mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
a25a4fbcfed0c0852bd2ebb3b110f46150cd5e25
20
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Steven Shriver
|
898f6e6495 |
CI: Emit JUnit from test runners, pin their exec bounds (#1687)
Today CI depends on process exit codes. This leads to a few issues with
reporting results. For example, a green build cannot be distinguished
from one where no tests ran at all; a `-run` filter that matches
nothing; an e2e suite short-circuiting without `--e2e`; or a
testcontainer skip: all currently exit 0.
This change adds gotestsum as a pinned tool module allowing opt-in for
JUnit reporting in both test runners by using `E2E_JUNIT_FILE` and
`ROOT_JUNIT_FILE` respectively. When left unset, the runners exec `go
test` directly and gotestsum is never built leaving local runs unchanged
for now.
Additionally, this change pins two execution bounds that `go test` would
otherwise infer. Both remain overridable via environment variables as
listed below.
- `-p`: system defaults didn't align with cluster capacity so pinning
the value avoids over allocation. (override with `E2E_PARALLELISM`).
- `-timeout`: Suite defaults conflicted with some E2E test timings
causing some tests that are expected to timeout at the same time to
abort rather than fail as expected. Setting an 30m default avoids the
conlficting timeouts producing clean failure signals (override with
`E2E_TIMEOUT`).
Fixes #1685
|
||
|
Tim Hockin
|
2fcfa64a73 |
Drop k8s third_party deps now that HEAD is updated (#1480)
The changes we need are live on HEAD of the k8s published repos. It was
a bit of a journey, since Go fought me all the way.
---
### Drop our third_party fork of k8s deps in tools
The changes we need are released now (sort of - on HEAD anyway).
---
### Bump k8s.io/streaming to v0.37.0 (not rc) in tools
---
### Bump codegen deps to HEAD in tools
GOPROXY=direct go get \
k8s.io/apimachinery@master \
k8s.io/code-generator@master
This pins them to HEAD of master. Go is terrible here: The HEAD is not
actually tagged, so Go just uses the next "reachable" tag which is
v0.36.0-alpha. The datestamp is correct, though.
---
### Drop our third_party fork of k8s deps in root
The changes we need are released now (sort of - on HEAD anyway).
---
### Bump k8s deps to v0.37.0 (not rc) in root
---
### Bump apimachinery dep in root to HEAD in root
GOPROXY=direct go mod edit -replace
k8s.io/apimachinery=k8s.io/apimachinery@master
GOPROXY=direct go mod tidy
GOPROXY=direct go mod vendor
GOPROXY=direct go mod tidy
This approach (-replace) is needed because Go is horrible here.
The master branch of k8s.io/apimachinery is not tagged, per se, but
there is an OLDER tag which is "reachable" from HEAD. So go helpfully
decides to use that (v0.36.0-alpha.2). If we just `go get ... @master`
it works for that dep (pinned to the right date) but then it looks at
transitive deps. Because the tag seems to be 0.36 (older), it
recalculates all the OTHER dependencies and downgrades a whole tangle of
things to versions that match 0.36, but we are ACTUALLY on 0.37+.
This was the only approach that I (and Gemini) could find. Blech.
---
### Run updated codegens
---
### Use DV's new maxBytes capability for `[]byte`
Removes 1 custom.
|
||
|
Benjamin Elder
|
1d58b95a7f |
update grpc 1.83.2 in all modules (#1385)
picks up security fixes |
||
|
Haven Xia
|
698289452b | Bump Go to 1.27 | ||
|
Mesut Oezdil
|
f936206dd5 |
ci: add kube-api-linter and exclude current findings (#416)
Part of #207, following the plan discussed there with @juli4n and @kannon92: plumbing plus the non invasive fixes first, with the existing invasive findings excluded so new APIs do not regress (as @kannon92 suggested in https://github.com/agent-substrate/substrate/issues/207#issuecomment-4921051580). The linter itself was originally suggested by @BenTheElder in #188. Plumbing: - hack/tools/kube-api-linter module with the golangci-lint-kube-api-linter tool, same pattern as the other tools. - .golangci-kal.yaml config. The pre-existing findings from rules that need Go API changes (nomaps, nonpointerstructs, nophase, optionalfields, requiredfields, ssatags) are excluded rather than disabled, and each exclusion rule names the fields it excuses, so the rules still apply to new API files and to new fields on the existing types. Fixing them on the existing types is the follow up in #207. - hack/verify/kube-api-linter.sh runs it against ./pkg/api/... and is picked up by hack/verify-all.sh in CI. Fixes in pkg/api/v1alpha1 (doc and marker only, no Go API change): - commentstart: field godocs now start with the serialized field name. - conditions: Conditions moved to the first position in ActorTemplateStatus and got the listType, listMapKey and patch markers. - defaultorrequired: SandboxConfigSpec.SandboxClass had both a default and required; now optional with omitempty, matching the same field on WorkerPoolSpec and ActorTemplateSpec. The ValidatingAdmissionPolicy in sandboxconfig-validation.yaml is unaffected since CRD defaulting runs before admission, so spec.sandboxClass is always set by then. - optionalorrequired: missing +optional markers added on ActorTemplateStatus fields. - defaults: configured preferredDefaultMarker to kubebuilder:default since CRDs are generated with controller-gen. Generated CRDs regenerated. Structural schema changes are only the conditions listType/listMapKey and sandboxClass no longer in the required list (it is defaulted, so behavior is the same); the rest is description text. Note: my earlier count of 50 issues in #207 was capped by the default golangci-lint issue limit. With the cap removed the real total is 86; the extra ones are requiredfields (20) and ssatags (4), both in the excluded set above. Test plan - hack/verify/kube-api-linter.sh passes (0 issues). - Exclusions verified both ways: dropping them brings the pre-existing findings back, and a scratch field added to WorkerPoolSpec is still reported (optionalfields), which the earlier per-file exclusion swallowed. - TestSandboxConfigValidation passes against the regenerated CRD. - go build ./... and go test ./pkg/api/... ./cmd/atecontroller/... pass. - gofmt, shellcheck and the regular golangci-lint on pkg/api are clean. |
||
|
Benjamin Elder
|
b6b5e949c5 |
hack: update kind to v0.33.0 (#1247)
Pick up the latest kind release for local dev clusters. Includes fix relevant to https://github.com/agent-substrate/substrate/issues/1133 (kindnetd memory) > It's a good idea to open an issue first for discussion. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR |
||
|
Tim Hockin
|
a8d83ee1b5 |
Use Kubernetes declarative validation (#1215)
This mostly eliminates the need to hand-write validation code. This PR is a long series of commits which add DV for most of Actor and all of Atespace. Here is a map to the commits: * The first few take a dep on a new Kubernetes tag, import the code into third_party, and apply a single patch. Because we have different Go modules for tools, I had to do it twice. When that patch lands, we can revert these commits, but that won't be until the 1.38 cycle in a few months. * The next commits slowly add DV support, so a human can review each of them in a reasonable amount of time. The emphasis is on great test cases. * I made a bad choice early on as to where to generate the code into, so I moved it. Rebasing on that was exceedingly hard, so I left it as a move. * This required changing update/go-generate -> update/codegen -- we need to get the ordering of tools right, which `go generate` does not guarantee. * Then I added a "middle" layer called "ServiceImpl" between the RPC and storage layers. This allows things like workflow to call the same business logic as the RPC layer, including validation. Lots of test fixes. * Then I finished the Create() and Update() paths for Actor. Those represent the "right" (or closest to) way to implement resources, and tests for validation. I strongly encourage reviewers to read it commit-by-commit. Rebasing this is VERY tedious, so the sooner it lands or dies completely, the better. Then we can start converting the rest. `./hack/run-tool.sh validation-gen --docs` will produce some docs on the tool and the available tags. @laoj2 @juli4n @EItanya @HavenXia @lalitc375 @yongruilin @jpbetz FYI |
||
|
dependabot[bot]
|
8373e60a4a |
build(deps): bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 in /hack/tools/ko (#681)
Bumps [github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go) from 1.2.0 to 1.2.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/sigstore-go/releases">github.com/sigstore/sigstore-go's releases</a>.</em></p> <blockquote> <h2>v1.2.1</h2> <h2>What's Changed</h2> <p>v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.</p> <ul> <li>Check signature time against public key validity window in <a href="https://redirect.github.com/sigstore/sigstore-go/pull/642">sigstore/sigstore-go#642</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/sigstore-go/compare/v1.2.0...v1.2.1">https://github.com/sigstore/sigstore-go/compare/v1.2.0...v1.2.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"><code>4594ab4</code></a> Check signature time against public key validity window (<a href="https://redirect.github.com/sigstore/sigstore-go/issues/642">#642</a>)</li> <li><a href="https://github.com/sigstore/sigstore-go/commit/3ad400caec47a75027e4f7188046d0ee07bbdcec"><code>3ad400c</code></a> Bump actions/checkout from 6.0.2 to 6.0.3 (<a href="https://redirect.github.com/sigstore/sigstore-go/issues/639">#639</a>)</li> <li>See full diff in <a href="https://github.com/sigstore/sigstore-go/compare/v1.2.0...v1.2.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/agent-substrate/substrate/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
9e2a669e33 |
build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /hack/tools/ko (#497)
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's releases</a>.</em></p> <blockquote> <h2>Release 1.82.1</h2> <h1>Security</h1> <ul> <li>server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable <code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li> <li>xds/rbac: Support <code>Metadata</code> and <code>RequestedServerName</code> permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.</li> <li>xds/rbac: Fix panic when parsing unsupported fields in <code>NotRule</code>/<code>NotId</code> permissions.</li> <li>xds/rbac: Support the deprecated <code>source_ip</code> principal identifier by treating it as equivalent to <code>direct_remote_ip</code>.</li> </ul> <h2>Release 1.82.0</h2> <h1>Behavior Changes</h1> <ul> <li>server: Remove support for <code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code> environment varibale. Strict incoming RPC path validation (which has been the default since <code>v1.79.3</code>) can no longer be disabled. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li> <li>transport: Add environment variable to change the default max header list size from <code>16MB</code> to <code>8KB</code>. This may be enabled by setting <code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>. This will be enabled by default in a subsequent release. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li> <li>balancer: Load Balancing policy registry is now case-sensitive. Set <code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code> (and file an issue) to revert to case-insensitive behavior. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li> </ul> <h1>New Features</h1> <ul> <li>experimental/stats: Expose a new API, <code>NewContextWithLabelCallback</code>, to register a callback that is invoked when telemetry labels are added. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>) <ul> <li>Special Thanks: <a href="https://github.com/seth-epps"><code>@seth-epps</code></a></li> </ul> </li> <li>client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>) <ul> <li>Special Thanks: <a href="https://github.com/chengxilo"><code>@chengxilo</code></a></li> </ul> </li> <li>server: Add environment variable <code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting <code>runtime/pprof.Labels</code> on goroutines spawned by the server. Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add the <code>grpc.method</code> label on goroutines spawned to handle incoming requests. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>) <ul> <li>Special Thanks: <a href="https://github.com/dfinkel"><code>@dfinkel</code></a></li> </ul> </li> </ul> <h1>Bug Fixes</h1> <ul> <li>xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li> <li>grpc: In the deprecated <code>gzip</code> Compressor (used via the deprecated <code>WithCompressor</code> dial option), enforce the <code>MaxRecvMsgSize</code> limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>) <ul> <li>Special Thanks: <a href="https://github.com/evilgensec"><code>@evilgensec</code></a></li> </ul> </li> <li>stats/opentelemetry: Record retry attempts, <code>grpc.previous-rpc-attempts</code>, at the call level and not the attempt level. (<a href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li> <li>encoding: Ensure <code>Close()</code> is always called on readers returned from <code>Compressor.Decompress</code> if possible. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li> <li>channelz: Fix the <code>LastMessageSentTimestamp</code> and <code>LastMessageReceivedTimestamp</code> fields in <code>SocketMetrics</code> to ensure they contain correct timestamp values. (<a href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a> Change version to 1.82.1 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a> Cherry-pick commits (<a href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a> Change version to 1.82.1-dev (<a href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a> Change version to 1.82.0 (<a href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a> Fix minor issues not covered by PR <a href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a> (<a href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a> internal: Split v3procservicepb import into pb and grpc for extproc (<a href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a> transport: surface subsequent data when receiving non-gRPC header (<a href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a> test/kokoro: add config for regional-td test (<a href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a> xds: ensure full-string matching for RBAC Filter rules (<a href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li> <li><a href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a> server: Set a pprof label on new stream goroutines (<a href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li> <li>Additional commits viewable in <a href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/agent-substrate/substrate/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
d858ef8013 |
build(deps): bump golang.org/x/net in /hack/tools/go-licenses
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.43.0 to 0.55.0. - [Commits](https://github.com/golang/net/compare/v0.43.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tim Hockin
|
b3e7b5bdf1 | Bump ko version | ||
|
dependabot[bot]
|
e43d99bb9a |
build(deps): bump golang.org/x/crypto in /hack/tools/ko
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0. - [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
59d89fea60 |
build(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 in /hack/tools/ko (#366)
Bumps [github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority) from 2.0.6 to 2.1.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sigstore/timestamp-authority/releases">github.com/sigstore/timestamp-authority/v2's releases</a>.</em></p> <blockquote> <h2>v2.1.0</h2> <h2>What's Changed</h2> <ul> <li>Bound path and HTTP method metric label cardinality to prevent OOM in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1374">sigstore/timestamp-authority#1374</a></li> <li>Fix spec violations in policy, EKU, and hash verification in <a href="https://redirect.github.com/sigstore/timestamp-authority/pull/1375">sigstore/timestamp-authority#1375</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0">https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sigstore/timestamp-authority/commit/58ae149676e193d2dd7e7ee53f231b83fdd10fad"><code>58ae149</code></a> Fix spec violations in policy, EKU, and hash verification (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1375">#1375</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5"><code>506ec57</code></a> Bound path and HTTP method metric label cardinality to prevent OOM (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1374">#1374</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/ee10addd351dc6ee98cce8ff8fd371d7c46da954"><code>ee10add</code></a> chore(deps): bump the actions group with 2 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1370">#1370</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/5238ec7a129fdb30696877cc72566273b5cda5ed"><code>5238ec7</code></a> chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1369">#1369</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/0ff73b8db18044af0cc8e1ae7e0745fe322377e1"><code>0ff73b8</code></a> chore(deps): bump goreleaser/goreleaser-action in the actions group (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1367">#1367</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/97813ca20ffde2ee48100f276de8b63a6aabcaf1"><code>97813ca</code></a> chore(deps): bump the actions group with 2 updates (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1366">#1366</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/ece88f8b7ed97d7018a26e393044de2b8301ab2e"><code>ece88f8</code></a> chore(deps): bump github.com/go-openapi/runtime from 0.30.0 to 0.31.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1365">#1365</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/77e0ee5cddc2629879814cff1eedce8eae716a0d"><code>77e0ee5</code></a> chore(deps): bump github.com/tink-crypto/tink-go-awskms/v2 to v3 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1364">#1364</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/6ea07dfd04b97429be00e98360b819b277398843"><code>6ea07df</code></a> chore(deps): bump go.step.sm/crypto from 0.80.0 to 0.81.0 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1363">#1363</a>)</li> <li><a href="https://github.com/sigstore/timestamp-authority/commit/f1dc03b146f2e1ea2c668a8f5849456e7cf0bc5a"><code>f1dc03b</code></a> chore(deps): bump github.com/tink-crypto/tink-go-hcvault/v2 (<a href="https://redirect.github.com/sigstore/timestamp-authority/issues/1362">#1362</a>)</li> <li>Additional commits viewable in <a href="https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/agent-substrate/substrate/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4f29aaf321 |
build(deps): bump golang.org/x/net in /hack/tools/controller-gen
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.48.0 to 0.55.0. - [Commits](https://github.com/golang/net/compare/v0.48.0...v0.55.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.55.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]
|
50a68bc146 |
build(deps): bump github.com/sigstore/rekor in /hack/tools/ko
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2. - [Release notes](https://github.com/sigstore/rekor/releases) - [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md) - [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2) --- updated-dependencies: - dependency-name: github.com/sigstore/rekor dependency-version: 1.5.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Benjamin Elder
|
6388be39dc | upgrade kind to v0.32 (with default k8s 1.36.1) | ||
|
Davanum Srinivas
|
55923825c7 |
chore(hack): add golangci-lint
Adds golangci-lint v2.12.2 using the per-tool-module pattern under hack/tools/golangci-lint/. The verifier at hack/verify/golangci-lint.sh is auto-discovered by hack/verify-all.sh, so the existing CI verify step picks it up with no workflow YAML change. Ships .golangci.yaml with the standard linter set, a make lint target, and a verify wrapper that pins GOOS=linux so ateom-gvisor's netlink references typecheck on macOS the same way they do on CI. Adjustments to keep the first run clean: two dead-code deletions ((*runsc).cmdList, MemoryPullCache.gcsClient), two SA9003 empty branches replaced with slog.Error / t.Logf, one S1008 return-bool simplification, and inline //nolint for one intentional best-effort ReleaseLock plus four audit-tracked SA1019 deprecations. Signed-off-by: Davanum Srinivas <davanum@gmail.com> |
||
|
Benjamin Elder
|
379e7e677d |
feat: add script to update tool dependencies in hack/tools directory (#56)
We are just using tools modules (plural) to manage installing go binaries with binned versions easily. We are NOT trying to patch transitive dependencies in those tools, versus just updating those tools themselves. Add a helper script to update them as intended, and add and AGENTS.md to tell agents to use the script. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR |
||
|
Benjamin Elder
|
e7e804a7db |
manage kind in tools module, add deletion script (#46)
We've already been managing other go binaries with tools modules. Doing this limits the number of setup steps needed, and allows our scripts to make assumptions about the kind version. `kind` has minimal dependencies and should compile very quickly. Label the registry as created by our script, so we know if we should delete it. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR |
||
|
+7
|
af3c65088e |
Initial commit of Agent Substrate
This is the initial release of the Agent Substrate. Agent substrate is a system built on top of Kubernetes which manages agent-like workloads to achieve higher scale and efficiency than Kubernetes alone can offer, with lower latency. It builds on top of Kubernetes features like Pods and Pod autoscaling, but takes the Kubernetes control-plane out of the critical path to achieve lower latency. It can run on any Kubernetes cluster and does not inhibit “regular” use of Kubernetes in any way. Kubernetes provides the infrastructure provisioning and management for all types of workloads, while Agent Substrate provides agent-specific scheduling and control. At its core, Agent Substrate maps a larger set of “actors” (applications such as agents) onto a smaller set of ready “workers” (Kubernetes Pods), relying on the fact that agent-like applications tend to be idle most of the time to achieve heavy multiplexing. It provides functionality to manage an actor’s lifecycle (e.g. create/destroy, suspend/resume), to assign actors to workers in real time, and to route incoming traffic to them. Agent Substrate is intended to be a low-opinion system. The workloads it manages don't have to be literal AI agents, but those are the best example of the kind of applications it is designed for. It is not an SDK for building agents, but rather a system for running them at scale. Agent Substrate is currently in VERY early development. It is not ready for production use, and the APIs are almost guaranteed to change. We are not making any guarantees about backward compatibility at this stage, and everything in this project may be changed. Co-authored-by: Alex Bulankou <alexbu@google.com> Co-authored-by: Benjamin Elder <bentheelder@google.com> Co-authored-by: Bowei Du <bowei@google.com> Co-authored-by: Dmitry Berkovich <dberkov@google.com> Co-authored-by: Fabricio Voznika <fvoznika@google.com> Co-authored-by: Francisco Cabrera <fclieutier@google.com> Co-authored-by: Haven Xia <haoyuxia@google.com> Co-authored-by: Julian Gutierrez Oschmann <juliangut@google.com> Co-authored-by: Kevin Steuer <ksteuer@google.com> Co-authored-by: Max Smythe <smythe@google.com> Co-authored-by: Maya Wang <mymaya@google.com> Co-authored-by: Michael Taufen <mtaufen@google.com> Co-authored-by: Shruti Nair <shrutinair@google.com> Co-authored-by: Taahir Ahmed <taahm@google.com> Co-authored-by: Tim Hockin <thockin@google.com> Co-authored-by: Zoe Zhao <zoezhao@google.com> |