Merge pull request #141 from cybozu-go/lock-dependencies

Lock dependencies

Author: tkna

.github/workflows/main.yaml

@@ -9,8 +9,8 @@ jobs:
     name: Build image
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: 'go.mod'
       - run: make setup

.github/workflows/release.yaml

@@ -8,8 +8,8 @@ jobs:
     name: Push container image
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: 'go.mod'
       - run: make setup
@@ -18,7 +18,7 @@ jobs:
       - run: make test
       - run: make docker-build
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -36,10 +36,10 @@ jobs:
     needs: image
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Create release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

Makefile

@@ -40,41 +40,50 @@ setup: download-tools download-crds ## Setup
 .PHONY: download-tools
 download-tools: $(GH) $(YQ) $(KUBECTL) $(HELM)
 	GOBIN=$(BIN_DIR) go install sigs.k8s.io/controller-tools/cmd/controller-gen@v$(CONTROLLER_TOOLS_VERSION)
-	GOBIN=$(BIN_DIR) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
+	GOBIN=$(BIN_DIR) go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v$(SETUP_ENVTEST_VERSION)
 	GOBIN=$(BIN_DIR) go install sigs.k8s.io/kustomize/kustomize/v5@v$(KUSTOMIZE_VERSION)
-	GOBIN=$(BIN_DIR) go install github.com/cybozu-go/golang-custom-analyzer/cmd/custom-checker@latest
-	GOBIN=$(BIN_DIR) go install honnef.co/go/tools/cmd/staticcheck@latest
-	GOBIN=$(BIN_DIR) go install golang.org/x/tools/cmd/goimports@latest
-	GOBIN=$(BIN_DIR) go install sigs.k8s.io/kind@latest
+	GOBIN=$(BIN_DIR) go install github.com/cybozu-go/golang-custom-analyzer/cmd/custom-checker@v$(CUSTOM_CHECKER_VERSION)
+	GOBIN=$(BIN_DIR) go install honnef.co/go/tools/cmd/staticcheck@v$(STATICCHECK_VERSION)
+	GOBIN=$(BIN_DIR) go install golang.org/x/tools/cmd/goimports@v$(GOIMPORTS_VERSION)
+	GOBIN=$(BIN_DIR) go install sigs.k8s.io/kind@v$(KIND_CLI_VERSION)
 
 .PHONY: download-crds
 download-crds:
 	curl -fsL -o $(CRD_DIR)/certmanager.yml -sLf https://github.com/jetstack/cert-manager/releases/download/$(call upstream-tag,$(CERT_MANAGER_VERSION))/cert-manager.crds.yaml
+	echo "$(CERTMANAGER_CRD_SHA256)  $(CRD_DIR)/certmanager.yml" | sha256sum --check
 	curl -fsL -o $(CRD_DIR)/dnsendpoint.yml -sLf https://github.com/kubernetes-sigs/external-dns/raw/$(call upstream-tag,$(EXTERNAL_DNS_VERSION))/config/crd/standard/dnsendpoints.externaldns.k8s.io.yaml
+	echo "$(EXTERNALDNS_CRD_SHA256)  $(CRD_DIR)/dnsendpoint.yml" | sha256sum --check
 	curl -fsL -o $(CRD_DIR)/httpproxy.yml -sLf https://github.com/projectcontour/contour/raw/$(call upstream-tag,$(CONTOUR_VERSION))/examples/contour/01-crds.yaml
+	echo "$(CONTOUR_CRD_SHA256)  $(CRD_DIR)/httpproxy.yml" | sha256sum --check
 
 $(GH):
 	mkdir -p $(BIN_DIR)
-	wget -qO - https://github.com/cli/cli/releases/download/v$(GH_VERSION)/gh_$(GH_VERSION)_linux_amd64.tar.gz | tar -zx -O gh_$(GH_VERSION)_linux_amd64/bin/gh > $@
+	wget -qO $(BIN_DIR)/gh.tar.gz https://github.com/cli/cli/releases/download/v$(GH_VERSION)/gh_$(GH_VERSION)_linux_amd64.tar.gz
+	echo "$(GH_SHA256)  $(BIN_DIR)/gh.tar.gz" | sha256sum --check
+	tar -zx -O -f $(BIN_DIR)/gh.tar.gz gh_$(GH_VERSION)_linux_amd64/bin/gh > $@
 	chmod +x $@
+	rm $(BIN_DIR)/gh.tar.gz
 
 $(YQ):
 	mkdir -p $(BIN_DIR)
 	wget -qO $@ https://github.com/mikefarah/yq/releases/download/v$(YQ_VERSION)/yq_linux_amd64
+	echo "$(YQ_SHA256)  $@" | sha256sum --check
 	chmod +x $@
 
 $(KUBECTL):
 	mkdir -p $(BIN_DIR)
 	wget -qO $@ https://dl.k8s.io/release/v$(ENVTEST_K8S_VERSION)/bin/linux/amd64/kubectl
+	echo "$(KUBECTL_SHA256)  $@" | sha256sum --check
 	chmod +x $@
 
 $(HELM):
 	mkdir -p $(BIN_DIR)
-	wget -qO helm.tar.gz https://get.helm.sh/helm-v$(HELM_VERSION)-linux-amd64.tar.gz
-	tar -xzf helm.tar.gz
-	mv linux-amd64/helm $@
+	wget -qO $(BIN_DIR)/helm.tar.gz https://get.helm.sh/helm-v$(HELM_VERSION)-linux-amd64.tar.gz
+	echo "$(HELM_SHA256)  $(BIN_DIR)/helm.tar.gz" | sha256sum --check
+	tar -xzf $(BIN_DIR)/helm.tar.gz -C $(BIN_DIR) linux-amd64/helm
+	mv $(BIN_DIR)/linux-amd64/helm $@
 	chmod +x $@
-	rm -rf linux-amd64 helm.tar.gz
+	rm -rf $(BIN_DIR)/linux-amd64 $(BIN_DIR)/helm.tar.gz
 
 .PHONY: clean
 clean: ## Clean files

Makefile.versions

@@ -12,6 +12,29 @@ HELM_VERSION := 3.20.0
 # https://github.com/cybozu/neco-containers/blob/main/argocd/Dockerfile#L10
 KUSTOMIZE_VERSION := 5.6.0
 
+# Versions for go install
+SETUP_ENVTEST_VERSION := 0.0.0-20260405152528-6210f847b2c1
+CUSTOM_CHECKER_VERSION := 0.1.5
+STATICCHECK_VERSION := 0.7.0
+GOIMPORTS_VERSION := 0.44.0
+KIND_CLI_VERSION := 0.31.0
+
+# Commit SHAs for git-cloned external repositories (must be updated together with the version)
+EXTERNAL_DNS_COMMIT := 5c2787321948e391ac188584855a7339eb8dd5e1
+CONTOUR_COMMIT := 33278ce35c125f8f2338910c983587ac667f95e8
+
+# SHA256 checksums for downloaded files (must be updated together with the version)
+GH_SHA256 := b4f533bf21d1fc0750976b4755e479ae3f59bfc42c9c22dfb0c0c5491ab1e152
+YQ_SHA256 := 654d2943ca1d3be2024089eb4f270f4070f491a0610481d128509b2834870049
+KUBECTL_SHA256 := a2e984a18a0c063279d692533031c1eff93a262afcc0afdc517375432d060989
+HELM_SHA256 := dbb4c8fc8e19d159d1a63dda8db655f9ffa4aac1b9a6b188b34a40957119b286
+CERTMANAGER_CRD_SHA256 := 7326633f0f70514a71dc8eece2414c5f753b8d121e564d4c455f107f32a2defc
+EXTERNALDNS_CRD_SHA256 := 0dbd14aff7edbd9bffc0bb04068f53c6942c94e55567674844fea22fd5f9af9b
+CONTOUR_CRD_SHA256 := c02ed88146211c84edcafb718191f403ab35d8a9c6593bdc244338d20e8461b2
+CERTMANAGER_MANIFEST_SHA256 := a8e859afe65a630d80b2b7e7ef76b6c86c457cfe2bf194b1b3ed20cf6b23471f
+ETCD_YAML_SHA256 := 26d8a20e94007b3030f04fcbcddbe26b01eaab369b0a8a3c8b40c00001df365e
+COREDNS_VALUES_SHA256 := 195a33eb977f39f8280c0ef3146bf9c0fa67a19941e624d7df4e755096fd1b4e
+
 # Versions used only in e2e testing
 KINDEST_NODE_VERSION := 1.35.1
 ENVOY_VERSION := 1.35.9.1

e2e/Makefile

@@ -11,8 +11,10 @@ install-crds:
 .PHONY: update-cert-manager-manifests
 update-cert-manager-manifests:
 	mkdir -p testdata/cert-manager/upstream
-	curl -sSLf https://github.com/jetstack/cert-manager/releases/download/$(call upstream-tag,$(CERT_MANAGER_VERSION))/cert-manager.yaml |\
-		$(YQ) eval 'select(.$(KIND) != "CustomResourceDefinition")' > testdata/cert-manager/upstream/cert-manager.yaml
+	curl -sSLf -o /tmp/cert-manager-upstream.yaml https://github.com/jetstack/cert-manager/releases/download/$(call upstream-tag,$(CERT_MANAGER_VERSION))/cert-manager.yaml
+	echo "$(CERTMANAGER_MANIFEST_SHA256)  /tmp/cert-manager-upstream.yaml" | sha256sum --check
+	$(YQ) eval 'select(.$(KIND) != "CustomResourceDefinition")' /tmp/cert-manager-upstream.yaml > testdata/cert-manager/upstream/cert-manager.yaml
+	rm /tmp/cert-manager-upstream.yaml
 	$(YQ) -i "(.images[] | select(.name==\"ghcr.io/cybozu/cert-manager\")).newTag = \"$(CERT_MANAGER_VERSION)\"" testdata/cert-manager/kustomization.yaml
 
 .PHONY: install-cert-manager
@@ -25,7 +27,9 @@ install-cert-manager:
 update-coredns-manifests:
 	mkdir -p testdata/coredns/upstream
 	curl -sSLf -o testdata/coredns/upstream/etcd.yaml https://raw.githubusercontent.com/kubernetes-sigs/external-dns/refs/tags/$(call upstream-tag,$(EXTERNAL_DNS_VERSION))/docs/snippets/tutorials/coredns/etcd.yaml
+	echo "$(ETCD_YAML_SHA256)  testdata/coredns/upstream/etcd.yaml" | sha256sum --check
 	curl -sSLf -o testdata/coredns/upstream/values-coredns.yaml https://raw.githubusercontent.com/kubernetes-sigs/external-dns/refs/tags/$(call upstream-tag,$(EXTERNAL_DNS_VERSION))/docs/snippets/tutorials/coredns/values-coredns.yaml
+	echo "$(COREDNS_VALUES_SHA256)  testdata/coredns/upstream/values-coredns.yaml" | sha256sum --check
 	# replace etcd resource namespace
 	$(YQ) -i 'select(.metadata.namespace) | .metadata.namespace = "external-dns"' testdata/coredns/upstream/etcd.yaml
 	# replace binary path with that of cybozu build
@@ -48,7 +52,10 @@ install-coredns:
 update-external-dns-manifests:
 	mkdir -p testdata/external-dns/upstream
 	d=$$(mktemp -d); \
-	cd $$d; git clone --depth 1 -b $(call upstream-tag,$(EXTERNAL_DNS_VERSION)) https://github.com/kubernetes-sigs/external-dns.git; \
+	git init $$d/external-dns; \
+	git -C $$d/external-dns remote add origin https://github.com/kubernetes-sigs/external-dns.git; \
+	git -C $$d/external-dns fetch --depth 1 origin $(EXTERNAL_DNS_COMMIT); \
+	git -C $$d/external-dns checkout FETCH_HEAD; \
 	cp -r $$d/external-dns/kustomize/. $(THIS_MK_DIR)/testdata/external-dns/upstream
 	$(YQ) -i "(.images[] | select(.name==\"ghcr.io/cybozu/external-dns\")).newTag = \"$(EXTERNAL_DNS_VERSION)\"" testdata/external-dns/kustomization.yaml
 
@@ -61,7 +68,10 @@ install-external-dns:
 update-contour-manifests:
 	mkdir -p testdata/contour/upstream
 	d=$$(mktemp -d); \
-	cd $$d; git clone --depth 1 -b $(call upstream-tag,$(CONTOUR_VERSION)) https://github.com/projectcontour/contour.git; \
+	git init $$d/contour; \
+	git -C $$d/contour remote add origin https://github.com/projectcontour/contour.git; \
+	git -C $$d/contour fetch --depth 1 origin $(CONTOUR_COMMIT); \
+	git -C $$d/contour checkout FETCH_HEAD; \
 	cp -r $$d/contour/examples/contour/. $(THIS_MK_DIR)/testdata/contour/upstream
 	$(YQ) -i "(.images[] | select(.newName==\"ghcr.io/cybozu/contour\")).newTag = \"$(CONTOUR_VERSION)\"" testdata/contour/kustomization.yaml
 	$(YQ) -i "(.images[] | select(.newName==\"ghcr.io/cybozu/envoy\")).newTag = \"$(ENVOY_VERSION)\"" testdata/contour/kustomization.yaml