Skip to content

v1.0.0

Choose a tag to compare

View all tags
@jonasz-lasut jonasz-lasut released this 21 Jul 18:47
v1.0.0
43c44f9
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Upstream Harbor Terraform provider updated v3.12.0 → v3.12.1, adding a new Project field and dropping two fields that can't be represented as Crossplane state.
  • Supply-chain hardening: released images are now signed and attested (SBOM + SLSA provenance) via Cosign, and a weekly Grype scan checks the latest release for new CVEs.
  • Go toolchain bumped to 1.26.5 and CI dependencies (golangci-lint, GitHub Actions, kind, docker buildx) refreshed via Renovate.

Upstream provider update

  • Harbor Terraform provider bumped to v3.12.1 (TERRAFORM_PROVIDER_VERSION).
  • Project: added proxyCacheLocalOnNotFound — serve images from the local cache when they've been removed from the upstream registry (requires Harbor v2.15.1+).
  • Config (Auth): dropped oidc_client_secret_wo / oidc_client_secret_wo_version from the generated schema. These are Terraform write-only fields with no state to read back, so they can't be represented as a Crossplane resource field.
  • internal/clients: updated the buildHarborSetup call site for the new upstream client constructor signature.

Supply chain / release hardening

  • Image signing & attestation — publish-provider-package.yml now signs both the GHCR image and the Upbound registry mirror with Cosign, generates an SPDX SBOM with Syft, and attests both the SBOM and SLSA provenance to each image.
  • Registry mirroring enabled — provider packages are now also mirrored to xpkg.upbound.io (mirror: true), gated behind new id-token / packages / attestations workflow permissions.
  • Marketplace packaging — a new attach-extensions job appends the README, an icon, and the release notes to the published xpkg as Upbound Marketplace extensions.
  • Scheduled vulnerability scanning — a new weekly Grype scan (grype-scan.yaml, Mondays 05:00 UTC) scans the latest published release image and uploads results to GitHub code scanning.

CI / tooling maintenance

  • Go toolchain: 1.25.9 → 1.26.5.
  • golangci-lint: v2.12.1 → v2.12.2.
  • GitHub Actions: actions/checkout → v7, actions/setup-go → v7, actions/cache → v6, codecov/codecov-action → v7, plus digest bumps for docker/setup-buildx-action and docker/setup-qemu-action.
  • docker/buildx → v0.35.0, kubernetes-sigs/kind → v0.32.0, k8s.io/utils digest bump.
  • Removed the ad hoc publish-artifacts job from ci.yml — artifact building/publishing is now handled entirely by the dedicated, signed publish-provider-package.yml workflow.
  • Removed the unused backport.yml workflow.

Compatibility / upgrade notes

  • Backward compatible — no breaking API changes. proxyCacheLocalOnNotFound is purely additive; the two dropped write-only Auth fields were never populated in Crossplane state, so no existing Config resources reference them.
  • Requires Harbor v2.15.1+ to make use of the new proxyCacheLocalOnNotFound field on Project.
  • Building from source now requires Go ≥ 1.26.5.

Full Changelog: v0.2.1...v1.0.0

Assets 2
Loading