prow-github-actions 3.4.0

v3.4.0

The GitHub App (beta) is now installable on Kubernetes with Helm, from a signed container
image and chart published with every release. Nothing changes for the action: @v3 callers get
it automatically, @v3.2.0 pins move to @v3.4.0.

Kubernetes

helm install prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.4.0 \
  --set github.existingSecret=prow-github

One replica with nothing else, or several replicas sharing a Redis (redis.url); the chart refuses
replicaCount > 1 without one. Deployment with liveness and readiness probes, Service, optional
Ingress, a CronJob for the scheduled jobs, a PodDisruptionBudget for several replicas. Image
ghcr.io/cncf/prow-github-actions:3.4.0 (linux/amd64, linux/arm64) and the chart are both
cosign-signed and carry SLSA provenance (gh attestation verify oci://…). Full guide:
Running as a GitHub App → Kubernetes.

App server fixes

• A pull request's events now run one at a time, in order, as the action's concurrency:
  group arranges; before, two events arriving together could race the merge gate.
• GET /readyz; graceful SIGTERM (in-flight events finish, PROW_SHUTDOWN_GRACE_MS).
• REDIS_URL shares delivery dedupe and the per-pull-request lock across replicas.
• docker build works again (broken since v3.2.0's Worker build step).

Upgrading

Nothing to do for the action. App users on the docker run path: the image is now published, so
ghcr.io/cncf/prow-github-actions:3.4.0 replaces a local build.

Verification

The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands
are under SBOM and provenance below.

Usage

- uses: cncf/prow-github-actions@v3.4.0

GitHub App (beta)

Container image and Helm chart for running Prow as a GitHub App:

docker pull ghcr.io/cncf/prow-github-actions@sha256:0d7bbeead7085476bd88eee391ebeb74a0f3d80118810d634e1428bcbe37480d
helm install prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.4.0

Both are signed with cosign (keyless) and carry SLSA provenance:

cosign verify ghcr.io/cncf/prow-github-actions:3.4.0 \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"
gh attestation verify oci://ghcr.io/cncf/prow-github-actions:3.4.0 --repo cncf/prow-github-actions

SBOM and provenance

An SPDX 2.3 SBOM of the runtime dependencies, generated with
waybill, is attached as
prow-github-actions-3.4.0.spdx.json and signed with
cosign (keyless). SLSA build
provenance covering both dist/index.js and the SBOM is attached as
prow-github-actions-3.4.0.intoto.jsonl.

Verify the SBOM signature:

cosign verify-blob \
  --bundle prow-github-actions-3.4.0.spdx.json.bundle \
  --certificate-identity-regexp="https://github.com/cncf/prow-github-actions" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
  prow-github-actions-3.4.0.spdx.json

Verify the provenance of the bundled action:

gh attestation verify dist/index.js --repo cncf/prow-github-actions

What's Changed

• docs(releases): absolute links in release notes, and a test that keeps them so by @jeefy in #622
• feat(app): order a pull request's events; Redis-shared dedupe and locks for several replicas by @jeefy in #623
• feat(app): publish the image and a Helm chart; install on Kubernetes with helm by @jeefy in #624
• ci(release): log cosign into ghcr before signing the chart by @jeefy in #627
• test(bundle): drive /label-sync's missing-number guard and already-in-sync report through dist/index.js (src/issueComment/labelSync.ts:20-21,32,35) by @hivecommons-hive[bot] in #621
• chore: release v3.4.0 by @jeefy in #628

Full Changelog: v3.2.0...v3.4.0