Update to upstream - v0.13.1

[JasonPowr]

Summary by Sourcery

Refresh dependencies, tooling, and CI workflows to align with newer upstream versions and Kubernetes releases, while tightening timestamp authority validation behavior.

Bug Fixes:

• Ensure validator ignores transparency log when using new TSA bundle format with signed timestamps to match expected authority options.

Enhancements:

• Update golang.org/x libraries and other Go module dependencies and remove the explicit Go toolchain directive from go.mod.
• Bump golangci-lint to the v2.x series and adjust the Makefile and lint workflow to use the newer binary.

CI:

• Expand kind-based test matrices to drop Kubernetes v1.30.x and add v1.34.x across image-policy and e2e workflows.
• Upgrade GitHub Actions across workflows (checkout, cache, CodeQL, Scorecard, upload-artifact, Codecov, Chainguard actions, Google Cloud actions, SBOM/Syft, GoReleaser, cosign-installer, yq, kind tooling, etc.) to their latest pinned versions.
• Update scaffolding release version used in kind cluster image policy workflows to v0.7.27.

[sourcery-ai]

Reviewer's Guide

Syncs this repo with upstream v0.13.1 by updating CI workflows (Kubernetes matrix, GitHub Actions pins, linters, and tooling) and aligning Go module and webhook validation behavior with upstream expectations.

Sequence diagram for TSA bundle validation with IgnoreTlog behavior

sequenceDiagram
  participant APIServer
  participant WebhookValidator
  participant Authority
  participant Bundle
  participant Options

  APIServer->>WebhookValidator: Admit request with image signature
  WebhookValidator->>Authority: Load authority configuration
  Authority-->>WebhookValidator: Returns TSA enabled and new bundle format

  WebhookValidator->>Bundle: Inspect bundle format
  Bundle-->>WebhookValidator: Indicates new bundle format

  WebhookValidator->>Authority: Compare trustRootRef for keyless and TSA
  Authority-->>WebhookValidator: trustRootRef values match

  WebhookValidator->>Options: Initialize verification options
  Options-->>WebhookValidator: Options with default flags

  WebhookValidator->>Options: Set UseSignedTimestamps = true
  WebhookValidator->>Options: Set IgnoreTlog = true

  WebhookValidator->>Authority: Verify signature using TSA bundle and options
  Authority-->>WebhookValidator: Verification result

  WebhookValidator-->>APIServer: Admission response based on verification

Loading

File-Level Changes

Change	Details	Files
Expand CI test matrix and scaffolding version to match upstream Kubernetes and sigstore scaffolding support.	Remove Kubernetes v1.30.x from kind-based workflow matrices. Add Kubernetes v1.34.x to kind-based workflow matrices. Bump SCAFFOLDING_RELEASE_VERSION from v0.7.24 to v0.7.27 in kind image policy workflows.	.github/workflows/kind-cluster-image-policy-tsa.yaml .github/workflows/kind-cluster-image-policy-no-tuf.yaml .github/workflows/kind-cluster-image-policy-trustroot.yaml .github/workflows/kind-cluster-image-policy.yaml .github/workflows/kind-e2e-cosigned.yaml .github/workflows/kind-e2e-trustroot-crd.yaml
Refresh GitHub Actions pins and related CI tooling to newer upstream versions.	Update actions/checkout from v4.2.2 to v5.0.0 across workflows and adjust one secondary checkout pin while keeping its logical version comment. Upgrade sigstore/cosign-installer pins to newer digests (v2 and v3.9.2). Upgrade chainguard-dev actions (setup-kind, setup-mirror, kind-diag, gofmt, goimports, trailing-space, eof-newline, donotsubmit, nodiff) from v1.4.3 to v1.5.10. Update caching, CodeQL, scorecard, upload-artifact, codecov, sbom-action (syft), google-github-actions auth/setup-gcloud, and goreleaser-action to their newer pinned SHAs. Align golangci-lint GitHub Action version from v2.1 to v2.6.	.github/workflows/kind-cluster-image-policy-tsa.yaml .github/workflows/kind-cluster-image-policy-no-tuf.yaml .github/workflows/kind-cluster-image-policy-trustroot.yaml .github/workflows/kind-cluster-image-policy.yaml .github/workflows/kind-e2e-cosigned.yaml .github/workflows/kind-e2e-trustroot-crd.yaml .github/workflows/release.yaml .github/workflows/build.yaml .github/workflows/codeql-analysis.yml .github/workflows/scorecard_action.yml .github/workflows/style.yaml .github/workflows/tests.yaml .github/workflows/release-snapshot.yaml .github/workflows/whitespace.yaml .github/workflows/donotsubmit.yaml .github/workflows/lint.yaml .github/workflows/policy-tester-examples.yml .github/workflows/verify-codegen.yaml .github/workflows/verify-docs.yaml
Adjust Go tooling and dependencies in line with upstream module expectations.	Remove explicit toolchain go1.24.5 directive from go.mod, relying on the go 1.24.0 line only. Bump golang.org/x crypto/net/sys, sync/term/text to the next minor/patch versions as per upstream. Update Makefile golangci-lint install path and version to use the v2 module path and v2.6.2. Regenerate go.sum to reflect dependency updates.	go.mod go.sum Makefile
Align webhook validator TSA bundle behavior with upstream by enabling tlog ignoring when using new bundle format.	When using the new bundle format and signed timestamps, set IgnoreTlog = true in checkOptsFromAuthority. Extend validator test expectations to assert IgnoreTlog: true in the relevant bundle-format test case.	pkg/webhook/validator.go pkg/webhook/validator_test.go

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• In .github/workflows/kind-cluster-image-policy-tsa.yaml, the second actions/checkout step is pinned to the same SHA as v5.0.0 but still commented as # v3.0.2; it would be less confusing to align the comment with the actual version or pin to the correct SHA for v3.0.2 if that’s what you intend.
• You removed the toolchain go1.24.5 directive from go.mod; if the project relies on a specific Go patch level for reproducibility or compatibility, consider keeping or updating the toolchain directive rather than dropping it entirely.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- In `.github/workflows/kind-cluster-image-policy-tsa.yaml`, the second `actions/checkout` step is pinned to the same SHA as v5.0.0 but still commented as `# v3.0.2`; it would be less confusing to align the comment with the actual version or pin to the correct SHA for v3.0.2 if that’s what you intend.
- You removed the `toolchain go1.24.5` directive from `go.mod`; if the project relies on a specific Go patch level for reproducibility or compatibility, consider keeping or updating the toolchain directive rather than dropping it entirely.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}