feat: add Artifact Hub metadata and fix Dependabot Go version issue #64
Conversation
go.mod
Outdated
| go 1.24.0 | ||
|
|
||
| toolchain go1.24.2 | ||
| go 1.23 |
There was a problem hiding this comment.
Was this intentional? There are security vulnerabilities in 1.23 and we are upgrading in SOK too to 1.24.
There was a problem hiding this comment.
Pull Request Overview
This PR adds Artifact Hub support for the Helm charts and fixes a critical Dependabot issue caused by using an unreleased Go version (1.24.0).
Key Changes:
- Fixed
go.modto use stable Go 1.23 instead of unreleased 1.24.0, resolving Dependabot parsing errors - Added Artifact Hub metadata to both helm charts with detailed annotations for better discoverability
- Created root-level
artifacthub-repo.ymlfor repository-wide Artifact Hub configuration
Reviewed Changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
go.mod |
Changed Go version from unreleased 1.24.0 to stable 1.23 and removed toolchain directive to fix Dependabot compatibility |
artifacthub-repo.yml |
Added repository-level metadata for Artifact Hub listing with owner information and links |
helm-chart/splunk-ai-operator/Chart.yaml |
Enhanced with Artifact Hub annotations including category, license, operator capabilities, links, and recommendations |
helm-chart/splunk-ai-platform/Chart.yaml |
Enhanced with Artifact Hub annotations and updated description to mention observability stack |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - url: https://artifacthub.io/packages/helm/kuberay/kuberay-operator | ||
| artifacthub.io/maintainers: | | ||
| - name: Splunk AI Team | ||
| email: opensource@splunk.com |
There was a problem hiding this comment.
The email address in the Artifact Hub maintainers annotation (opensource@splunk.com) differs from the Chart.yaml maintainers field (splunkai@cisco.com on line 18). This inconsistency may cause confusion. Consider using the same email address for both, preferably splunkai@cisco.com which is consistently used throughout the codebase (CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md).
| email: opensource@splunk.com | |
| email: splunkai@cisco.com |
| - url: https://artifacthub.io/packages/helm/prometheus-community/kube-prometheus-stack | ||
| artifacthub.io/maintainers: | | ||
| - name: Splunk AI Team | ||
| email: opensource@splunk.com |
There was a problem hiding this comment.
The email address in the Artifact Hub maintainers annotation (opensource@splunk.com) differs from the Chart.yaml maintainers field (splunkai@cisco.com on line 21). This inconsistency may cause confusion. Consider using the same email address for both, preferably splunkai@cisco.com which is consistently used throughout the codebase (CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md).
| email: opensource@splunk.com | |
| email: splunkai@cisco.com |
| artifacthub.io/prerelease: "false" | ||
| artifacthub.io/containsSecurityUpdates: "false" | ||
| artifacthub.io/operator: "true" | ||
| artifacthub.io/operatorCapabilities: Seamless Upgrades |
There was a problem hiding this comment.
The operator capabilities annotation is set to "Seamless Upgrades", but the existing helm-chart/splunk-ai-operator/artifacthub-repo.yml file specifies "Full Lifecycle". These should be consistent to avoid confusion on Artifact Hub. Consider aligning both to use the same capability level.
| artifacthub.io/operatorCapabilities: Seamless Upgrades | |
| artifacthub.io/operatorCapabilities: Full Lifecycle |
artifacthub-repo.yml
Outdated
| url: https://github.com/splunk/splunk-ai-operator/releases | ||
| owners: | ||
| - name: Splunk | ||
| email: opensource@splunk.com |
There was a problem hiding this comment.
The email address opensource@splunk.com is inconsistent with the existing helm-chart/splunk-ai-operator/artifacthub-repo.yml file which uses splunkai@cisco.com. For consistency across Artifact Hub configurations, consider using the same email address in both locations.
| email: opensource@splunk.com | |
| email: splunkai@cisco.com |
- Add Artifact Hub annotations to Helm charts for better discoverability - Add artifacthub-repo.yml with repository metadata - Configure Dependabot to ignore Go toolchain updates (managed manually) - Update .env to Go 1.24.0 to match go.mod Artifact Hub changes: - Added category, license, and operator capability annotations - Added links to documentation, compatibility matrix, and BOM - Added recommendations for related charts (cert-manager, kuberay) - Enhanced keywords for better searchability Dependabot configuration: - Added ignore rules for "go" and "golang.org/toolchain" dependencies - Allows manual management of Go version for security patching - Go 1.24 includes security fixes not available in Go 1.23 - Dependabot will still update other Go module dependencies Go version alignment: - go.mod: go 1.24.0 - .env: GO_VERSION=1.24.0 - Ensures consistency across local dev, CI/CD, and workflows 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
vivekr-splunk
force-pushed
the
feat/add-bom-sbom-generation
branch
from
2e48cb6 to
e7ea73c
Compare
Pull Request Test Coverage Report for Build 19483380804Details
💛 - Coveralls |
- Change email from opensource@splunk.com to splunkai@cisco.com - Ensures consistency with existing Chart.yaml maintainers - Updates artifacthub-repo.yml and both Chart.yaml annotations 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
3 participants
Summary
This PR adds Artifact Hub support and configures Dependabot to properly handle Go 1.24 (which includes important security fixes).
Artifact Hub Support
artifacthub-repo.yml: Repository metadata for Artifact Hub listingDependabot Configuration for Go 1.24
.envtoGO_VERSION=1.24.0to matchgo.modWhy This Approach
Go 1.24 Security: Go 1.24.0 includes important security patches. While it's a newer release, we need to use it for security reasons.
Dependabot Limitation: Dependabot may have issues with newer Go versions, so we configure it to ignore Go toolchain updates while still updating other Go module dependencies.
Manual Control: This gives the team full control over when to update the Go version, which is important for:
After Merge
Register on Artifact Hub:
oci://ghcr.io/splunk/chartsDependabot Behavior:
Test Plan
helm lintRelated
🤖 Generated with Claude Code
Co-Authored-By: Claude noreply@anthropic.com