[pull] master from kubernetes-sigs:master

.github/*.instructions.md

@@ -0,0 +1 @@
+See [AGENTS.md](../AGENTS.md) for AI agent guidelines.

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -1,5 +1,5 @@
 name: Bug Report
-about: Problems and issues with code or docs
+description: Problems and issues with code or docs
 labels:
 - kind/bug
 body: 
@@ -18,7 +18,7 @@ body:
         cross-repository effort, it probably belongs here.  Feel free to continue :wink:
 
       [cr-issue]: https://github.com/kubernetes-sigs/controller-runtime/issues/new
-      [cr-issue]: https://github.com/kubernetes-sigs/controller-tools/issues/new
+      [ct-issue]: https://github.com/kubernetes-sigs/controller-tools/issues/new
 
 - type: markdown
   attributes:
@@ -36,7 +36,7 @@ body:
       <summary>Code & details examples</summary>
 
       `````markdown
-      Some code code written in Go:
+      Some code written in Go:
 
       ```go
       type Manager struct {
@@ -98,7 +98,7 @@ body:
   id: cli-version
   attributes:
     label: KubeBuilder (CLI) Version
-    description: "use `kubebuilder --version` to find this out"
+    description: "use `kubebuilder version` to find this out"
   validations:
     required: true
 
@@ -126,7 +126,7 @@ body:
 
 - type: dropdown
   attributes: 
-    label: " "
+    label: "Extra Labels"
     description: |
       If this is *also* a documentation request, etc, please select that below.
     multiple: true

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 # allow free form issues as an escape hatch.  This can be taken away if people abuse it ;-)
-blank_issues_enabled: true 
+blank_issues_enabled: true
 
 # link to CR and CT for easier access
 contact_links:

.github/ISSUE_TEMPLATE/feature_request.yaml

@@ -18,13 +18,13 @@ body:
         cross-repository effort, it probably belongs here.  Feel free to continue :wink:
 
       [cr-issue]: https://github.com/kubernetes-sigs/controller-runtime/issues/new
-      [cr-issue]: https://github.com/kubernetes-sigs/controller-tools/issues/new
+      [ct-issue]: https://github.com/kubernetes-sigs/controller-tools/issues/new
 
 - type: markdown
   attributes:
     value: |
       # Hiya!  Welcome to Kubebuilder!
-      
+
       For a smooth issue process, try to answer the following questions.
       Don't worry if they're not all applicable; just try to include what you can :smile:
 
@@ -34,9 +34,9 @@ body:
       <details>
 
       <summary>Code & details examples</summary>
-      
+
       `````markdown
-      Some code code written in Go:
+      Some code written in Go:
 
       ```go
       type Manager struct {
@@ -63,7 +63,7 @@ body:
 
       `````
 
-      [mdn-details]: ://developer.mozilla.org/en-US/docs/Web/HTML/Element/details 
+      [mdn-details]: ://developer.mozilla.org/en-US/docs/Web/HTML/Element/details
 
 - type: textarea
   attributes:
@@ -75,13 +75,13 @@ body:
 
       Does it require a particular Kubernetes version?
 
-      Is there currently another isssue associated with this (use github syntax
+      Is there currently another issue associated with this (use github syntax
       like `#xyz` to link to it)?
   validations: {required: true}
 
 - type: dropdown
-  attributes: 
-    label: " "
+  attributes:
+    label: "Extra Labels"
     description: |
       If this is *also* a documentation request, etc, please select that below.
     multiple: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,6 @@
 <!--
 
-Hiya!  Welcome to KubeBuilder!  For a smooth PR process, please ensure
+Hiya!  Welcome to Kubebuilder!  For a smooth PR process, please ensure
 that you include the following information:
 
 * a description of the change

.github/SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Security Announcements
+
+Join the [kubernetes-security-announce] group for security and vulnerability announcements related to the Kubernetes ecosystem.
+
+You can also subscribe to an RSS feed of these announcements using [this link][kubernetes-security-announce-rss].
+
+## Reporting a Vulnerability
+
+Instructions for reporting a vulnerability can be found on the [Kubernetes Security and Disclosure Information] page.
+
+## Supported Versions
+
+Kubebuilder is tested against the latest three Kubernetes releases, in alignment with the [Kubernetes version and version skew support policy](https://kubernetes.io/docs/setup/release/version-skew-policy/).
+
+However, each version is only tested with the dependencies used for its release. For detailed information, please refer to the [compatibility and support policy on GitHub][compatibility-policy].
+
+## Release Policy
+
+Kubebuilder maintains a policy of releasing updates for the latest CLI version (currently v4). Older versions (v1, v2, v3) are no longer supported, and no releases will be produced for them. It is recommended to ensure that any project scaffolded by Kubebuilder remains aligned with the latest release.
+
+## Automated Vulnerability Scanning
+
+Kubebuilder employs automated scanning via Dependabot and GitHub Actions within its CI/CD pipeline. This process detects vulnerabilities in dependencies and configurations, generating daily or weekly reports prioritized for the latest supported versions.
+
+- **Dependabot Configuration**: You can review the setup in `.github/dependabot.yml`.
+- **Security Checks**: Security checks are enabled in the Kubebuilder repository settings.
+- **Code Scanning**: The `.github/workflows/codeql.yml` workflow scans the `master` and `book-v4` branches, which typically contain the latest release code. Other release branches may not be scanned.
+
+## Production-Grade Security
+
+Projects generated by Kubebuilder are designed for ease of development and are **not** configured with production-grade security settings. For example, default configurations do not enable cert-manager or perform proper certificate validation, which may not be suitable for production environments. Ensure that you make the necessary adjustments to security settings before releasing your solution for production.
+
+[kubernetes-security-announce]: https://groups.google.com/forum/#!forum/kubernetes-security-announce
+[kubernetes-security-announce-rss]: https://groups.google.com/forum/feed/kubernetes-security-announce/msgs/rss_v2_0.xml?num=50
+[Kubernetes version and version skew support policy]: https://kubernetes.io/docs/setup/release/version-skew-policy/#supported-versions
+[Kubernetes Security and Disclosure Information]: https://kubernetes.io/docs/reference/issues-security/security/#report-a-vulnerability
+[compatibility-policy]: ./../README.md#versions-compatibility-and-supportability
+[project-upgrade-assistant]: https://book.kubebuilder.io/reference/rescaffold
+[testdata-directory]: https://github.com/kubernetes-sigs/kubebuilder/tree/master/testdata
+[kubebuilder-releases]: https://github.com/kubernetes-sigs/kubebuilder/releases

.github/dependabot.yml

@@ -0,0 +1,56 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # Maintain dependencies for GitHub Actions
+  - package-ecosystem: "github-actions"
+    # Workflow files stored in the
+    # default location of `.github/workflows`
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "ok-to-test"
+
+  # Maintain dependencies for go
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "ok-to-test"
+
+  # Maintain dependencies for go
+  - package-ecosystem: "gomod"
+    directory: "/testdata/project-v4"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: ":seedling:"
+    labels:
+      - "ok-to-test"
+
+  # Maintain dependencies for dockerfile scaffold in the projects
+  - package-ecosystem: docker
+    directory: "testdata/project-v4"
+    schedule:
+      interval: daily
+    commit-message:
+      prefix: ":seedling:"
+
+  # Maintain dependencies for go in external plugin sample
+  - package-ecosystem: "gomod"
+    directory: "docs/book/src/simple-external-plugin-tutorial/testdata/sampleexternalplugin/v1"
+    schedule:
+      interval: "daily"
+    commit-message:
+      prefix: ":book:"
+    labels:
+      - "ok-to-test"

.github/workflows/apidiff.yml

@@ -0,0 +1,30 @@
+name: APIDiff
+
+on:
+  push:
+    paths-ignore:
+      - '**/*.md'
+  pull_request:
+    paths-ignore:
+      - '**/*.md'
+
+jobs:
+  go-apidiff:
+    name: Verify API differences
+    runs-on: ubuntu-latest
+    # Pull requests from different repository only trigger this checks
+    if: (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - name: Execute go-apidiff
+        uses: joelanford/[email protected]
+        with:
+          compare-imports: true
+          print-compatible: true

.github/workflows/codeql.yml

@@ -0,0 +1,54 @@
+name: "CodeQL Advanced"
+
+on:
+  # We are checking both `master` and `book-v4` branches:
+  # - `master` represents the latest development work.
+  # - `book-v4` is the latest stable release branch, which contains the latest published code,
+  #   ensuring that any issues in production are identified and addressed promptly.
+  schedule:
+    - cron: '30 20 * * 1'  # Runs every Monday at 8:30 PM
+
+jobs:
+  analyze:
+    name: Analyze Go
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Build and install Kubebuilder CLI
+        run: make install
+
+      # Preparing the project-v4 sample for CodeQL analysis:
+      # - `go mod tidy` ensures dependencies are fully resolved.
+      # - `make manifests` generates required manifests for a complete project structure.
+      # - `make build` builds the project code, ensuring all components are ready for CodeQL analysis.
+      - name: Build project-v4 sample project
+        run: |
+          cd testdata/project-v4
+          go mod tidy
+          echo 'Running build commands for Go in project-v4'
+          make manifests
+          make build
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: go
+          build-mode: autobuild
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:go"

.github/workflows/coverage.yml

@@ -0,0 +1,31 @@
+name: Coverage
+
+on:
+  push:
+    paths-ignore: ['**/*.md']
+  pull_request:
+    paths-ignore: ['**/*.md']
+
+jobs:
+  coverage:
+    runs-on: ubuntu-latest
+    if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository)
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+
+      - name: Remove pre-installed kustomize
+        run: sudo rm -f /usr/local/bin/kustomize
+
+      - name: Run tests with coverage
+        run: make test-coverage
+
+      - name: Upload coverage to Coveralls
+        uses: shogo82148/actions-goveralls@v1
+        with:
+          path-to-profile: coverage-all.out

.github/workflows/cross-platform-tests.yml

@@ -0,0 +1,43 @@
+name: Cross-Platform Tests
+
+# Trigger the workflow on pull requests and direct pushes to any branch
+on:
+  push:
+    paths-ignore:
+      - '**/*.md'
+  pull_request:
+    paths-ignore:
+      - '**/*.md'
+
+jobs:
+  test:
+    name: ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os:
+          - ubuntu-latest
+          - macos-latest
+    # Pull requests from the same repository won't trigger this checks as they were already triggered by the push
+    if: (github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository)
+    steps:
+      - name: Clone the code
+        uses: actions/checkout@v5
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      # This step is needed as the following one tries to remove
+      # kustomize for each test but has no permission to do so
+      - name: Remove pre-installed kustomize
+        run: sudo rm -f /usr/local/bin/kustomize
+
+      - name: Unit Tests
+        run: make test-unit
+
+      - name: Run Testdata
+        run: make test-testdata
+
+      - name: Run Integration Tests
+        run: make test-integration
+