chore: update from upstream (#466) * chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 (#5236) Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 4.7.2 to 4.7.3. - [Release notes](https://github.com/actions/dependency-review-action/releases) - [Commits](https://github.com/actions/dependency-review-action/compare/bc41886e18ea39df68b1b1245f4184881938e050...595b5aeba73380359d98a5e087f648dbb0edce1b) --- updated-dependencies: - dependency-name: actions/dependency-review-action dependency-version: 4.7.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump ubi8/ubi from `7010e70` to `534c2c0` (#5237) Bumps ubi8/ubi from `7010e70` to `534c2c0`. --- updated-dependencies: - dependency-name: ubi8/ubi dependency-version: 534c2c0efa4150ede18e3f9d7480d3b9ec2a52e62bc91cd54e08ee7336819619 dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 (#5238) Bumps [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) from 2.4.0 to 3.0.0. - [Release notes](https://github.com/actions/attest-build-provenance/releases) - [Changelog](https://github.com/actions/attest-build-provenance/blob/main/RELEASE.md) - [Commits](https://github.com/actions/attest-build-provenance/compare/e8998f949152b193b063cb0ec769d69d929409be...977bb373ede98d70efdf65b84cb5f73e068dcc2a) --- updated-dependencies: - dependency-name: actions/attest-build-provenance dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * fix: controller-runtime update (#5239) * fix: controller-runtime update Signed-off-by: Gustavo Carvalho * fix: bump e2e Signed-off-by: Gustavo Carvalho * fix: e2e Signed-off-by: Gustavo Carvalho --------- Signed-off-by: Gustavo Carvalho * chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs (#5242) Bumps [regex](https://github.com/mrabarnett/mrab-regex) from 2025.7.34 to 2025.8.29. - [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt) - [Commits](https://github.com/mrabarnett/mrab-regex/compare/2025.7.34...2025.8.29) --- updated-dependencies: - dependency-name: regex dependency-version: 2025.8.29 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs (#5241) Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.3.8 to 4.4.0. - [Release notes](https://github.com/tox-dev/platformdirs/releases) - [Changelog](https://github.com/tox-dev/platformdirs/blob/main/CHANGES.rst) - [Commits](https://github.com/tox-dev/platformdirs/compare/4.3.8...4.4.0) --- updated-dependencies: - dependency-name: platformdirs dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * update dependencies (#5229) Signed-off-by: External Secrets Operator Co-authored-by: External Secrets Operator * chore(deps): bump distroless/static from `2e114d2` to `f2ff10a` (#5240) Bumps distroless/static from `2e114d2` to `f2ff10a`. --- updated-dependencies: - dependency-name: distroless/static dependency-version: f2ff10a709b0fd153997059b698ada702e4870745b6077eff03a5f4850ca91b6 dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * remove verbose logging (#5247) Signed-off-by: Dakota Harden * feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete (#5163) * feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete Signed-off-by: Matheus Mazzoni * docs: Fix provider stability and support table (#5161) Signed-off-by: Jonathan Stacks Signed-off-by: Matheus Mazzoni * feat(helm): Add control of response to missing prometheus (#5087) Signed-off-by: Pat Riehecky Co-authored-by: Gergely Brautigam Signed-off-by: Matheus Mazzoni * chore: Added release notes configuration (#5148) * Added release notes configuration Signed-off-by: Dmytro Bondar * Rename title for default category Signed-off-by: Dmytro Bondar --------- Signed-off-by: Dmytro Bondar Co-authored-by: Gergely Brautigam Signed-off-by: Matheus Mazzoni * refactor: update fmt after make fmt Signed-off-by: Matheus Mazzoni * fix: adjust css and ss watches ps Signed-off-by: Matheus Mazzoni * test: using manager instead of k8s client for get the ps index correctly Signed-off-by: Matheus Mazzoni * chore: bump bitwarden helm chart version (#5044) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Moritz Johner Signed-off-by: Matheus Mazzoni * chore(docs): update `ADOPTERS.md` to include SAP (#5165) SAP is an active and collaborating company in the ESO ecosystem. I have the admission of the company to admit us as Adopter. Disclaimer: I work at SAP Signed-off-by: Jakob Möller Signed-off-by: Matheus Mazzoni * feat: use cmd.Context for index the syncedSecrets and deletionPolicy on ps controller Signed-off-by: Matheus Mazzoni * chore: using a single finalizer handler for all secret stores Signed-off-by: Matheus Mazzoni * docs: remove TODO comment from pushsecret controller test Signed-off-by: Matheus Mazzoni * chore: update the handlerFinalizer logic turnig more readable Signed-off-by: Matheus Mazzoni * test: create secretstore finalizer management suite Signed-off-by: Matheus Mazzoni * refactor: remove findForPushSecret code duplication on SetupWithManager CSS/SS Signed-off-by: Matheus Mazzoni * docs: update suite_test comments Signed-off-by: Matheus Mazzoni * fix: skip finalizer management when pushsecret feature is disable Signed-off-by: Matheus Mazzoni * fix: remove handle finalizers from generic_store and update the syncedPushSecrets index to use the entire storeKey Signed-off-by: Matheus Mazzoni * refactor: improves readability of hasPushSecretsWithDeletePolicy function and add some new comments Signed-off-by: Matheus Mazzoni * fix: update the code fmt, lint and move some util functions for util.go file Signed-off-by: Matheus Mazzoni * Apply suggestions from code review Co-authored-by: Jakob Möller Signed-off-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com> * refactor: update the watcher based if the pushsecrets is enabled Signed-off-by: Matheus Mazzoni --------- Signed-off-by: Matheus Mazzoni Signed-off-by: Jonathan Stacks Signed-off-by: Pat Riehecky Signed-off-by: Dmytro Bondar Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Signed-off-by: Jakob Möller Signed-off-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com> Co-authored-by: Jonathan Stacks Co-authored-by: Pat Riehecky <3534830+jcpunk@users.noreply.github.com> Co-authored-by: Gergely Brautigam Co-authored-by: Dmytro Bondar Co-authored-by: Moritz Johner Co-authored-by: Jakob Möller Co-authored-by: Jakob Möller * fix: keepersecurity support for shortcuts (#5245) Signed-off-by: Pedro Parra Ortega * feat: add support for GCP Workload Identity Federation (#4654) * 1038: Updates SecretStore API with GCP Workload Identity Federation support Signed-off-by: Bharath B * 1038: Updates GCP generator with GCP Workload Identity Federation support Signed-off-by: Bharath B * 1038: Updates GCP generator with GCP Workload Identity Federation support Signed-off-by: Bharath B * updates api-docs/Makefile docker command Signed-off-by: Bharath B * incorporate review suggestions on the API changes Signed-off-by: Bharath B * fmt tool suggested changes Signed-off-by: Bharath B * updates ClusterGenerator limitation on referenced objects Signed-off-by: Bharath B --------- Signed-off-by: Bharath B Co-authored-by: Gergely Brautigam * feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager (#5022) * Add new meaningOfKey field Signed-off-by: asrormirzoev Add an implementation of the get by name feature with meaningOfKey in Yandex Lockbox Signed-off-by: asrormirzoev Add stub implementation in ycm provider for local launch Signed-off-by: asrormirzoev Fixed the cache issue Signed-off-by: asrormirzoev Fix an issue with v1beta Signed-off-by: asrormirzoev Remove unnecessary arguments Signed-off-by: asrormirzoev Fix an issue with naming Signed-off-by: asrormirzoev Fix the issue with the meaningOfKey fork Signed-off-by: asrormirzoev Fix the issue with unsupported resourceKeyType Signed-off-by: asrormirzoev * Change fetching structure Signed-off-by: asrormirzoev Fix case order in swith statement Signed-off-by: asrormirzoev Fix naming Signed-off-by: asrormirzoev Fix the issue with enum naming Signed-off-by: asrormirzoev Fix comments of the new fields Signed-off-by: asrormirzoev * Add a check for the simultaneous existence of two fields Signed-off-by: asrormirzoev Remove duplicates from the code Signed-off-by: asrormirzoev Fix the issue with error handling Signed-off-by: asrormirzoev Fix the issue with naming Signed-off-by: asrormirzoev * Add new field explanation in docs Signed-off-by: asrormirzoev Remove unnecessary chap; add some more comments Signed-off-by: asrormirzoev Remove meaningOfKey and add new fields Signed-off-by: asrormirzoev Remove meaningOfKey field Signed-off-by: asrormirzoev Simplify docs Signed-off-by: asrormirzoev Change naming Signed-off-by: asrormirzoev * Add get by name feature in ycm Signed-off-by: asrormirzoev Fix the issue with log message Signed-off-by: asrormirzoev * Add the versionID field to the requests Signed-off-by: asrormirzoev Add folder specific data Signed-off-by: asrormirzoev * Add base tests for ycm provider Signed-off-by: asrormirzoev Added a test to check when folderID is not set in FetchByName Signed-off-by: asrormirzoev Remove duplicate in folderValue field Signed-off-by: asrormirzoev * Change folderMap to folderAndNameMap and flatten the error check Signed-off-by: asrormirzoev Fix tests naming Signed-off-by: asrormirzoev * Refactor folderAndNameMap structure Signed-off-by: asrormirzoev Refactor folderAndName map key and value namings Signed-off-by: asrormirzoev * Add some base tests Signed-off-by: asrormirzoev Remove unnecessary check Signed-off-by: asrormirzoev Add test when secret is not found by name Signed-off-by: asrormirzoev * Set default folderIds and secretNames Signed-off-by: asrormirzoev Refactor tests naming Signed-off-by: asrormirzoev * Add tests for checking different entries when fetching by name option enabled Signed-off-by: asrormirzoev Add some more tests Signed-off-by: asrormirzoev Remove unnecessary condition Signed-off-by: asrormirzoev Add test when folderID isn't set Signed-off-by: asrormirzoev Remove duplicate in folderValue field Signed-off-by: asrormirzoev Fix the issue with filling folderId and name Signed-off-by: asrormirzoev Remove unnecessary method Signed-off-by: asrormirzoev Change tests name Signed-off-by: asrormirzoev * Rename folderMap to folderAndNameMap and flatten error checks Signed-off-by: asrormirzoev Validate folderId and name before mapping entries Signed-off-by: asrormirzoev * Refactor the structure of folderAndNameMap Signed-off-by: asrormirzoev Refactor folderAndName map key and value namings Signed-off-by: asrormirzoev Fix codestyle issues Signed-off-by: asrormirzoev * Add about new fields in docs Signed-off-by: asrormirzoev Remove duplicate Signed-off-by: asrormirzoev Remove duplicates Signed-off-by: asrormirzoev * Fix the issue with prinln Signed-off-by: asrormirzoev * Change fetching configuration Signed-off-by: asrormirzoev Remove useless check Signed-off-by: asrormirzoev Fix docs Signed-off-by: asrormirzoev * Fix the lint issue Signed-off-by: asrormirzoev * Fix the lint issue Signed-off-by: asrormirzoev * Rebase onto main Signed-off-by: asrormirzoev * Run make helm.test.update and make test.crds.update Signed-off-by: asrormirzoev --------- Signed-off-by: asrormirzoev Co-authored-by: asrormirzoev Co-authored-by: Gergely Brautigam * Adds new make target for installing unittest plugin (#5250) Signed-off-by: Bharath B Co-authored-by: Jakob Möller * add comments & ntoe (#5248) Signed-off-by: Niels ten Boom Co-authored-by: Gergely Brautigam * feat(release): add new workflow to label first time contributor issues (#5243) * Add new workflow to label first time contributor issues Signed-off-by: mouhsen.ibrahim * Use hash of action/github-script github action Co-authored-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com> Signed-off-by: Mouhsen Ibrahim * use first-interaction action to add a comment to the issues Signed-off-by: mouhsen.ibrahim * Remove code to create the label if it doesn't exist Signed-off-by: mouhsen.ibrahim --------- Signed-off-by: mouhsen.ibrahim Signed-off-by: Mouhsen Ibrahim Co-authored-by: Matheus Mazzoni <54732019+matheusmazzoni@users.noreply.github.com> * Add an option to make HTTP2 configurable (#5231) Signed-off-by: siddhi bhor # Conflicts: # cmd/controller/root.go Co-authored-by: Gergely Brautigam * feat: add retry for onepassword on authorization error (#5253) * feat: add retry for onepassword on authorization error Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * updated to use k8s OnError and added retry client Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * extracted the retry client into its own file Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> --------- Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Jakob Möller * fix: handle namespace deletion race conditions with finalizers (#5154) * fix: handle namespace deletion race conditions with finalizers Replace error suppression approach with proper finalizer-based cleanup to prevent race conditions when namespaces are deleted. Changes: - Add finalizers to ClusterExternalSecret and ExternalSecret controllers - Implement proper cleanup order during deletion - Add namespace deletion checks before creating ExternalSecrets - Remove namespace finalizers during CES cleanup - Handle managed secret cleanup based on DeletionPolicy This ensures resources are cleaned up in the correct order and prevents errors when namespaces are terminating. Fixes #4175 Signed-off-by: framsouza * fix: resolve CI failures - lint and race conditions - Fixed godot lint errors by adding periods to comment endings - Fixed namespace update race conditions by: - Fetching latest namespace before updates to avoid conflicts - Handling IsConflict errors with immediate requeue - Making test retry on conflict when updating namespaces - All tests now pass locally Signed-off-by: framsouza * Address review feedback and improve error handling Based on reviewer feedback, this commit improves the code quality: Controller behavior fixes: - Return immediately after Update() calls to let Kubernetes trigger the next reconciliation naturally rather than continuing - Replace deprecated Requeue field with RequeueAfter: 0 for immediate reconciliation on conflicts Error handling improvements: - Properly return errors from cleanup functions instead of just logging them - Aggregate multiple errors during cleanup and return them all - Add clear comments explaining the namespace finalizer purpose The namespace finalizer prevents race conditions when namespaces are deleted while ClusterExternalSecrets still have resources in them. Each CES gets its own finalizer to track its resources independently. Signed-off-by: framsouza * fix: add namespace update permissions for ClusterExternalSecret controller The controller needs permission to update namespaces when managing finalizers to prevent race conditions during namespace deletion. Signed-off-by: framsouza * fix: resolve unused parameter linter error The log parameter in cleanupExternalSecrets was not being used, causing linter failures in CI. Changed to underscore to indicate intentionally unused parameter. Signed-off-by: framsouza * refactor: reduce cognitive complexity in cleanup methods Split cleanupExternalSecrets into smaller functions to improve readability. Extracted namespace and finalizer operations into separate helper methods. Reduces SonarCloud complexity score from 30 to under 10. Signed-off-by: framsouza * fix: resolve golangci-lint errors - Add periods to end of comment lines to fix godot linter errors - Combine repeated parameter types to fix gocritic paramTypeCombine warnings - Updated function signatures to use combined type declarations (e.g., namespaceName, finalizer string) Signed-off-by: framsouza * refactor: improve finalizer handling and error aggregation - Always attempt cleanup on deletion to handle edge cases - Only call Update() when finalizers actually change - Use errors.Join() instead of error slices - Return error instead of RequeueAfter:0 for conflicts Addresses review feedback from jakobmoellerdev. Signed-off-by: framsouza * docs(helm): Add detailed comment for processClusterExternalSecret flag Clarifies that enabling processClusterExternalSecret adds update/patch permissions on namespaces to handle finalizers for proper cleanup during namespace deletion, preventing race conditions with ExternalSecrets. Signed-off-by: framsouza * docs(helm): Update generated README with processClusterExternalSecret documentation The helm chart README is auto-generated from values.yaml comments. This commit includes the generated documentation for the processClusterExternalSecret flag. Signed-off-by: framsouza --------- Signed-off-by: framsouza Signed-off-by: framsouza Co-authored-by: Moritz Johner Co-authored-by: Jakob Möller * add Oracle Vault maintainer (#5257) Signed-off-by: Anders Swanson Co-authored-by: Gergely Brautigam * fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 (#5263) * upgrade akeyless go sdk version to v4 Signed-off-by: Kobbi Gal * update e2e go sum Signed-off-by: Kobbi Gal --------- Signed-off-by: Kobbi Gal * feat: support Pod Identity authentication for Vault Provider (#5201) * tidy: clean requestTokenWithIamAuth function to better support changes. Signed-off-by: Erik Westra * feat: add ability to use pod identity (if irsa token is not set and pod identity environment variables are) Signed-off-by: Erik Westra * docs: update documentation to describe support for both IRSA and pod identity Signed-off-by: Erik Westra * (peer-review) remove documentation from v1beta1 and move v1 comment to the struct instead of a non-existent field) so it actually shows up in generated docs. Signed-off-by: Erik Westra * (peer-review) properly catch both unset and empty set values Signed-off-by: Erik Westra * (peer-review) clean file path for os.Stat call as well. Signed-off-by: Erik Westra * (peer-review) make type assertions safer. Signed-off-by: Erik Westra * (peer-review) fix unnecessary fmt.Errorf with no verbs Co-authored-by: Gustavo Fernandes de Carvalho <17139678+gusfcarvalho@users.noreply.github.com> Signed-off-by: Erik Westra * (peer-review) explicitly check for missing token claims. Signed-off-by: Erik Westra * (peer-review) return correct errors for invalid token claims. Signed-off-by: Erik Westra * (peer-review) only require the podIdentityURI to be set. Signed-off-by: Erik Westra * (peer-review) fix unnecessary nil error in claim validation. Signed-off-by: Erik Westra --------- Signed-off-by: Erik Westra Co-authored-by: Gustavo Fernandes de Carvalho <17139678+gusfcarvalho@users.noreply.github.com> Co-authored-by: Gergely Brautigam * add domain field to secretserver provider (#5258) Signed-off-by: Rodrigo Kellermann Co-authored-by: Gergely Brautigam * use actions/create-github-app-token action to get app installation tokens and fix the parameters (#5264) Signed-off-by: mouhsen.ibrahim Co-authored-by: Gergely Brautigam * chore: just updating the crd conformance tests (#5265) * Revert "use actions/create-github-app-token action to get app installation to…" (#5269) This reverts commit 941564a38cd1023b481780f9fba5ef39bcb663e1. Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * chore: azure sdk update (#5162) * Support new azure sdk and custom clouds via feature flag Signed-off-by: will haus * fix(provider/kubernetes): make auth field optional (#5064) Signed-off-by: Martin Hrabovcin Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Gergely Brautigam Signed-off-by: will haus * chore: Fix Markdown spelling issues found by codespell (#5139) See, ``` codespell $(find . -type f -name '*.md') ``` Signed-off-by: Mario Trangoni Co-authored-by: Gergely Brautigam Signed-off-by: will haus * Fix yaml codeblock for oracle-vault provider (#5146) Signed-off-by: Anton Mu <34460584+muckelba@users.noreply.github.com> Signed-off-by: will haus * feat: add liveness probe to eso controller (#4930) * feat: add liveness probe to eso controller Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * fixed the linter warning Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * fixed the helm schema generator as values and output was removed effectively Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com * add named port and add a helm test for the new value Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: gergely.brautigam@sap.com Signed-off-by: will haus * fix(helm): add boolean for processClusterGenerator (#5144) * fix(helm): add boolean to remove clusterGenerator Signed-off-by: DrummyFloyd * style(helm): typo missing space Signed-off-by: DrummyFloyd --------- Signed-off-by: DrummyFloyd Signed-off-by: will haus * chore: add Cisco to ADOPTERS.md (#5159) - Add Cisco.com to the ADOPTERS.md Signed-off-by: Sri Aradhyula Signed-off-by: will haus * docs: Fix provider stability and support table (#5161) Signed-off-by: Jonathan Stacks Signed-off-by: will haus * feat(helm): Add control of response to missing prometheus (#5087) Signed-off-by: Pat Riehecky Co-authored-by: Gergely Brautigam Signed-off-by: will haus * fix lint errors Signed-off-by: will haus * address code comments, move new code to new file Signed-off-by: will haus * test suite and make fmt-ed Signed-off-by: will haus * reduce complexity of getAllSecrets with new sdk Signed-off-by: will haus * forgot to lint Signed-off-by: william-o-haus-civ_S2VA * requested changes and check-diff run Signed-off-by: hauswio * marshall key into new type order Signed-off-by: hauswio * fix: run go mod tidy on e2e Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> --------- Signed-off-by: will haus Signed-off-by: Martin Hrabovcin Signed-off-by: Mario Trangoni Signed-off-by: Anton Mu <34460584+muckelba@users.noreply.github.com> Signed-off-by: DrummyFloyd Signed-off-by: Sri Aradhyula Signed-off-by: Jonathan Stacks Signed-off-by: Pat Riehecky Signed-off-by: william-o-haus-civ_S2VA Signed-off-by: hauswio <92599939+hauswio@users.noreply.github.com> Signed-off-by: hauswio Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: will haus Co-authored-by: Martin Hrabovcin Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Gergely Brautigam Co-authored-by: Mario Trangoni Co-authored-by: Anton Mu <34460584+muckelba@users.noreply.github.com> Co-authored-by: DrummyFloyd Co-authored-by: Sri Aradhyula Co-authored-by: Jonathan Stacks Co-authored-by: Pat Riehecky <3534830+jcpunk@users.noreply.github.com> * chore(deps): bump golang from 1.25.0 to 1.25.1 (#5275) Bumps golang from 1.25.0 to 1.25.1. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#5274) Bumps [actions/github-script](https://github.com/actions/github-script) from 7.0.1 to 8.0.0. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/60a0d83039c74a4aee543508d2ffcb1c3799cdea...ed597411d8f924073f98dfc5c65a23a2325f34cd) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 8.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump actions/stale from 9.1.0 to 10.0.0 (#5273) Bumps [actions/stale](https://github.com/actions/stale) from 9.1.0 to 10.0.0. - [Release notes](https://github.com/actions/stale/releases) - [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/stale/compare/5bef64f19d7facfb25b37b414482c7164d639639...3a9db7e6a41a89f618792c92c0e97cc736e1b13f) --- updated-dependencies: - dependency-name: actions/stale dependency-version: 10.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#5276) Bumps [actions/setup-go](https://github.com/actions/setup-go) from 5.5.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/d35c59abb061a4a6fb18e82ac0862c26744d6ab5...44694675825211faa026b3c33043df3e48a5fa00) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump mkdocs-material in /hack/api-docs (#5279) Bumps [mkdocs-material](https://github.com/squidfunk/mkdocs-material) from 9.6.18 to 9.6.19. - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](https://github.com/squidfunk/mkdocs-material/compare/9.6.18...9.6.19) --- updated-dependencies: - dependency-name: mkdocs-material dependency-version: 9.6.19 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 (#5278) Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 5.5.0 to 5.5.1. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/codecov/codecov-action/compare/fdcc8476540edceab3de004e990f80d881c6cc00...5a1091511ad55cbe89839c7260b706298ca349f7) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-version: 5.5.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 (#5277) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.29.11 to 3.30.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/3c3833e0f8c1c83d449a7478aa59c036a9165498...f1f6e5f6af878fb37288ce1c627459e94dbf7d01) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.30.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs (#5281) Bumps [markdown](https://github.com/Python-Markdown/markdown) from 3.8.2 to 3.9. - [Release notes](https://github.com/Python-Markdown/markdown/releases) - [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md) - [Commits](https://github.com/Python-Markdown/markdown/compare/3.8.2...3.9.0) --- updated-dependencies: - dependency-name: markdown dependency-version: '3.9' dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e (#5280) Bumps golang from 1.25.0-bookworm to 1.25.1-bookworm. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.1-bookworm dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs (#5282) Bumps [regex](https://github.com/mrabarnett/mrab-regex) from 2025.8.29 to 2025.9.1. - [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt) - [Commits](https://github.com/mrabarnett/mrab-regex/compare/2025.8.29...2025.9.1) --- updated-dependencies: - dependency-name: regex dependency-version: 2025.9.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * feat: add support for fetching Secret by Path on Delinea Secret Server provider (#5270) * update tss-sdk-go module Signed-off-by: DelineaSahilWankhede * Revert "update tss-sdk-go module" This reverts commit 71b284c5afd2f05f15819e69e2a2e72c15a83f2e. Signed-off-by: DelineaSahilWankhede * update tss-sdk-go module Signed-off-by: DelineaSahilWankhede * update Delinea SecretServer provider Signed-off-by: DelineaSahilWankhede * update Delinea SecretServer provider doc Signed-off-by: DelineaSahilWankhede * fix linting issues Signed-off-by: DelineaSahilWankhede * Update docs/provider/secretserver.md Co-authored-by: Moritz Johner Signed-off-by: DelineaSahilWankhede <161290557+DelineaSahilWankhede@users.noreply.github.com> * fix e2e go.mod/go.sum Signed-off-by: DelineaSahilWankhede * update e2e go modules and provider Signed-off-by: DelineaSahilWankhede * revert deletion of other provider mods Signed-off-by: DelineaSahilWankhede * Update e2e/go.mod as needed Signed-off-by: DelineaSahilWankhede * added running make check-diff Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> --------- Signed-off-by: DelineaSahilWankhede Signed-off-by: DelineaSahilWankhede <161290557+DelineaSahilWankhede@users.noreply.github.com> Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: Moritz Johner Co-authored-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * migrate from tibdex/github-app-token to actions/create-github-app-token. Force getTokenFromOwner (#5286) Signed-off-by: Rodrigo Kellermann Co-authored-by: Gergely Brautigam * fix: license headers across all Go files - standardize format, add missing copyright, fix typos (#5288) * Initial plan * Fix license headers in all Go files - add copyright, fix typos, standardize format Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * run make fmt to fix formatting Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> --------- Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * fix: the boilerplate was missing the right license format (#5289) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action (#5290) * Initial plan * Add license header check scripts and workflow * Add test Go files for license header validation * Complete license header check implementation with CI integration Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * Add license header requirements to developer guide Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * Replace bash scripts with Apache SkyWalking Eyes GitHub Action for license header checking Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * Replace spdx-id with content matching hack/boilerplate.go.txt in .licenserc.yaml Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * Update .licenserc.yaml content to match updated hack/boilerplate.go.txt Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * Replace paths-ignore with language configuration to only check Go files Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * Replace language configuration with paths to only check Go files using **/*.go pattern Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> * fix: license header format on all files Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam * a bunch of more fixes for files Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam * revert setup go update because it breaks go version parsing Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * separate the license check from check-diff Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam --------- Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Skarlso <182850+Skarlso@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(docs): remove GitHub Discussions references and update support channels (#5292) fix https://github.com/external-secrets/external-secrets/issues/5283 Signed-off-by: Jakob Möller * doc: update the ladder with two new tracks: documentation and community (#5298) * doc: create upgrading section (#5310) Signed-off-by: Rodrigo Kellermann * docs: readme update for health of the project (#5309) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam * fix: validate namespace in secretRef (#5311) * fix: validate namespace in secretRef Signed-off-by: Moritz Johner * docs: add burnout prevention strategies and mitigation policy document (#5307) * docs: add burnout prevention strategies and mitigation policy document Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam * Apply suggestions from code review Co-authored-by: Jean-Philippe Evrard Signed-off-by: Gergely Brautigam * Update docs/contributing/burnout-mitigation.md Co-authored-by: Jean-Philippe Evrard Signed-off-by: Gergely Brautigam --------- Signed-off-by: Gergely Brautigam Co-authored-by: Jean-Philippe Evrard * feat: add missing go sbom (#5313) Signed-off-by: Moritz Johner * feat: make vault e2e tests run locally (#5246) * feat: make vault e2e tests run locally Signed-off-by: Moritz Johner * fix: use ginkgo ctx in e2e tests Signed-off-by: Moritz Johner * fix: go mod & use ginkgo ctx in aws tests Signed-off-by: Moritz Johner * fix: helm uninstall should wait, uninstall flux after suite Signed-off-by: Moritz Johner * fix: wait for hr to be uninstalled before removing flux Signed-off-by: Moritz Johner * fix: use context in new azure tests Signed-off-by: Moritz Johner * fix: port forward handling Signed-off-by: Moritz Johner * fix: :broom: conjur naming & fwd close Signed-off-by: Moritz Johner --------- Signed-off-by: Moritz Johner Co-authored-by: Gergely Brautigam * chore(deps): bump golang from `b6ed3fd` to `b6ed3fd` (#5318) Bumps golang from `b6ed3fd` to `b6ed3fd`. --- updated-dependencies: - dependency-name: golang dependency-version: 1.25.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 (#5317) Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.0.0. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/a26af69be951a213d495a4c3e4e4022e16d87065...e797f83bcb11b83ae66e0230d6156d7c80228e7c) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 (#5319) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.30.1 to 3.30.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f1f6e5f6af878fb37288ce1c627459e94dbf7d01...192325c86100d080feab897ff886c34abd4c83a3) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 3.30.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump distroless/static from `f2ff10a` to `87bce11` (#5320) Bumps distroless/static from `f2ff10a` to `87bce11`. --- updated-dependencies: - dependency-name: distroless/static dependency-version: 87bce11be0af225e4ca761c40babb06d6d559f5767fbf7dc3c47f0f1a466b92c dependency-type: direct:production ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 (#5323) Bumps [actions/labeler](https://github.com/actions/labeler) from 5.0.0 to 6.0.1. - [Release notes](https://github.com/actions/labeler/releases) - [Commits](https://github.com/actions/labeler/compare/8558fd74291d67161a8a78ce36a881fa63b766a9...634933edcd8ababfe52f92936142cc22ac488b1b) --- updated-dependencies: - dependency-name: actions/labeler dependency-version: 6.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 (#5321) Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2.3.2 to 2.3.3. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/72f2c25fcb47643c292f7107632f7a47c1df5cd8...6cbd405e2c4e67a21c47fa9e383d020e4e28b836) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 2.3.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 (#5322) Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.1.1 to 2.1.4. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Commits](https://github.com/actions/create-github-app-token/compare/a8d616148505b5069dccd32f177bb87d7f39123b...67018539274d69449ef7c02e8e71183d1719ab42) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 2.1.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Moritz Johner * chore: update dependencies (#5324) * update dependencies Signed-off-by: External Secrets Operator * fix: disable conjur credentials storage Signed-off-by: Moritz Johner --------- Signed-off-by: External Secrets Operator Signed-off-by: Moritz Johner Co-authored-by: External Secrets Operator Co-authored-by: Moritz Johner * feat: add Cloudsmith generator for container registry authentication (#5267) * feat: add Cloudsmith generator for container registry authentication Implements CloudsmithAccessToken generator that uses OIDC token exchange to authenticate with Cloudsmith's container registry. The generator creates dockerconfigjson secrets for pulling/pushing container images. Key features: - OIDC authentication using Kubernetes service account tokens - Generates dockerconfigjson secrets for Docker registry access - Configurable API host with default to api.cloudsmith.io - Support for both namespaced and cluster-wide generators - Comprehensive documentation and examples Signed-off-by: Ian Duffy * fix: code duplication feedback Signed-off-by: Ian Duffy * fix: add documentation link for cloudsmith Signed-off-by: Ian Duffy * fix: param rename Signed-off-by: Ian Duffy * Fix: review feedback Signed-off-by: Ian Duffy * fix: update headers Signed-off-by: Ian Duffy * fix: add generated files Signed-off-by: Ian Duffy --------- Signed-off-by: Ian Duffy Co-authored-by: Gergely Brautigam * feat: Add lgtm review automation step to ci workflows. (#5251) * feat(ci): Add lgtm approval workflows. Signed-off-by: Erik Westra * standardise name (inline with other pull request maintenance workflows) Signed-off-by: Erik Westra * (peer-review) remove lgtm label and make label name a constant. Signed-off-by: Erik Westra * (peer-review) remove review question and clarify permission usage. Signed-off-by: Erik Westra --------- Signed-off-by: Erik Westra * feat(provider): add Volcengine provider support (#5306) Add support for Volcengine (BytePlus) as a new provider for External Secrets. This includes: - Implementation of the provider with support for both static credentials and IRSA authentication - Documentation and examples for configuration - CRD updates and test cases - Integration with Volcengine KMS for secret management Signed-off-by: yanfuhai Co-authored-by: Riccardo M. Cefala * test: add more information to potentially flaky test (#5330) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * fix(docs): Fix typo in controller options doc (#5299) * Fix typo in controller options doc Signed-off-by: Thomas D. Spear * Fix inconsistent spacing Signed-off-by: Thomas D. Spear --------- Signed-off-by: Thomas D. Spear Co-authored-by: Thomas D. Spear * ci: Add licence.check make target (#5335) Also add it as a target for reviewable. There is now a licence check github action that runs to make sure that all files have a correct license Signed-off-by: Jonathan Stacks * docs(gitlab-variables): document environment scope fallback (#5300) * docs(gitlab-variables): document environment scope fallback Added details about environment scope fallback behavior for GitLab provider. Signed-off-by: Sinyx Signed-off-by: s1nyx * docs(gitlab-variables): add implementation note for environment scope fallback behavior Signed-off-by: s1nyx --------- Signed-off-by: Sinyx Signed-off-by: s1nyx Co-authored-by: Gergely Brautigam * chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 (#5339) Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 2.1.1 to 2.1.4. - [Release notes](https://github.com/actions/create-github-app-token/releases) - [Commits](https://github.com/actions/create-github-app-token/compare/v2.1.1...67018539274d69449ef7c02e8e71183d1719ab42) --- updated-dependencies: - dependency-name: actions/create-github-app-token dependency-version: 2.1.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 (#5344) Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.33.0 to 0.33.1. - [Release notes](https://github.com/aquasecurity/trivy-action/releases) - [Commits](https://github.com/aquasecurity/trivy-action/compare/f9424c10c36e288d5fa79bd3dfd1aeb2d6eae808...b6643a29fecd7f34b3597bc6acb0a98b03d33ff8) --- updated-dependencies: - dependency-name: aquasecurity/trivy-action dependency-version: 0.33.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump mkdocs-material in /hack/api-docs (#5345) Bumps [mkdocs-material](https://github.com/squidfunk/mkdocs-material) from 9.6.19 to 9.6.20. - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](https://github.com/squidfunk/mkdocs-material/compare/9.6.19...9.6.20) --- updated-dependencies: - dependency-name: mkdocs-material dependency-version: 9.6.20 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 (#5343) Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.13.0 to 2.13.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/ec9f2d5744a09debf3a187a3f4f675c53b671911...f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-version: 2.13.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 (#5340) Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) from 3.9.2 to 3.10.0. - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/d58896d6a1865668819e1d91763c7751a165e159...d7543c93d881b35a8faa02e8e3605f69b7a1ce62) --- updated-dependencies: - dependency-name: sigstore/cosign-installer dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 (#5341) Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action) from 0.20.5 to 0.20.6. - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/da167eac915b4e86f08b264dbdbc867b61be6f0c...f8bdd1d8ac5e901a77a92f111440fdb1b593736b) --- updated-dependencies: - dependency-name: anchore/sbom-action dependency-version: 0.20.6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs (#5346) Bumps [regex](https://github.com/mrabarnett/mrab-regex) from 2025.9.1 to 2025.9.18. - [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt) - [Commits](https://github.com/mrabarnett/mrab-regex/compare/2025.9.1...2025.9.18) --- updated-dependencies: - dependency-name: regex dependency-version: 2025.9.18 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 (#5342) Bumps [apache/skywalking-eyes](https://github.com/apache/skywalking-eyes) from 0.6.0 to 0.7.0. - [Release notes](https://github.com/apache/skywalking-eyes/releases) - [Changelog](https://github.com/apache/skywalking-eyes/blob/main/CHANGES.md) - [Commits](https://github.com/apache/skywalking-eyes/compare/cd7b195c51fd3d6ad52afceb760719ddc6b3ee91...5c5b974209f0de5d905f37deb69369068ebfc15c) --- updated-dependencies: - dependency-name: apache/skywalking-eyes dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Gergely Brautigam * fix(typo) goolge->google (#5348) It bothers me a bit. Signed-off-by: Jean-Philippe Evrard * chore: update helm charts v0.20.1 (#5352) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam * chore(docs): update stability and support table for 0.20.x (#5354) Signed-off-by: Jakob Möller * update dependencies (#5349) Signed-off-by: External Secrets Operator Co-authored-by: External Secrets Operator Co-authored-by: Gergely Brautigam * chore(docs): update the release flow (#5358) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> On-behalf-of: Gergely Brautigam * feat: add support for decryption scheme from properties in senhasegura Devops Secrets Management (DSM) provider (#3895) * Initial Commit Signed-off-by: Felipe Oliveira dos Santos * Building an RSA-Based Sensitive Data Decryption Feature with Advanced Templating v2 Signed-off-by: Felipe Oliveira dos Santos * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * reviewable: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * docs: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * chore(license): building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * test: building an rsa-based sensitive data decryption feature with advanced templating v2 Signed-off-by: Felipe Oliveira dos Santos * test: remove bin data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos * test: add encrypted data test on building an rsa-based sensitive data decryption feature Signed-off-by: Felipe Oliveira dos Santos --------- Signed-off-by: Felipe Oliveira dos Santos * feat(ci): use separate github app for lgtm workflow. (#5365) Signed-off-by: Erik Westra * fix: listing required roles should NOT mention/tag the roles, just list the title. (#5363) Signed-off-by: Erik Westra * fix(ci): run lgtm label remover in pull_request_target context instead (#5366) Signed-off-by: Erik Westra Co-authored-by: Gergely Brautigam * chore: update codeql action to also run for actions (#5360) Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * Oracle provider maintained status (#5367) Signed-off-by: Anders Swanson Co-authored-by: Gergely Brautigam * fix: liveness probe would include invalid value `enable` (#5369) * feat: introduce priorityPolicy in merge rewrite (#5329) * introduce priorityPolicy in merge rewrite Signed-off-by: Riccardo M. Cefala * make reviewable Signed-off-by: Riccardo M. Cefala * update documentation for priorityPolicy Signed-off-by: Riccardo M. Cefala * add some missing kubebuilder Enum validation …

Uh oh!

suggestion: disable discussions #5283

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions