enabled: true
+preservePullRequestTitle: true

.github/renovate.json5

@@ -6,6 +6,7 @@
   commitMessageSuffix: " in {{packageFile}}",
   dependencyDashboardAutoclose: true,
   automerge: true,
+  baseBranches: ["main", "/^release\-.*/"],
   platformAutomerge: true,
   labels: ["dependencies"],
   postUpdateOptions: [

.github/workflows/atlantis-image.yml

@@ -4,24 +4,43 @@ on:
   push:
     branches:
       - 'main'
+      - 'release-**'
     tags:
       - v*.*.* # stable release like, v0.19.2
       - v*.*.*-pre.* # pre release like, v0.19.0-pre.calendardate
   pull_request:
-    paths:
-      - 'Dockerfile'
-      - 'docker-entrypoint.sh'
-      - '.github/workflows/atlantis-image.yml'
-      - '**.go'
-      - 'go.*'
+    branches:
+      - 'main'
+      - 'release-**'
   workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
+  changes:
+    outputs:
+      should-run-build: ${{ steps.changes.outputs.src == 'true' }}
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            src:
+              - 'Dockerfile'
+              - 'docker-entrypoint.sh'
+              - '.github/workflows/atlantis-image.yml'
+              - '**.go'
+              - 'go.*'
+
   build:
+    needs: [changes]
+    if: needs.changes.outputs.should-run-build == 'true'
+    name: Build Image
     strategy:
       matrix:
         image_type: [alpine, debian]
@@ -123,3 +142,14 @@ jobs:
         target: ${{ matrix.image_type }}
         labels: ${{ steps.meta.outputs.labels }}
         outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
+
+  skip-build:
+    needs: [changes]
+    if: needs.changes.outputs.should-run-build == 'false'
+    name: Build Image
+    strategy:
+      matrix:
+        image_type: [alpine, debian]
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "No build required"'

.github/workflows/codeql.yml

@@ -13,30 +13,44 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ "main" ]
-    paths:
-      - '**.go'
-      - '**.js'
+    branches:
+      - 'main'
+      - 'release-**'
   pull_request:
     # The branches below must be a subset of the branches above
     types:
       - opened
       - reopened
       - synchronize
       - ready_for_review
-    branches: [ "main" ]
-    paths:
-      - '**.go'
-      - '**.js'
+    branches:
+      - 'main'
+      - 'release-**'
 
   schedule:
     - cron: '17 9 * * 5'
 
 jobs:
+  changes:
+    outputs:
+      should-run-analyze: ${{ steps.changes.outputs.src == 'true' }}
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            src:
+              - '**.go'
+              - '**.js4'
+
   analyze:
+    needs: [changes]
     name: Analyze
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    if: github.event.pull_request.draft == false && needs.changes.outputs.should-run-analyze == 'true'
+    runs-on: ubuntu-22.04
     permissions:
       actions: read
       contents: read
@@ -87,3 +101,14 @@ jobs:
       uses: github/codeql-action/analyze@v2
       with:
         category: "/language:${{matrix.language}}"
+
+  skip-analyze:
+    needs: [changes]
+    if: needs.changes.outputs.should-run-analyze == 'false'
+    name: Analyze
+    strategy:
+      matrix:
+        language: [ 'go', 'javascript' ]
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "No build required"'  

.github/workflows/lint.yml

@@ -9,24 +9,46 @@ on:
       - ready_for_review
     branches:
       - "main"
-    paths:
-      - '**.go'
-      - 'go.*'
-      - '.github/workflows/lint.yml'
-      - '.golangci.yml'
+      - 'release-**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-  golangci-lint:
+  changes:
+    outputs:
+      should-run-linting: ${{ steps.changes.outputs.go == 'true' }}
     if: github.event.pull_request.draft == false
-    name: runner / golangci-lint
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v2
+        id: changes
+        with:
+          filters: |
+            go:
+              - '**.go'
+              - 'go.*'
+              - '.github/workflows/lint.yml'
+              - '.golangci.yml'
+
+  golangci-lint:
+    needs: [changes]
+    if: github.event.pull_request.draft == false && needs.changes.outputs.should-run-linting == 'true'
+    name: Linting
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v4
     - name: golangci-lint
       uses: reviewdog/action-golangci-lint@v2
       with:
         tool_name: golangci-lint
+
+  skip-lint:
+    needs: [changes]
+    if: needs.changes.outputs.should-run-linting == 'false'
+    name: Linting
+    runs-on: ubuntu-22.04
+    steps:
+      - run: 'echo "No build required"'

.github/workflows/pr-lint.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   main:
     name: Validate PR title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

.github/workflows/renovate-config.yml

@@ -6,15 +6,16 @@ on:
       - '.github/renovate.json5'
     branches:
       - main
+      - 'releases-**'
   pull_request:
     paths:
       - '.github/renovate.json5'
   workflow_dispatch:
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
       - run: npx --package renovate -c 'renovate-config-validator'

.github/workflows/stale.yml

@@ -4,7 +4,7 @@ on:
     - cron: '30 1 * * *'
 jobs:
   stale:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/stale@v8
         with: