Test build w/push to Cachix.

.coderabbit.yaml

@@ -57,7 +57,7 @@ reviews:
     - "**/*.md"
     - "**/*.proto"
     - "**/Dockerfile*"
-    - "**/Earthfile"
+    - "**/flake.nix"
     - "**/*.sh"
 
     # Exclude generated and vendor files
@@ -71,7 +71,6 @@ reviews:
     - "!**/testdata/**"
     - "!**/dist/**"
     - "!**/build/**"
-    - "!**/.tmp-earthly-out/**"
 
   # Path-specific instructions for different areas of the codebase
   path_instructions:

.github/PULL_REQUEST_TEMPLATE.md

@@ -19,7 +19,7 @@ Fixes #
 I have: <!--You MUST either [x] check or [ ] ~strike through~ every item.-->
 
 - [ ] Read and followed Crossplane's [contribution process].
-- [ ] Run `earthly +reviewable` to ensure this PR is ready for review.
+- [ ] Run `./nix.sh flake check` to ensure this PR is ready for review.
 - [ ] Added or updated unit tests.
 - [ ] Added or updated e2e tests.
 - [ ] Linked a PR or a [docs tracking issue] to [document this change].
@@ -32,4 +32,4 @@ Need help with this checklist? See the [cheat sheet].
 [docs tracking issue]: https://github.com/crossplane/docs/issues/new
 [document this change]: https://docs.crossplane.io/contribute/contribute
 [cheat sheet]: https://github.com/crossplane/crossplane/tree/main/contributing#checklist-cheat-sheet
-[API promotion workflow]: https://github.com/crossplane/crossplane/blob/main/contributing/guide-api-promotion.md
+[API promotion workflow]: https://github.com/crossplane/crossplane/blob/main/contributing/guide-api-promotion.md

.github/renovate-base.json5

@@ -0,0 +1,140 @@
+{
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+  extends: [
+    'config:recommended',
+    'helpers:pinGitHubActionDigests',
+    ':semanticCommits',
+  ],
+  // We only want renovate to rebase PRs when they have conflicts, default
+  // "auto" mode is not required.
+  rebaseWhen: 'conflicted',
+  // The maximum number of PRs to be created in parallel
+  prConcurrentLimit: 5,
+  // The branches renovate should target
+  // PLEASE UPDATE THIS WHEN RELEASING.
+  baseBranches: [
+    'main',
+    'release-1.20',
+    'release-2.0',
+    'release-2.1',
+  ],
+  ignorePaths: [
+    'design/**',
+    // We test upgrades, so leave it on an older version on purpose.
+    "test/e2e/manifests/pkg/provider/provider-initial.yaml",
+    // We test dependencies' upgrades, manifests must remain unchanged to avoid breaking tests.
+    "test/e2e/manifests/pkg/dependency-upgrade/**",
+    // We test packages signature verifications also on upgrades, manifests must remain unchanged to avoid breaking tests.
+    "test/e2e/manifests/pkg/image-config/signature-verification/**"
+  ],
+  postUpdateOptions: [
+    'gomodTidy',
+  ],
+  // All PRs should have a label
+  labels: [
+    'automated',
+  ],
+  crossplane: {
+    fileMatch: [
+      '(^|/)test/e2e/.*\\.ya?ml$',
+    ],
+  },
+  // PackageRules disabled below should be enabled in case of vulnerabilities
+  vulnerabilityAlerts: {
+    enabled: true,
+  },
+  osvVulnerabilityAlerts: true,
+  // Renovate evaluates all packageRules in order, so low priority rules should
+  // be at the beginning, high priority at the end
+  packageRules: [
+    {
+      matchManagers: [
+        'crossplane',
+      ],
+      matchFileNames: [
+        'test/e2e/**',
+      ],
+      groupName: 'e2e-manifests',
+    },
+    {
+      description: 'Ignore non-security related updates to release branches',
+      matchBaseBranches: [
+        '/^release-.*/',
+      ],
+      enabled: false,
+    },
+    {
+      description: 'Still update Docker images on release branches though',
+      matchDatasources: [
+        'docker',
+      ],
+      matchBaseBranches: [
+        '/^release-.*/',
+      ],
+      enabled: true,
+    },
+    {
+      description: 'Only get Docker image updates every 2 weeks to reduce noise',
+      matchDatasources: [
+        'docker',
+      ],
+      schedule: [
+        'every 2 week on monday',
+      ],
+      enabled: true,
+    },
+    {
+      description: 'Ignore k8s.io/client-go older versions, they switched to semantic version and old tags are still available in the repo',
+      matchDatasources: [
+        'go',
+      ],
+      matchDepNames: [
+        'k8s.io/client-go',
+      ],
+      allowedVersions: '<1.0',
+    },
+    {
+      description: 'Ignore k8s dependencies, should be updated on crossplane-runtime',
+      matchDatasources: [
+        'go',
+      ],
+      enabled: false,
+      matchPackageNames: [
+        'k8s.io{/,}**',
+        'sigs.k8s.io{/,}**',
+      ],
+    },
+    {
+      description: 'Only get dependency digest updates every month to reduce noise, except crossplane-runtime',
+      matchDatasources: [
+        'go',
+      ],
+      matchUpdateTypes: [
+        'digest',
+      ],
+      extends: [
+        'schedule:monthly',
+      ],
+      matchPackageNames: [
+        '!github.com/crossplane/crossplane-runtime/v2',
+      ],
+    },
+    {
+      description: "Ignore oss-fuzz, it's not using tags, we'll stick to master",
+      matchDepTypes: [
+        'action',
+      ],
+      matchDepNames: [
+        'google/oss-fuzz',
+      ],
+      enabled: false,
+    },
+    {
+      description: 'Group all go version updates',
+      matchDatasources: [
+        'golang-version',
+      ],
+      groupName: 'golang version',
+    },
+  ],
+}

.github/renovate-earthly.json5

@@ -0,0 +1,164 @@
+{
+  // Earthly-specific configuration for release branches.
+  // Main branch uses Nix - see renovate-nix.json5.
+  customManagers: [
+    {
+      customType: 'regex',
+      description: 'Bump Earthly version in GitHub workflows',
+      fileMatch: [
+        '^\\.github\\/workflows\\/[^/]+\\.ya?ml$',
+      ],
+      matchStrings: [
+        "EARTHLY_VERSION: '(?<currentValue>.*?)'\\n",
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'earthly/earthly',
+      extractVersionTemplate: '^v(?<version>.*)$',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump Go version in Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG --global GO_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'golang-version',
+      depNameTemplate: 'golang',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump golangci-lint version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG GOLANGCI_LINT_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'golangci/golangci-lint',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump helm version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG HELM_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'helm/helm',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump helm-docs version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG HELM_DOCS_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'norwoodj/helm-docs',
+      extractVersionTemplate: '^v(?<version>.*)$',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump kind version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG KIND_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'kubernetes-sigs/kind',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump kubectl version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG KUBECTL_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'kubernetes/kubernetes',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump gotestsum version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG GOTESTSUM_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'gotestyourself/gotestsum',
+      extractVersionTemplate: '^v(?<version>.*)$',
+    },
+    {
+      customType: 'regex',
+      description: 'Bump codeql version in the Earthfile',
+      fileMatch: [
+        '^Earthfile$',
+      ],
+      matchStrings: [
+        'ARG CODEQL_VERSION=(?<currentValue>.*?)\\n',
+      ],
+      datasourceTemplate: 'github-releases',
+      depNameTemplate: 'github/codeql-action',
+      extractVersionTemplate: '^codeql-bundle-(?<version>.*)$',
+    },
+  ],
+  // Renovate doesn't have native Earthfile support, but because Earthfile
+  // syntax is a superset of Dockerfile syntax this works to update FROM images.
+  // https://github.com/renovatebot/renovate/issues/15975
+  dockerfile: {
+    fileMatch: [
+      '(^|/)Earthfile$',
+    ],
+  },
+  packageRules: [
+    {
+      description: 'Generate code after upgrading go dependencies (Earthly)',
+      matchDatasources: [
+        'go',
+      ],
+      matchBaseBranches: [
+        '/^release-.*/',
+      ],
+      postUpgradeTasks: {
+        commands: [
+          'earthly --strict +go-generate',
+        ],
+        fileFilters: [
+          '**/*',
+        ],
+        executionMode: 'update',
+      },
+    },
+    {
+      description: 'Lint code after upgrading golangci-lint (Earthly)',
+      matchDepNames: [
+        'golangci/golangci-lint',
+      ],
+      matchBaseBranches: [
+        '/^release-.*/',
+      ],
+      postUpgradeTasks: {
+        commands: [
+          'earthly --strict +go-lint',
+        ],
+        fileFilters: [
+          '**/*',
+        ],
+        executionMode: 'update',
+      },
+    },
+  ],
+}

.github/renovate-entrypoint.sh

@@ -1,7 +1,25 @@
-#!/bin/sh
+#!/bin/bash
 
+set -e
+
+# Install Earthly (for release branches)
+echo "Installing Earthly..."
 curl -fsSLo /usr/local/bin/earthly https://github.com/earthly/earthly/releases/latest/download/earthly-linux-amd64
 chmod +x /usr/local/bin/earthly
 /usr/local/bin/earthly bootstrap
 
+# Install Nix (for main branch)
+echo "Installing Nix..."
+apt-get update && apt-get install -y nix-bin
+
+# Configure Nix via environment variable
+export NIX_CONFIG="
+experimental-features = nix-command flakes
+max-jobs = auto
+extra-substituters = https://crossplane.cachix.org
+extra-trusted-public-keys = crossplane.cachix.org-1:NJluVUN9TX0rY/zAxHYaT19Y5ik4ELH4uFuxje+62d4=
+"
+
+echo "Nix $(nix --version) installed successfully"
+
 renovate