init and analyze run in the same job in codeql-analysis.yml and
codeql-action refuses to run a mixed pair. Patch releases moved together
through patch-updates; 4.38.0 was the first minor after the subactions
were pinned to SHAs, so it arrived as one pull request per subaction
path and each one failed on its own.
Signed-off-by: Vad1mo <vadim@8gears.com>
The first angular group PRs (#23854, #23856) moved Angular 21 -> 22 and
TypeScript 5.9 -> 7.0.2. They fail npm ci with ERESOLVE (build-angular 21.2.22
peers compiler-cli ^21; compiler-cli 22 peers typescript >=6 <6.1), and with the
set corrected by hand the portal still fails to build with 2459 TypeScript
errors under TS 6 plus a new marked-katex-extension peer from ngx-markdown 22.
An Angular major is a migration, not a bump. Skip version-update:semver-major
for @angular/*, @angular-devkit/*, @angular-eslint/* and typescript in both
src/portal entries so the group keeps delivering 21.x updates; do Angular 22 in
a dedicated PR.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
Every ecosystem entry currently has a single "patch-updates" group, so every
minor and major update arrives as its own pull request. Three sets of packages
need to move together instead. Two of them break the build when they do not,
the third produces conflicting pull requests.
Angular, build failure. Bumping one @angular package alone breaks `npm ci`
with ERESOLVE. From the CI log of #23769, which bumps
@angular/platform-browser from 21.2.20 to 22.1.2 on its own:
npm error code ERESOLVE
npm error While resolving: @angular-devkit/build-angular@21.2.21
npm error Found: @angular/platform-browser@22.1.2
npm error Could not resolve dependency:
npm error peerOptional @angular/platform-browser@"^21.0.0" from
npm error @angular-devkit/build-angular@21.2.21
#23765 and #23767 on main and #23737 and #23738 on release-2.15.0 fail the
same way. typescript and zone.js belong in the group as well:
@angular-devkit/build-angular@21.2.21 declares a peer dependency on
typescript ">=5.9 <6.0" and @angular/core@21.2.20 one on zone.js
"~0.15.0 || ~0.16.0", so neither can move on its own either.
Kubernetes, build failure. The k8s.io modules are released as one set.
Bumping k8s.io/api alone to v0.37.0 while k8s.io/client-go stays at v0.36.3
leaves the tree unbuildable:
k8s.io/client-go@v0.36.3/kubernetes/scheme/register.go:69:2:
no required module provides package k8s.io/api/scheduling/v1alpha2
OpenTelemetry, conflicting pull requests. src/go.mod carries eleven
go.opentelemetry.io modules that are released together. Bumping any one of
them pulls the rest along through minimal version selection, so separate pull
requests each rewrite the same go.mod and go.sum lines and go stale against
each other. They also go stale against main: #23079 raised the exporter to
1.43.0 and with it the whole core set, but main has since moved to 1.44.0, so
merging it would have downgraded otel, otel/sdk and otel/trace. Grouping keeps
the set in one pull request that Dependabot can rebase as a whole.
Groups are listed before "patch-updates" because a dependency is assigned to
the first group it matches. A group only applies to the update kind named by
"applies-to", which defaults to version-updates, so each of the three has a
security-updates twin with the same patterns. Without those, a security update
for a grouped package would still arrive on its own and hit the same failures.
Also add npm entries for src/portal/app-swagger-ui on main and on
release-2.15.0. It is a real npm project with its own package.json and
package-lock.json but has never had an entry here, so Dependabot could only
ever open security updates for it, and those cannot be rebased or recreated.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: switch security reporting to GitHub private vulnerability reporting
Replace the cncf-harbor-security mailing list with GitHub private
vulnerability reporting as the intake channel for security reports,
per goharbor/community#292. Private vulnerability reporting is enabled
on the repository.
- SECURITY.md: point reporters at the Security tab / Report a
vulnerability form; describe the advisory-based triage, CVSS,
in-band CVE request, and temporary private fork workflow; keep the
mailing list only as a fallback for reporters without a GitHub
account and for distributor list membership requests
- Add issue template contact link routing vulnerability reports to
the private advisory form
- Add a security warning to the bug report template
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: make GitHub private reporting the sole intake channel
Address review feedback: drop the mailing-list fallback so there is a
single reporting method, clarify that the reporter can see their own
report, and fix template grammar.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: address review feedback on security reporting switch
- Relax the response SLA: acknowledge within 5 business days, then
investigate and follow up, instead of promising a full investigation
plan within 3 business days.
- Request a CVE from GitHub only where GitHub is eligible as CNA; when
another CNA already covers the affected component, coordinate with
that CNA instead of filing a duplicate.
- Point README.md's vulnerability reporting section at private
vulnerability reporting instead of the security mailing list.
- List cncf-harbor-security@lists.cncf.io again under Mailing lists,
scoped to distributors-list administration, since the Embargo Policy
and membership sections still reference it.
- Split the reporting paragraph, state the GitHub-account requirement as
a deliberate single-channel decision, and stop overloading
'acknowledged' to mean both receipt and triage verdict.
- Disable blank issues so reports cannot bypass the issue chooser and
its security contact link.
- Note that larger artifacts are shared in the temporary private fork;
the advisory form is not documented to accept attachments.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: drop Notary from the dependency example list
Notary is no longer part of Harbor, so listing it as an example
dependency in the vulnerability-scope section is misleading. Also
normalises PGSql to PostgreSQL in the same list.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* docs: drop the Notary feature bullet from README
Notary is no longer part of Harbor, so advertising Docker Content Trust
signing via Notary in the feature list is misleading.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
---------
Signed-off-by: Vadim Bauer <vb@container-registry.com>
Group patch updates to reduce PR noise and update target branches and ecosystems for the 2.15.0 release.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Every third-party and first-party action referenced across
.github/workflows/ was pinned by a mutable version tag (@v7, @v3,
@master, ...). A tag can be repointed by its publisher (or, for
third-party actions, by a compromised maintainer account) to run
different code under the same ref, which several of these workflows
run with real credentials: AWS keys, Docker Hub push creds, and
publish_release.yml's id-token: write OIDC signing.
Pin every `uses:` to the full 40-character commit SHA that the
referenced tag currently resolves to, with a trailing comment noting
the exact release so the intent stays readable and Dependabot
(already configured for the github-actions ecosystem) can keep it
current. Two notes on the exceptions:
- jitterbit/get-changed-files has only ever published a bare `v1`
tag (no dotted release exists), so `# v1` is already the most
precise version available.
- docker-practice/actions-setup-docker was already SHA-pinned to a
commit on master newer than its last tagged release (v1, 2023);
there is no tagged version to cite, so the comment says so
explicitly instead of fabricating one.
No behavior change; each pin resolves to the commit the previous tag
currently points at.
Signed-off-by: Prasanth Baskar <prasanth@8gears.com>
build-package.yml and publish_release.yml reference this third-party action by
the mutable @master tag in jobs that hold AWS keys, Docker Hub push credentials
(and, in publish_release, OIDC signing via id-token: write). A moved tag would
run unreviewed code with those release credentials. Pin to the current master
commit SHA. Behaviour unchanged; per GitHub's pin-to-SHA guidance.
Signed-off-by: Kobi Hikri <kobi.hikri@gmail.com>
Co-authored-by: Wang Yan <wangyan_0219@hotmail.com>
* ci: migrate all GitHub workflows to CNCF-hosted runners
Replace the Oracle self-hosted labels and the GitHub-hosted defaults with
the CNCF runner pool:
oracle-vm-24cpu-96gb-x86-64 -> cncf-ubuntu-16-64-x86
ubuntu-latest -> cncf-ubuntu-16-64-x86
ubuntu-24.04-arm -> cncf-ubuntu-16-64-arm
The arm64 leg of the BUILD_PACKAGE matrix keeps building natively, now on
cncf-ubuntu-16-64-arm.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* ci: run pass-CI no-op stubs on the smallest CNCF runner
The pass-CI jobs only exist to satisfy required status checks on skipped
paths and execute nothing, so cncf-ubuntu-2-8-x86 is sufficient.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* ci: fix silently-disabled Go caching and cache CI Go tools
actions/setup-go ran before actions/checkout, so it looked for go.sum in an
empty workspace and logged:
Restore cache failed: Dependencies file is not found in
/home/ubuntu/_work/harbor/harbor. Supported file pattern: go.sum
With cache: true (the v5 default) this silently no-ops, so GOMODCACHE and
GOCACHE were cold on every job of every run. Checkout now runs first, and
cache-dependency-path points at src/go.sum under the checkout path.
Also cache $GOPATH/bin and only build the three CI tools and golangci-lint
when they are missing, instead of recompiling them from source every run.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* fix(make): resolve Go tool paths against the first GOPATH entry
CI sets GOPATH to a colon-separated list (go env GOPATH plus the workspace),
so $(shell go env GOPATH)/bin/golangci-lint expanded to the nonexistent path
'/home/ubuntu/go:/home/ubuntu/_work/harbor/harbor/bin/golangci-lint'.
This was masked because ut_install.sh installed golangci-lint using the same
broken expression, so both sides agreed on the same bogus location. Resolving
the tool against the first GOPATH entry (where go install actually writes
binaries) makes the path correct in both the single-entry and list cases.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* test(portal): wait for pagination control before clicking
The spec queried .pagination-next immediately after whenStable() and clicked
it, so it failed whenever the datagrid had not rendered yet. Retry the lookup
until the control appears.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* test: do not reuse cached go test results
With GOCACHE persisted across CI runs, go test replayed cached results instead
of executing the tests. Harbor's tests share a database across packages, so a
package that re-ran could observe state that the replayed packages never
created. -count=1 forces tests to run while still reusing the compilation cache.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* ci: fix Go caching in build-package and conformance, pin misspell
build-package.yml and conformance_test.yml also ran setup-go before checkout,
so their caches failed open exactly as CI.yml's did. Checkout now runs first
in both, with cache-dependency-path set.
cover and goveralls were installed but never used: goveralls is only named in a
commented-out line in ut_run.sh, and go test -cover uses the built-in tool, not
golang.org/x/tools/cmd/cover. Drop both and pin misspell, which make misspell
does invoke, so the cached tool version is reproducible.
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
---------
Signed-off-by: Vadim Bauer <vadim@8gears.com>
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* bump: bump up trivy adapter version to v0.37.2-rc2
Update TRIVYADAPTERVERSION to v0.37.2-rc2 in Makefile.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
* bump: bump up Go version to v1.26.4
Update Go version from 1.26.3 to 1.26.4 across makefiles, configuration, CI workflows, and documentation.
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
---------
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
Signed-off-by: stonezdj(Daojun Zhang) <stonezdj@gmail.com>
* ci: use local base for component builds; fix flaky log rotation test
- build-package.yml: set PULL_BASE_FROM_DOCKERHUB=false so components
build on the base image built in the same run, not a stale remote tag.
- test_log_rotation.py: accept Stopped or Success for the dry-run purge
job to avoid a timing flake.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
* fix ci failure
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
---------
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
pin qemu binfmt and prevent publish races
- Pin docker/setup-qemu-action to tonistiigi/binfmt:qemu-v9.2.2 for stable arm64 emulation.
- Add per-branch concurrency in build-package workflow to avoid overlapping runs racing on mutable tags/manifests.
- Rename Go setup step label to match the actual configured version.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
The per-component base images (goharbor/harbor-core-base, harbor-db-base,
harbor-portal-base, ...) were pushed by both BUILD_PACKAGE matrix jobs to the
same unsuffixed tag (e.g. :dev), so whichever architecture finished last
overwrote the other and the published tag ended up single-arch — the same
last-writer-wins problem goharbor/photon:5.0 had before #23334 (#23324).
Apply the same pattern already used for the component images:
- make/photon/Makefile: _build_base keeps building the local unsuffixed tag
(component Dockerfiles build FROM it unchanged) but pushes an arch-suffixed
tag instead: harbor-<name>-base:<tag>-amd64 / -arm64.
- .github/workflows/build-package.yml: each matrix job also saves the list of
goharbor/*-base repos it built; CREATE_MANIFEST combines the two suffixed
tags into the unsuffixed multi-arch manifest with docker buildx imagetools
create, using the base tag scheme (dev on main, the release version on
release-* branches). The base manifest step only runs when BUILD_BASE_IMAGE
decided to rebuild bases, since otherwise no suffixed tags were pushed in
this run.
Consumers that pull harbor-*-base:<tag> (PULL_BASE_FROM_DOCKERHUB=true flows)
now resolve the correct architecture via the manifest list instead of getting
whatever architecture won the race.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
The swagger, and mockery images are local build-time helper images and are not pushed with dev-{arch} tags.
Exclude them from the repo list used by the manifest job to avoid creating multi-arch manifests for images that are not part of the Harbor runtime release set.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
fix#23339
The spectral image is only used as a local API lint helper and is built with its own version tag, not as a Harbor runtime image.
Exclude it from the repo list used by the manifest job so CI does not try to create goharbor/spectral:dev from missing dev-{arch} tags.
Signed-off-by: wang yan <yan-yw.wang@broadcom.com>
Co-authored-by: wang yan <yan-yw.wang@broadcom.com>
Upgrade Harbor UI to Angular 21, Clarity v18, and Node.js v22
- Upgrade the Harbor UI (src/portal) from Angular 16 to Angular 19 and subsequently to Angular 21.
- Upgrade VMware Clarity from v17 to v18, and Node.js from v20 to v22 (updated .nvmrc, CI.yml, Makefile, Dockerfile).
- Migrate Angular templates to the new @if/@for control flow syntax.
- Fix UI issues #1 through #35, including robot accounts, layout, dropdown overlay, and input styling.
- Fix unit tests: resolve NG0100 ExpressionChangedAfterItHasBeenCheckedError in policy.component.spec.ts, replace autoDetectChanges(true) with explicit detectChanges cycles, and use TestBed.overrideComponent to stub AddP2pPolicyComponent template.
- Fix Clarity v18 breaking changes: update dark-theme SCSS import, add cds-theme attribute for theming, update ClrDatagridStateInterface import path, add ClrIconModule to app module.
- Stabilize npm installs and resolve CI/CD pipeline hangs.
- Fix swagger-ui crash caused by React 19 createRoot removal:
- swagger-ui 5.28+ resolves a nested react-dom@19 which removed createRoot
from the main react-dom entry point (moved to react-dom/client). The
swagger-ui-es-bundle-core.js still imports createRoot from react-dom,
making it undefined and causing "TypeError: i is not a function" at render.
- app-swagger-ui/webpack.prod.js: alias bare 'swagger-ui' import to
swagger-ui-bundle.js (the standalone UMD build that ships with React 18
already bundled), bypassing the broken external react-dom@19 entirely.
- app-swagger-ui/package.json: add npm overrides to pin react and
react-dom to ^18.3.1 so future npm installs do not re-introduce React 19.
- angular.json: expose swagger-ui.bundle.js and swagger-ui-index.html
from app-swagger-ui/dist as Angular dev-server assets, enabling the
proxy to serve the locally built, fixed bundle during development.
- Convert eslint-plugin-header config from JSON to JS to apply the ESLint 9 schema fix at config-load time, removing the need for patch-package.
- Pin all dependency versions to exact installed versions from the lock file, and remove unused prettier-eslint package.
- Fix flake in P2pProviderService unit test by initializing date with 0 milliseconds to prevent cross-second duration calculation mismatches.
Signed-off-by: Ashish Patel <zoom2ashish@gmail.com>
Co-authored-by: stonezdj <stone.zhang@broadcom.com>
goharbor/photon:5.0 was built and pushed independently by both the amd64 and
arm64 BUILD_PACKAGE matrix jobs to the same tag, so whichever job finished last
overwrote the other and the published tag ended up single-arch ("sometimes
amd64, sometimes arm64", #23324).
Build it once as an amd64+arm64 manifest list in a dedicated BUILD_BASE_IMAGE
job that BUILD_PACKAGE depends on, and exclude goharbor/photon from the
component manifest list in CREATE_MANIFEST (it is published here and stays at
tag 5.0).
The db base image keeps the photon-snapshot repo (the stable Photon source) and
installs both postgresql15-server (old binaries at /usr/pgsql/15/bin, required
by pg_upgrade) and postgresql18-server (runtime), temporarily un-pinning the
snapshot to pull whichever major Photon has deprecated out of the current
snapshot per architecture (pg15 on amd64, pg18 on arm64). common/Dockerfile
keeps photon-snapshot and merges its setup into a single RUN.
Signed-off-by: Vadim Bauer <vb@container-registry.com>
* refresh goharbor photon:5.0 when create new base image
Signed-off-by: jUDASmILE <judasmile@gmail.com>
* correct date and format in buildbaselog
Signed-off-by: jUDASmILE <judasmile@gmail.com>
---------
Signed-off-by: jUDASmILE <judasmile@gmail.com>
fix UT failures for Go 1.26.3 compatibility
Add //nolint:revive to packages whose names shadow Go stdlib
Fix mock file import ordering (goimports compliance)
Bump golangci-lint from v2.8.0 to v2.9.0 for Go 1.26 support
Update CI step label to reflect Go 1.26
Signed-off-by: stonezdj <stone.zhang@broadcom.com>
