trending/substrate
1
0
Fork 0
mirror of https://github.com/agent-substrate/substrate.git synced 2026-11-10 10:13:50 +08:00
Code Issues Packages Projects Releases Wiki Activity
653 Commits 8 Branches 11 Tags
a8d83ee1b5cc980e2e3ab9ceed3ffc7d1ea5da07
Commit Graph
14 Commits
Author SHA1 Message Date
Tim Hockin a8d83ee1b5 Use Kubernetes declarative validation (#1215) 
This mostly eliminates the need to hand-write validation code.

This PR is a long series of commits which add DV for most of Actor and
all of Atespace.

Here is a map to the commits:
* The first few take a dep on a new Kubernetes tag, import the code into
third_party, and apply a single patch. Because we have different Go
modules for tools, I had to do it twice. When that patch lands, we can
revert these commits, but that won't be until the 1.38 cycle in a few
months.
* The next commits slowly add DV support, so a human can review each of
them in a reasonable amount of time. The emphasis is on great test
cases.
* I made a bad choice early on as to where to generate the code into, so
I moved it. Rebasing on that was exceedingly hard, so I left it as a
move.
* This required changing update/go-generate -> update/codegen -- we need
to get the ordering of tools right, which `go generate` does not
guarantee.
* Then I added a "middle" layer called "ServiceImpl" between the RPC and
storage layers. This allows things like workflow to call the same
business logic as the RPC layer, including validation. Lots of test
fixes.
* Then I finished the Create() and Update() paths for Actor. Those
represent the "right" (or closest to) way to implement resources, and
tests for validation.

I strongly encourage reviewers to read it commit-by-commit. Rebasing
this is VERY tedious, so the sooner it lands or dies completely, the
better. Then we can start converting the rest.

`./hack/run-tool.sh validation-gen --docs` will produce some docs on the
tool and the available tags.

@laoj2 @juli4n @EItanya @HavenXia
@lalitc375 @yongruilin @jpbetz  FYI
 2026-08-25 20:24:59 -07:00
dependabot[bot] 8373e60a4a build(deps): bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 in /hack/tools/ko (#681) 
Bumps
[github.com/sigstore/sigstore-go](https://github.com/sigstore/sigstore-go)
from 1.2.0 to 1.2.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/sigstore-go/releases">github.com/sigstore/sigstore-go's
releases</a>.</em></p>
<blockquote>
<h2>v1.2.1</h2>
<h2>What's Changed</h2>
<p>v1.2.1 resolves GHSA-wqqc-jjcq-vfxm.</p>
<ul>
<li>Check signature time against public key validity window in <a
href="https://redirect.github.com/sigstore/sigstore-go/pull/642">sigstore/sigstore-go#642</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/sigstore-go/compare/v1.2.0...v1.2.1">https://github.com/sigstore/sigstore-go/compare/v1.2.0...v1.2.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/sigstore-go/commit/4594ab4c779d08be1f4419803a8249188f35ed5f"><code>4594ab4</code></a>
Check signature time against public key validity window (<a
href="https://redirect.github.com/sigstore/sigstore-go/issues/642">#642</a>)</li>
<li><a
href="https://github.com/sigstore/sigstore-go/commit/3ad400caec47a75027e4f7188046d0ee07bbdcec"><code>3ad400c</code></a>
Bump actions/checkout from 6.0.2 to 6.0.3 (<a
href="https://redirect.github.com/sigstore/sigstore-go/issues/639">#639</a>)</li>
<li>See full diff in <a
href="https://github.com/sigstore/sigstore-go/compare/v1.2.0...v1.2.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/sigstore-go&package-manager=go_modules&previous-version=1.2.0&new-version=1.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agent-substrate/substrate/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-10 15:49:42 -04:00
dependabot[bot] 9e2a669e33 build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /hack/tools/ko (#497) 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.81.1 to 1.82.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.82.1</h2>
<h1>Security</h1>
<ul>
<li>server: Stop reading from the connection when flooded by HTTP/2
frames. The default value for this limit is 100 frames, excluding DATA
and HEADERS, and may be changed by setting environment variable
<code>GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT</code>.</li>
<li>xds/rbac: Support <code>Metadata</code> and
<code>RequestedServerName</code> permissions matcher fields. If present
in a DENY rule, previously these would be ignored and fail-open.</li>
<li>xds/rbac: Fix panic when parsing unsupported fields in
<code>NotRule</code>/<code>NotId</code> permissions.</li>
<li>xds/rbac: Support the deprecated <code>source_ip</code> principal
identifier by treating it as equivalent to
<code>direct_remote_ip</code>.</li>
</ul>
<h2>Release 1.82.0</h2>
<h1>Behavior Changes</h1>
<ul>
<li>server: Remove support for
<code>GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING</code>
environment varibale. Strict incoming RPC path validation (which has
been the default since <code>v1.79.3</code>) can no longer be disabled.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9112">#9112</a>)</li>
<li>transport: Add environment variable to change the default max header
list size from <code>16MB</code> to <code>8KB</code>. This may be
enabled by setting
<code>GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true</code>.
This will be enabled by default in a subsequent release. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9019">#9019</a>)</li>
<li>balancer: Load Balancing policy registry is now case-sensitive. Set
<code>GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false</code>
(and file an issue) to revert to case-insensitive behavior. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9017">#9017</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>experimental/stats: Expose a new API,
<code>NewContextWithLabelCallback</code>, to register a callback that is
invoked when telemetry labels are added. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8877">#8877</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/seth-epps"><code>@​seth-epps</code></a></li>
</ul>
</li>
<li>client: Return a portion of the response body in the error message,
when the client receives an unexpected non-gRPC HTTP response, to make
debugging easier. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/chengxilo"><code>@​chengxilo</code></a></li>
</ul>
</li>
<li>server: Add environment variable
<code>GRPC_GO_SERVER_GOROUTINE_LABELS</code> that controls setting
<code>runtime/pprof.Labels</code> on goroutines spawned by the server.
Set <code>GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true</code> to add
the <code>grpc.method</code> label on goroutines spawned to handle
incoming requests. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dfinkel"><code>@​dfinkel</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>xds/server: Fix a memory leak of HTTP filter instances occurring
when route configurations are updated in-place during a Route Discovery
Service (RDS) update. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9138">#9138</a>)</li>
<li>grpc: In the deprecated <code>gzip</code> Compressor (used via the
deprecated <code>WithCompressor</code> dial option), enforce the
<code>MaxRecvMsgSize</code> limit on the decompressed message buffer,
preventing excessive memory allocation from highly compressed payloads.
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9114">#9114</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/evilgensec"><code>@​evilgensec</code></a></li>
</ul>
</li>
<li>stats/opentelemetry: Record retry attempts,
<code>grpc.previous-rpc-attempts</code>, at the call level and not the
attempt level. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8923">#8923</a>)</li>
<li>encoding: Ensure <code>Close()</code> is always called on readers
returned from <code>Compressor.Decompress</code> if possible. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9135">#9135</a>)</li>
<li>channelz: Fix the <code>LastMessageSentTimestamp</code> and
<code>LastMessageReceivedTimestamp</code> fields in
<code>SocketMetrics</code> to ensure they contain correct timestamp
values. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9109">#9109</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/ebd8f06a09426fbece97157c95c3917abff28f4e"><code>ebd8f06</code></a>
Change version to 1.82.1 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9238">#9238</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/4ea465d4ab98013f72a142fe0fc89c19770b2935"><code>4ea465d</code></a>
Cherry-pick commits (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9236">#9236</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/9494a2cf32a0ec9d35420af401445ef3c9f66f05"><code>9494a2c</code></a>
Change version to 1.82.1-dev (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9171">#9171</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/bd239854f0ab7f1ee63457d47f7c1d2675e1f736"><code>bd23985</code></a>
Change version to 1.82.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9170">#9170</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0f3086db7a755b6af83a90809471dd7f645b345a"><code>0f3086d</code></a>
Fix minor issues not covered by PR <a
href="https://redirect.github.com/grpc/grpc-go/issues/9137">#9137</a>
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/9147">#9147</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/fef07fbb2b94b668e8daca1f6b70433dcd36c1c8"><code>fef07fb</code></a>
internal: Split v3procservicepb import into pb and grpc for extproc (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9163">#9163</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/91dd64f4b83cb5134e279d1126ebb1ccf47d4d31"><code>91dd64f</code></a>
transport: surface subsequent data when receiving non-gRPC header (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8929">#8929</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/adc97de9521a9f377dab5e911039842dc4de23e5"><code>adc97de</code></a>
test/kokoro: add config for regional-td test (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9158">#9158</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/57c9ff14e05b535ee6995ba49bc882b287a175de"><code>57c9ff1</code></a>
xds: ensure full-string matching for RBAC Filter rules (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9148">#9148</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/b58f32d9ff07c612d64e677bd826bcbec88af9bd"><code>b58f32d</code></a>
server: Set a pprof label on new stream goroutines (<a
href="https://redirect.github.com/grpc/grpc-go/issues/9082">#9082</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.81.1&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agent-substrate/substrate/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-22 18:42:56 -04:00
dependabot[bot] d858ef8013 build(deps): bump golang.org/x/net in /hack/tools/go-licenses 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.43.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.43.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 16:43:23 -07:00
Tim Hockin b3e7b5bdf1 Bump ko version 2026-07-08 13:26:26 -07:00
dependabot[bot] e43d99bb9a build(deps): bump golang.org/x/crypto in /hack/tools/ko 
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.
- [Commits](https://github.com/golang/crypto/compare/v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.52.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-08 12:55:03 -07:00
dependabot[bot] 59d89fea60 build(deps): bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 in /hack/tools/ko (#366) 
Bumps
[github.com/sigstore/timestamp-authority/v2](https://github.com/sigstore/timestamp-authority)
from 2.0.6 to 2.1.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/sigstore/timestamp-authority/releases">github.com/sigstore/timestamp-authority/v2's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bound path and HTTP method metric label cardinality to prevent OOM
in <a
href="https://redirect.github.com/sigstore/timestamp-authority/pull/1374">sigstore/timestamp-authority#1374</a></li>
<li>Fix spec violations in policy, EKU, and hash verification in <a
href="https://redirect.github.com/sigstore/timestamp-authority/pull/1375">sigstore/timestamp-authority#1375</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0">https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/58ae149676e193d2dd7e7ee53f231b83fdd10fad"><code>58ae149</code></a>
Fix spec violations in policy, EKU, and hash verification (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1375">#1375</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/506ec57b6ac2ea1e4739322e47453469425b69b5"><code>506ec57</code></a>
Bound path and HTTP method metric label cardinality to prevent OOM (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1374">#1374</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/ee10addd351dc6ee98cce8ff8fd371d7c46da954"><code>ee10add</code></a>
chore(deps): bump the actions group with 2 updates (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1370">#1370</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/5238ec7a129fdb30696877cc72566273b5cda5ed"><code>5238ec7</code></a>
chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1369">#1369</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/0ff73b8db18044af0cc8e1ae7e0745fe322377e1"><code>0ff73b8</code></a>
chore(deps): bump goreleaser/goreleaser-action in the actions group (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1367">#1367</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/97813ca20ffde2ee48100f276de8b63a6aabcaf1"><code>97813ca</code></a>
chore(deps): bump the actions group with 2 updates (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1366">#1366</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/ece88f8b7ed97d7018a26e393044de2b8301ab2e"><code>ece88f8</code></a>
chore(deps): bump github.com/go-openapi/runtime from 0.30.0 to 0.31.0
(<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1365">#1365</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/77e0ee5cddc2629879814cff1eedce8eae716a0d"><code>77e0ee5</code></a>
chore(deps): bump github.com/tink-crypto/tink-go-awskms/v2 to v3 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1364">#1364</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/6ea07dfd04b97429be00e98360b819b277398843"><code>6ea07df</code></a>
chore(deps): bump go.step.sm/crypto from 0.80.0 to 0.81.0 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1363">#1363</a>)</li>
<li><a
href="https://github.com/sigstore/timestamp-authority/commit/f1dc03b146f2e1ea2c668a8f5849456e7cf0bc5a"><code>f1dc03b</code></a>
chore(deps): bump github.com/tink-crypto/tink-go-hcvault/v2 (<a
href="https://redirect.github.com/sigstore/timestamp-authority/issues/1362">#1362</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/sigstore/timestamp-authority/compare/v2.0.6...v2.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/sigstore/timestamp-authority/v2&package-manager=go_modules&previous-version=2.0.6&new-version=2.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/agent-substrate/substrate/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-08 02:00:25 -07:00
dependabot[bot] 4f29aaf321 build(deps): bump golang.org/x/net in /hack/tools/controller-gen 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.48.0 to 0.55.0.
- [Commits](https://github.com/golang/net/compare/v0.48.0...v0.55.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.55.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-07 10:23:52 -07:00
dependabot[bot] 50a68bc146 build(deps): bump github.com/sigstore/rekor in /hack/tools/ko 
Bumps [github.com/sigstore/rekor](https://github.com/sigstore/rekor) from 1.5.1 to 1.5.2.
- [Release notes](https://github.com/sigstore/rekor/releases)
- [Changelog](https://github.com/sigstore/rekor/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sigstore/rekor/compare/v1.5.1...v1.5.2)

---
updated-dependencies:
- dependency-name: github.com/sigstore/rekor
  dependency-version: 1.5.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-06-26 17:22:14 -07:00
Benjamin Elder 6388be39dc upgrade kind to v0.32 (with default k8s 1.36.1) 2026-06-05 16:33:10 -07:00
Davanum Srinivas 55923825c7 chore(hack): add golangci-lint 
Adds golangci-lint v2.12.2 using the per-tool-module pattern under
hack/tools/golangci-lint/. The verifier at hack/verify/golangci-lint.sh
is auto-discovered by hack/verify-all.sh, so the existing CI verify
step picks it up with no workflow YAML change.

Ships .golangci.yaml with the standard linter set, a make lint
target, and a verify wrapper that pins GOOS=linux so ateom-gvisor's
netlink references typecheck on macOS the same way they do on CI.

Adjustments to keep the first run clean: two dead-code deletions
((*runsc).cmdList, MemoryPullCache.gcsClient), two SA9003 empty
branches replaced with slog.Error / t.Logf, one S1008 return-bool
simplification, and inline //nolint for one intentional best-effort
ReleaseLock plus four audit-tracked SA1019 deprecations.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
 2026-05-23 16:19:09 -07:00
Benjamin Elder 379e7e677d feat: add script to update tool dependencies in hack/tools directory (#56) 
We are just using tools modules (plural) to manage installing go
binaries with binned versions easily.
We are NOT trying to patch transitive dependencies in those tools,
versus just updating those tools themselves.

Add a helper script to update them as intended, and add and AGENTS.md to
tell agents to use the script.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-05-21 21:36:39 -04:00
Benjamin Elder e7e804a7db manage kind in tools module, add deletion script (#46) 
We've already been managing other go binaries with tools modules.

Doing this limits the number of setup steps needed, and allows our
scripts to make assumptions about the kind version.

`kind` has minimal dependencies and should compile very quickly.

Label the registry as created by our script, so we know if we should
delete it.

- [x] Tests pass
- [x] Appropriate changes to documentation are included in the PR
 2026-05-21 15:38:34 -04:00
+7
The Agent Substrate Seed TeamAlex BulankouBenjamin ElderBowei DuDmitry BerkovichFabricio VoznikaFrancisco CabreraHaven XiaJulian Gutierrez OschmannKevin SteuerMax SmytheMaya WangMichael TaufenShruti NairTaahir AhmedTim HockinZoe Zhao
 		af3c65088e Initial commit of Agent Substrate 
This is the initial release of the Agent Substrate.

Agent substrate is a system built on top of Kubernetes which manages agent-like
workloads to achieve higher scale and efficiency than Kubernetes alone can
offer, with lower latency.  It builds on top of Kubernetes features like
Pods and Pod autoscaling, but takes the Kubernetes control-plane out of the
critical path to achieve lower latency.

It can run on any Kubernetes cluster and does not inhibit “regular” use of
Kubernetes in any way. Kubernetes provides the infrastructure provisioning and
management for all types of workloads, while Agent Substrate provides
agent-specific scheduling and control.

At its core, Agent Substrate maps a larger set of “actors” (applications such
as agents) onto a smaller set of ready “workers” (Kubernetes Pods), relying on
the fact that agent-like applications tend to be idle most of the time to
achieve heavy multiplexing.  It provides functionality to manage an actor’s
lifecycle (e.g. create/destroy, suspend/resume), to assign actors to workers in real
time, and to route incoming traffic to them.

Agent Substrate is intended to be a low-opinion system.  The workloads it
manages don't have to be literal AI agents, but those are the best example of
the kind of applications it is designed for.  It is not an SDK for building
agents, but rather a system for running them at scale.

Agent Substrate is currently in VERY early development.  It is not ready for
production use, and the APIs are almost guaranteed to change.  We are not
making any guarantees about backward compatibility at this stage, and
everything in this project may be changed.

Co-authored-by: Alex Bulankou <alexbu@google.com>
Co-authored-by: Benjamin Elder <bentheelder@google.com>
Co-authored-by: Bowei Du <bowei@google.com>
Co-authored-by: Dmitry Berkovich <dberkov@google.com>
Co-authored-by: Fabricio Voznika <fvoznika@google.com>
Co-authored-by: Francisco Cabrera <fclieutier@google.com>
Co-authored-by: Haven Xia <haoyuxia@google.com>
Co-authored-by: Julian Gutierrez Oschmann <juliangut@google.com>
Co-authored-by: Kevin Steuer <ksteuer@google.com>
Co-authored-by: Max Smythe <smythe@google.com>
Co-authored-by: Maya Wang <mymaya@google.com>
Co-authored-by: Michael Taufen <mtaufen@google.com>
Co-authored-by: Shruti Nair <shrutinair@google.com>
Co-authored-by: Taahir Ahmed <taahm@google.com>
Co-authored-by: Tim Hockin <thockin@google.com>
Co-authored-by: Zoe Zhao <zoezhao@google.com>
 2026-05-19 16:57:14 -07:00