feat: Add lgtm review automation step to ci workflows. by webstradev · Pull Request #5251 · external-secrets/external-secrets

webstradev · 2025-09-03T17:50:18Z

Remaining Questions for maintainers:

Shall we give reviewer roles the triage permission, meaning we can further harden this new workflow or shall i leave it at none (see line 43 in lgtm.yaml for more details).
When removing the label do we also need the comment?

Problem Statement

With the new contributor ladder, there needs to be some functionality to allow reviewers of specific specialties to review PR's and signal to maintainers that they are "approved" / "lgtm"'ed

Related Issue

Fixes #5219

Proposed Changes

I've tried to replicate the current ci workflows as much as possible so as to remain consistent. This does however mean that we have quite a bit of logic (in js) in one step. Open to changing this for the sake of readability, however you might lose some symmetry with other files.

I decided to add a little bit of complexity to this workflow, where it parses the codeowners.MD file so as to determine which teams are allowed to approve a PR. This is mainly to not have to duplicate roles and paths in the workflow itself.

The workflow boils down to this

parse codeowners to get a mapping from filePattern to role
check if commenter is one of the maintainer roles and if yes lgtm immediately

- for each file, use the codeowners mappings to see all the codeowners/required roles for this PR - get all the roles that the commentor (only the ones that apply to this MR) - check if the user has any of above - Add lgtm label and post confirmation message (tagging all maintainer roles) - If not all roles were covered it will warn the maintainer with a list of required roles and a list of covered roles.

NOTE: I've tried to replicate the ESO organisation as much as possible in my own org for testing purposes, using the same set up for codeowners, create-github-token for token generation etc. etc. However I can only test so much in my own org. You won't be able to test it untll you merge it to master.

Results in my org looked something like this (note ultra-developers is my maintainer role):

Commenter doesn’t have any of the required roles.
All Areas Covered

Not all areas covered

label automatically removed after a PR update:

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

Skarlso · 2025-09-06T19:00:06Z

As an inspiration maybe take a look at what prow's approver plugin is doing? That's the lgtm command that everyone in the Kubernetes ecosystem is using anyways.

Skarlso · 2025-09-06T19:03:33Z

Otherwise this is shaping up nicely I think. Since we do have granular owners there is no way around it.

It's interesting though that what if there are changes in multiple locations? We need some a kind of precedence tracking where if there are a changes to files the person has is not in the group for then they can't approve the whole pr even if they can approve changes to certain sections of the pr.

For example the pr is editing the vault plugin. Vault members might approve the pr. But lo and behold there are changes in the controller as well. Now the vault members should not be able to approve the pr. Right?

webstradev · 2025-09-07T13:25:24Z

Otherwise this is shaping up nicely I think. Since we do have granular owners there is no way around it.

It's interesting though that what if there are changes in multiple locations? We need some a kind of precedence tracking where if there are a changes to files the person has is not in the group for then they can't approve the whole pr even if they can approve changes to certain sections of the pr.

For example the pr is editing the vault plugin. Vault members might approve the pr. But lo and behold there are changes in the controller as well. Now the vault members should not be able to approve the pr. Right?

So I started with this originally because it made sense to me as well. I ran into some complexities and asked this question on the issue originally (whether someone needs all roles for all files changed, or if you want to make separate LGTM labels (which gets quite messy).

The answer at the time was #5219 (comment)
That it would still be caught by codeowners (actual maintainers) if there are more things needing to be reviewed.

Main disadvantage of approving on parts of the PR is that it gets very messy if you take into account all the reviewer roles for each provider. I had started thinking there was only 4 or 5 but then i saw there is a reviewer group for each provider which means you would need to make lgtm labels for each provider.

because you would need to make labels for each provider

webstradev · 2025-09-07T13:25:34Z

As an inspiration maybe take a look at what prow's approver plugin is doing? That's the lgtm command that everyone in the Kubernetes ecosystem is using anyways.

I'll have a look

webstradev · 2025-09-07T13:34:53Z

As an inspiration maybe take a look at what prow's approver plugin is doing? That's the lgtm command that everyone in the Kubernetes ecosystem is using anyways.

So a few more important things we should probably add unless you disagree:

ability to cancel/remove label, this seems sensible but the downside is if two people have lgtm'ed (because 2 different areas) you would remove the single label.
Automatically remove lgtm label when PR is updated, might be a little strict, especially because it will still be looked at by a maintainer
[] how to deal with multiple changes to different areas.

Skarlso · 2025-09-07T13:40:49Z

I don't care about removing the label honestly. Also, updates remove the label sounds like a default behaviour anyways. Like, right now, on an update, approve also have to be re-applied. So making this work the same makes sense.

And yes, the third one is the more difficult one I guess.

webstradev · 2025-09-14T08:14:07Z

@Skarlso just to put out the options I see for solving the third point:

Option A: Go with the current system, meaning anyone with any of the needed roles can lgtm a PR. Downside is it puts a little bit more burden on the maintainers because they might be pinged to early if not all areas have been reviewed yet, plus the reviewers need to ensure all areas were reviewed.

Option B: Make it so someone running /lgtm requires all of the required groups (would be a simple solution but imo defeats the purpose of this command and having separate groups to begin with, because realistically who willl have that besides maintainers)

Option C: Add labels for each provider and all the areas and a generic lgtm label, only apply the last one if all areas are covered and only tag maintainers when all are covere, doable but just increases the code complexity signifcantly. Maybe with the foresight of providers moving out of tree this isn't so bad as it can eventually be dropped.

Skarlso · 2025-09-14T08:43:36Z

Hm, I lean towards an easier solution. One that is less complex to maintain. I guess the reviewer would have to keep in mind that if there is code that has been touched outside their area of expertise can still say lgtm but would essentially say: please review THAT area since I have no idea about it.

Also, on that note, I guess the pull request creator could keep in mind to compartmentalize properly all edits to a single location. Of course with overarching changes that's not always possible, but it should be something that people should at least try to do. :)

So, let's keep it simple I think. And ignore cross-cutting changes for now. WDYT?

webstradev · 2025-09-14T09:01:14Z

Hm, I lean towards an easier solution. One that is less complex to maintain. I guess the reviewer would have to keep in mind that if there is code that has been touched outside their area of expertise can still say lgtm but would essentially say: please review THAT area since I have no idea about it.

Also, on that note, I guess the pull request creator could keep in mind to compartmentalize properly all edits to a single location. Of course with overarching changes that's not always possible, but it should be something that people should at least try to do. :)

So, let's keep it simple I think. And ignore cross-cutting changes for now. WDYT?

Yeah I think simplicity is the way to go here, because the code isn't easy to maintain by nature because its inline in a CI step, so no linting formatting typesafety etc.
If it cross-area PRs become too much of a problem we can always reevaluate it then.

As a minor (and easy to maintain) improvemnt :

We could add a label if something touches multiple areas (maybe kind of pointless because there is already a label per area.
Adjust the message that pings maintainers to warn incases that a PR touches multiple areas, somehting along the lines of "This pull request affect multiple code areas, please ensure all areas have been lgtm'ed looked at"

Skarlso · 2025-09-14T09:10:11Z

Sounds good!

webstradev · 2025-09-14T10:50:39Z

Sounds good!

okay so just to confirm I'll add the following changes.

Remove lgtm label if PR is updated
Warn maintainers (in the lgtm message) if a PR touches multiple areas

and not the ability to remove the lgtm label with something like lgtm cancel because that is not needed?

Skarlso · 2025-09-14T11:05:16Z

Yep! 👍

webstradev · 2025-09-15T21:49:52Z

@Skarlso I've implemented the remainder of the changes and cleaned up the code a bit.
The description is now up to date, two outstanding questions for reviewers however maybe they are best answered once the code is reviewed.

To cover the final point we discussed (warning maintainers that not all areas have been reviewed I essentially do a quick coverage analysis and report the missing roles. see the updated description for what that looks like.

Anything else you'd like me to add?

Skarlso · 2025-09-16T04:58:01Z

That sounds lovely man! Nothing to add, I'll review the code. :)

webstradev · 2025-09-16T07:22:36Z

I removed the token generation from the lgtm removal step as it doesn't need it for simple label checking and deleting steps. That should make the CI pass now.

Skarlso

Generally looks okay. I'm a bit concerned about maintainability at this point. Honestly I think it would be better to write our own act8n in go and use GitHub's graphql with it and publish it. What do you think @webstradev ? I have experience using graphql with go. I even have project that you could steal for this. Would give us greater control over all the things we could do. And it could be versioned. I know it's a huge pivot.

.github/workflows/lgtm.yml

webstradev · 2025-09-16T21:49:23Z

Generally looks okay. I'm a bit concerned about maintainability at this point. Honestly I think it would be better to write our own act8n in go and use GitHub's graphql with it and publish it. What do you think @webstradev ? I have experience using graphql with go. I even have project that you could steal for this. Would give us greater control over all the things we could do. And it could be versioned. I know it's a huge pivot.

Hmm, at that point is it not less effort to have a small cluster somewhere and just deploy prow?

Not written an action in go before but happy to give it a crack (especially if you have some boilerplate) but I wonder prow would be less effort. I dunno if there is already a cluster or some sort of infra that can be used to host it, thatt would likely be the decider.

Skarlso · 2025-09-17T04:54:12Z

Nah, you're right. It's fine. We can't host prow we don't really have the environment. Not like we couldn't run it in AWS or something. It's just not something I would like to maintain either.

Let's do this. :)

Skarlso · 2025-09-17T04:56:24Z

@webstradev this is the thing I wrote that can be run on a trigger: https://github.com/Skarlso/caretaker

webstradev · 2025-09-17T07:20:46Z

@webstradev this is the thing I wrote that can be run on a trigger: https://github.com/Skarlso/caretaker

Looks nice! I think it's definetly still worth considering implementing our own action as a replacement of this worklfow.
It's even a good first issue with a bit of size/scope for someone willing to contribute to ESO, even if they know nothing about ESO.

Skarlso · 2025-09-17T07:22:18Z

Agreed. I'll create a follow-up. For now, this should be enough.

Signed-off-by: Erik Westra <e.s.westra.95@gmail.com>

webstradev · 2025-09-17T07:27:32Z

just a reminder, when this is merged, the actual label still needs to be created if you want to name it anything else than lgtm, then you can change the labelName in the workflow

Skarlso · 2025-09-17T07:28:15Z

.github/workflows/lgtm-remove-on-update.yml

+          // Add comment to notify about removal
+          await github.rest.issues.createComment({
+            owner, repo, issue_number: prNumber,
+            body: '🔄 LGTM label removed due to PR update. Re-approval required.'
+          });


This is actually needlessly spammy. It will comment every time it removes the label which might be annoying. We'll have the pr history anyways to track label removal.

This is actually needlessly spammy. It will comment every time it removes the label which might be annoying. We'll have the pr history anyways to track label removal.

yeah i agree, left it there as the second question whether or not that was necessary Ill remove the commenting step for this.

Signed-off-by: Erik Westra <e.s.westra.95@gmail.com>

sonarqubecloud · 2025-09-17T07:35:02Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Skarlso · 2025-09-17T08:11:42Z

@webstradev Alright, time for testing this thing. :D

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [external-secrets](https://github.com/external-secrets/external-secrets) | minor | `0.19.2` -> `0.20.1` | --- ### Release Notes <details> <summary>external-secrets/external-secrets (external-secrets)</summary> ### [`v0.20.1`](https://github.com/external-secrets/external-secrets/releases/tag/v0.20.1) [Compare Source](external-secrets/external-secrets@v0.19.2...v0.20.1) Image: `ghcr.io/external-secrets/external-secrets:v0.20.1` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi` Image: `ghcr.io/external-secrets/external-secrets:v0.20.1-ubi-boringssl`  #### What's Changed ##### General - chore: release 0.19.2 by [@moolen](https://github.com/moolen) in [#5136](external-secrets/external-secrets#5136) - chore: update readme by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5137](external-secrets/external-secrets#5137) - fix(kubernetes): make auth field optional by [@mhrabovcin](https://github.com/mhrabovcin) in [#5064](external-secrets/external-secrets#5064) - chore: Fix Markdown spelling issues found by codespell by [@mjtrangoni](https://github.com/mjtrangoni) in [#5139](external-secrets/external-secrets#5139) - Fix yaml codeblock for oracle-vault provider docs by [@muckelba](https://github.com/muckelba) in [#5146](external-secrets/external-secrets#5146) - feat: add liveness probe to eso controller by [@Skarlso](https://github.com/Skarlso) in [#4930](external-secrets/external-secrets#4930) - fix(helm): add boolean for processClusterGenerator by [@DrummyFloyd](https://github.com/DrummyFloyd) in [#5144](external-secrets/external-secrets#5144) - chore: add Cisco to ADOPTERS.md by [@sriaradhyula](https://github.com/sriaradhyula) in [#5159](external-secrets/external-secrets#5159) - docs: Fix provider stability and support table by [@jonstacks](https://github.com/jonstacks) in [#5161](external-secrets/external-secrets#5161) - feat(helm): Add control of response to missing prometheus CRDs by [@jcpunk](https://github.com/jcpunk) in [#5087](external-secrets/external-secrets#5087) - chore: Added release notes configuration by [@bonddim](https://github.com/bonddim) in [#5148](external-secrets/external-secrets#5148) - chore: bump bitwarden helm chart version by [@Skarlso](https://github.com/Skarlso) in [#5044](external-secrets/external-secrets#5044) - chore(docs): update `ADOPTERS.md` to include SAP by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5165](external-secrets/external-secrets#5165) - feat: add externalsecret namespace for webhook provider by [@matheusmazzoni](https://github.com/matheusmazzoni) in [#5155](external-secrets/external-secrets#5155) - fix: add unknown status for secret store by [@alvin-rw](https://github.com/alvin-rw) in [#5070](external-secrets/external-secrets#5070) - Fix pushing to an AWS Secrets Manager Secret when there are no secret values by [@nirajsapkota](https://github.com/nirajsapkota) in [#4878](external-secrets/external-secrets#4878) - add extralabels for dashboard to be scraped by multiple grafana instances by [@L1ghtman2k](https://github.com/L1ghtman2k) in [#5138](external-secrets/external-secrets#5138) - fix: the api docs are not referencing sshkey generator by [@Skarlso](https://github.com/Skarlso) in [#5170](external-secrets/external-secrets#5170) - Update github.md by [@gecube](https://github.com/gecube) in [#5171](external-secrets/external-secrets#5171) - Update anchore-engine-credentials.md by [@gecube](https://github.com/gecube) in [#5172](external-secrets/external-secrets#5172) - docs: update infisical docs to clarify missing system:auth-delegator need by [@Skarlso](https://github.com/Skarlso) in [#5174](external-secrets/external-secrets#5174) - Adding support different type auth sources by [@preved911](https://github.com/preved911) in [#4877](external-secrets/external-secrets#4877) - fix: stability update document did not update the stability table correctly by [@Skarlso](https://github.com/Skarlso) in [#5176](external-secrets/external-secrets#5176) - Add esv1.AnnotationForceSync for CES and ES by [@ntnn](https://github.com/ntnn) in [#5156](external-secrets/external-secrets#5156) - fix: helm build failing by [@Skarlso](https://github.com/Skarlso) in [#5178](external-secrets/external-secrets#5178) - fix: remove release- branch automation by [@moolen](https://github.com/moolen) in [#5182](external-secrets/external-secrets#5182) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5181](external-secrets/external-secrets#5181) - docs: update bitwarden documentation for dataFrom field usage by [@Skarlso](https://github.com/Skarlso) in [#5196](external-secrets/external-secrets#5196) - feat: add contributor ladder by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5150](external-secrets/external-secrets#5150) - feat: support vault provider check and set for push secrets by [@webstradev](https://github.com/webstradev) in [#5197](external-secrets/external-secrets#5197) - chore(docs): update helm charts by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5203](external-secrets/external-secrets#5203) - chore(ci): fix sonarqube security warnings in helm.yml by [@webstradev](https://github.com/webstradev) in [#5202](external-secrets/external-secrets#5202) - chore: add pull request maintenance auto labelling and sizes by [@Skarlso](https://github.com/Skarlso) in [#5200](external-secrets/external-secrets#5200) - fix: update the label verification step by [@Skarlso](https://github.com/Skarlso) in [#5209](external-secrets/external-secrets#5209) - feat: add infisical k8s auth with Client JWT as Reviewer JWT Token support by [@tuxtof](https://github.com/tuxtof) in [#5168](external-secrets/external-secrets#5168) - feat: improve error message for json marshalling/unmarshalling by [@webstradev](https://github.com/webstradev) in [#5211](external-secrets/external-secrets#5211) - chore: enhance `helm-values-schema-json` schema plugin management logic by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5212](external-secrets/external-secrets#5212) - fix(aws): stop incrementing the UUID for versions by [@Skarlso](https://github.com/Skarlso) in [#5175](external-secrets/external-secrets#5175) - feat: enable secure serving for metrics \[issue 4614] by [@rkferreira](https://github.com/rkferreira) in [#5169](external-secrets/external-secrets#5169) - fix(infisical): fix TokenAuth auth method by escaping the token revocation by [@arthlr](https://github.com/arthlr) in [#5217](external-secrets/external-secrets#5217) - fix: tilt build was failing to rebuild by [@Skarlso](https://github.com/Skarlso) in [#5225](external-secrets/external-secrets#5225) - feat: add selectable fields to the CRDs by [@Skarlso](https://github.com/Skarlso) in [#5226](external-secrets/external-secrets#5226) - ref: removing Yandex Cloud specific common types declaration duplication by [@preved911](https://github.com/preved911) in [#4905](external-secrets/external-secrets#4905) - fix: missing codeowners file from .github folder by [@Skarlso](https://github.com/Skarlso) in [#5228](external-secrets/external-secrets#5228) - feat: add setting remote namespace to metadata for kubernetes provider by [@Skarlso](https://github.com/Skarlso) in [#5224](external-secrets/external-secrets#5224) - feat: add support for certs only in pkcs12 by [@devnopt](https://github.com/devnopt) in [#4875](external-secrets/external-secrets#4875) - docs: document redundant clusterName/clusterLocation parameters in GCP Secret Manager docs by [@ionicsolutions](https://github.com/ionicsolutions) in [#5208](external-secrets/external-secrets#5208) - feat: Allow adding finalizers from template by [@malovme](https://github.com/malovme) in [#5140](external-secrets/external-secrets#5140) - fix: controller-runtime update by [@gusfcarvalho](https://github.com/gusfcarvalho) in [#5239](external-secrets/external-secrets#5239) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5229](external-secrets/external-secrets#5229) - fix: Prevent secretstore reconcile loop when provider error response is dynamic by [@dakotaharden](https://github.com/dakotaharden) in [#5247](external-secrets/external-secrets#5247) - feat: add finalizers to SecretStores when referenced by PushSecrets with DeletionPolicy=Delete by [@matheusmazzoni](https://github.com/matheusmazzoni) in [#5163](external-secrets/external-secrets#5163) - fix: keepersecurity support for shortcuts by [@pepordev](https://github.com/pepordev) in [#5245](external-secrets/external-secrets#5245) - feat: add support for GCP Workload Identity Federation by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#4654](external-secrets/external-secrets#4654) - feat: support fetching secrets and certificates by name in Yandex Lockbox & Certificate Manager by [@alliseeisgold](https://github.com/alliseeisgold) in [#5022](external-secrets/external-secrets#5022) - chore(charts): Adds new make target for installing unittest plugin by [@bharath-b-rh](https://github.com/bharath-b-rh) in [#5250](external-secrets/external-secrets#5250) - docs(templating): added clarifying comments to Github generator example by [@nielstenboom](https://github.com/nielstenboom) in [#5248](external-secrets/external-secrets#5248) - feat(release): add new workflow to label first time contributor issues by [@mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#5243](external-secrets/external-secrets#5243) - feat(security): Adds an option to make HTTP2 configurable by [@siddhibhor-56](https://github.com/siddhibhor-56) in [#5231](external-secrets/external-secrets#5231) - feat: add retry for onepassword on authorization error by [@Skarlso](https://github.com/Skarlso) in [#5253](external-secrets/external-secrets#5253) - fix: handle namespace deletion race conditions with finalizers by [@framsouza](https://github.com/framsouza) in [#5154](external-secrets/external-secrets#5154) - docs: update stability and support by [@anders-swanson](https://github.com/anders-swanson) in [#5257](external-secrets/external-secrets#5257) - fix(akeyless): Upgrade Akeyless Provider Go SDK to v4 by [@kgal-akl](https://github.com/kgal-akl) in [#5263](external-secrets/external-secrets#5263) - feat: support Pod Identity authentication for Vault Provider by [@webstradev](https://github.com/webstradev) in [#5201](external-secrets/external-secrets#5201) - feat: add domain field to secretserver provider by [@rkferreira](https://github.com/rkferreira) in [#5258](external-secrets/external-secrets#5258) - chore(release): Migrate to actions/create-github-app-token action by [@mouhsen-ibrahim](https://github.com/mouhsen-ibrahim) in [#5264](external-secrets/external-secrets#5264) - chore: just updating the crd conformance tests by [@Skarlso](https://github.com/Skarlso) in [#5265](external-secrets/external-secrets#5265) - chore(revert): "chore(release): Migrate to actions/create-github-app-token action" by [@Skarlso](https://github.com/Skarlso) in [#5269](external-secrets/external-secrets#5269) - chore: azure sdk update by [@hauswio](https://github.com/hauswio) in [#5162](external-secrets/external-secrets#5162) - feat: add support for fetching Secret by Path on Delinea Secret Server provider by [@DelineaSahilWankhede](https://github.com/DelineaSahilWankhede) in [#5270](external-secrets/external-secrets#5270) - feat: migrate from tibdex to actions/create-github-app-token by [@rkferreira](https://github.com/rkferreira) in [#5286](external-secrets/external-secrets#5286) - fix: license headers across all Go files - standardize format, add missing copyright, fix typos by [@Copilot](https://github.com/Copilot) in [#5288](external-secrets/external-secrets#5288) - fix: the boilerplate was missing the right license format by [@Skarlso](https://github.com/Skarlso) in [#5289](external-secrets/external-secrets#5289) - chore(license): add automated license header checking using Apache SkyWalking Eyes GitHub Action by [@Copilot](https://github.com/Copilot) in [#5290](external-secrets/external-secrets#5290) - chore(docs): remove GitHub Discussions references and update support channels by [@jakobmoellerdev](https://github.com/jakobmoellerdev) in [#5292](external-secrets/external-secrets#5292) - docs: updated the ladder with two new tracks: documentation and community by [@Skarlso](https://github.com/Skarlso) in [#5298](external-secrets/external-secrets#5298) - docs(release): create upgrading section by [@rkferreira](https://github.com/rkferreira) in [#5310](external-secrets/external-secrets#5310) - docs: readme update for health of the project by [@Skarlso](https://github.com/Skarlso) in [#5309](external-secrets/external-secrets#5309) - fix: validate namespace in secretRef by [@moolen](https://github.com/moolen) in [#5311](external-secrets/external-secrets#5311) - docs: add burnout prevention strategies and mitigation policy document by [@Skarlso](https://github.com/Skarlso) in [#5307](external-secrets/external-secrets#5307) - feat: add missing go sbom by [@moolen](https://github.com/moolen) in [#5313](external-secrets/external-secrets#5313) - feat: make vault e2e tests run locally by [@moolen](https://github.com/moolen) in [#5246](external-secrets/external-secrets#5246) - chore: update dependencies by [@eso-service-account-app](https://github.com/eso-service-account-app)\[bot] in [#5324](external-secrets/external-secrets#5324) - feat: add Cloudsmith generator for container registry authentication by [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) in [#5267](external-secrets/external-secrets#5267) - feat: Add lgtm review automation step to ci workflows. by [@webstradev](https://github.com/webstradev) in [#5251](external-secrets/external-secrets#5251) - feat(provider): add Volcengine provider support by [@kevinyancn](https://github.com/kevinyancn) in [#5306](external-secrets/external-secrets#5306) - test: add more information to potentially flaky test by [@Skarlso](https://github.com/Skarlso) in [#5330](external-secrets/external-secrets#5330) - fix(docs): Fix typo in controller options doc by [@tspearconquest](https://github.com/tspearconquest) in [#5299](external-secrets/external-secrets#5299) - chore(testing): Add licence.check make target by [@jonstacks](https://github.com/jonstacks) in [#5335](external-secrets/external-secrets#5335) - docs(gitlab-variables): document environment scope fallback by [@s1nyx](https://github.com/s1nyx) in [#5300](external-secrets/external-secrets#5300) ##### Dependencies - chore(deps): bump mkdocs-macros-plugin from 1.3.7 to 1.3.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5190](external-secrets/external-secrets#5190) - chore(deps): bump requests from 2.32.4 to 2.32.5 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5191](external-secrets/external-secrets#5191) - chore(deps): bump golang from 1.24.6-bookworm to 1.25.0-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5189](external-secrets/external-secrets#5189) - chore(deps): bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5188](external-secrets/external-secrets#5188) - chore(deps): bump actions/create-github-app-token from 2.1.0 to 2.1.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5187](external-secrets/external-secrets#5187) - chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#5186](external-secrets/external-secrets#5186) - chore(deps): bump codecov/codecov-action from 5.4.3 to 5.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5184](external-secrets/external-secrets#5184) - chore(deps): bump golang from 1.24.6 to 1.25.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5194](external-secrets/external-secrets#5194) - chore(deps): bump github/codeql-action from 3.29.8 to 3.29.11 by [@dependabot](https://github.com/dependabot)\[bot] in [#5195](external-secrets/external-secrets#5195) - chore(deps): bump ubi8/ubi from `4f0a4e4` to `7010e70` by [@dependabot](https://github.com/dependabot)\[bot] in [#5193](external-secrets/external-secrets#5193) - chore(deps): bump mkdocs-material from 9.6.16 to 9.6.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5192](external-secrets/external-secrets#5192) - chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5198](external-secrets/external-secrets#5198) - chore(deps): bump actions/dependency-review-action from 4.7.1 to 4.7.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#5199](external-secrets/external-secrets#5199) - chore(deps): bump aquasecurity/trivy-action from 0.32.0 to 0.33.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5234](external-secrets/external-secrets#5234) - chore(deps): bump actions/dependency-review-action from 4.7.2 to 4.7.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5236](external-secrets/external-secrets#5236) - chore(deps): bump ubi8/ubi from `7010e70` to `534c2c0` by [@dependabot](https://github.com/dependabot)\[bot] in [#5237](external-secrets/external-secrets#5237) - chore(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5238](external-secrets/external-secrets#5238) - chore(deps): bump regex from 2025.7.34 to 2025.8.29 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5242](external-secrets/external-secrets#5242) - chore(deps): bump platformdirs from 4.3.8 to 4.4.0 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5241](external-secrets/external-secrets#5241) - chore(deps): bump distroless/static from `2e114d2` to `f2ff10a` by [@dependabot](https://github.com/dependabot)\[bot] in [#5240](external-secrets/external-secrets#5240) - chore(deps): bump golang from 1.25.0 to 1.25.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5275](external-secrets/external-secrets#5275) - chore(deps): bump actions/github-script from 7.0.1 to 8.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5274](external-secrets/external-secrets#5274) - chore(deps): bump actions/stale from 9.1.0 to 10.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5273](external-secrets/external-secrets#5273) - chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5276](external-secrets/external-secrets#5276) - chore(deps): bump mkdocs-material from 9.6.18 to 9.6.19 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5279](external-secrets/external-secrets#5279) - chore(deps): bump codecov/codecov-action from 5.5.0 to 5.5.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5278](external-secrets/external-secrets#5278) - chore(deps): bump github/codeql-action from 3.29.11 to 3.30.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5277](external-secrets/external-secrets#5277) - chore(deps): bump markdown from 3.8.2 to 3.9 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5281](external-secrets/external-secrets#5281) - chore(deps): bump golang from 1.25.0-bookworm to 1.25.1-bookworm in /e2e by [@dependabot](https://github.com/dependabot)\[bot] in [#5280](external-secrets/external-secrets#5280) - chore(deps): bump regex from 2025.8.29 to 2025.9.1 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5282](external-secrets/external-secrets#5282) - chore(deps): bump golang from `b6ed3fd` to `b6ed3fd` by [@dependabot](https://github.com/dependabot)\[bot] in [#5318](external-secrets/external-secrets#5318) - chore(deps): bump actions/setup-python from 5.6.0 to 6.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5317](external-secrets/external-secrets#5317) - chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5319](external-secrets/external-secrets#5319) - chore(deps): bump distroless/static from `f2ff10a` to `87bce11` by [@dependabot](https://github.com/dependabot)\[bot] in [#5320](external-secrets/external-secrets#5320) - chore(deps): bump actions/labeler from 5.0.0 to 6.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5323](external-secrets/external-secrets#5323) - chore(deps): bump softprops/action-gh-release from 2.3.2 to 2.3.3 by [@dependabot](https://github.com/dependabot)\[bot] in [#5321](external-secrets/external-secrets#5321) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5322](external-secrets/external-secrets#5322) - chore(deps): bump actions/create-github-app-token from 2.1.1 to 2.1.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#5339](external-secrets/external-secrets#5339) - chore(deps): bump aquasecurity/trivy-action from 0.33.0 to 0.33.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5344](external-secrets/external-secrets#5344) - chore(deps): bump mkdocs-material from 9.6.19 to 9.6.20 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5345](external-secrets/external-secrets#5345) - chore(deps): bump step-security/harden-runner from 2.13.0 to 2.13.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#5343](external-secrets/external-secrets#5343) - chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5340](external-secrets/external-secrets#5340) - chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#5341](external-secrets/external-secrets#5341) - chore(deps): bump regex from 2025.9.1 to 2025.9.18 in /hack/api-docs by [@dependabot](https://github.com/dependabot)\[bot] in [#5346](external-secrets/external-secrets#5346) - chore(deps): bump apache/skywalking-eyes from 0.6.0 to 0.7.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#5342](external-secrets/external-secrets#5342) #### New Contributors - [@mjtrangoni](https://github.com/mjtrangoni) made their first contribution in [#5139](external-secrets/external-secrets#5139) - [@muckelba](https://github.com/muckelba) made their first contribution in [#5146](external-secrets/external-secrets#5146) - [@DrummyFloyd](https://github.com/DrummyFloyd) made their first contribution in [#5144](external-secrets/external-secrets#5144) - [@sriaradhyula](https://github.com/sriaradhyula) made their first contribution in [#5159](external-secrets/external-secrets#5159) - [@jonstacks](https://github.com/jonstacks) made their first contribution in [#5161](external-secrets/external-secrets#5161) - [@matheusmazzoni](https://github.com/matheusmazzoni) made their first contribution in [#5155](external-secrets/external-secrets#5155) - [@nirajsapkota](https://github.com/nirajsapkota) made their first contribution in [#4878](external-secrets/external-secrets#4878) - [@L1ghtman2k](https://github.com/L1ghtman2k) made their first contribution in [#5138](external-secrets/external-secrets#5138) - [@gecube](https://github.com/gecube) made their first contribution in [#5171](external-secrets/external-secrets#5171) - [@preved911](https://github.com/preved911) made their first contribution in [#4877](external-secrets/external-secrets#4877) - [@ntnn](https://github.com/ntnn) made their first contribution in [#5156](external-secrets/external-secrets#5156) - [@webstradev](https://github.com/webstradev) made their first contribution in [#5197](external-secrets/external-secrets#5197) - [@rkferreira](https://github.com/rkferreira) made their first contribution in [#5169](external-secrets/external-secrets#5169) - [@arthlr](https://github.com/arthlr) made their first contribution in [#5217](external-secrets/external-secrets#5217) - [@devnopt](https://github.com/devnopt) made their first contribution in [#4875](external-secrets/external-secrets#4875) - [@dakotaharden](https://github.com/dakotaharden) made their first contribution in [#5247](external-secrets/external-secrets#5247) - [@bharath-b-rh](https://github.com/bharath-b-rh) made their first contribution in [#4654](external-secrets/external-secrets#4654) - [@alliseeisgold](https://github.com/alliseeisgold) made their first contribution in [#5022](external-secrets/external-secrets#5022) - [@nielstenboom](https://github.com/nielstenboom) made their first contribution in [#5248](external-secrets/external-secrets#5248) - [@siddhibhor-56](https://github.com/siddhibhor-56) made their first contribution in [#5231](external-secrets/external-secrets#5231) - [@framsouza](https://github.com/framsouza) made their first contribution in [#5154](external-secrets/external-secrets#5154) - [@kgal-akl](https://github.com/kgal-akl) made their first contribution in [#5263](external-secrets/external-secrets#5263) - [@hauswio](https://github.com/hauswio) made their first contribution in [#5162](external-secrets/external-secrets#5162) - [@Copilot](https://github.com/Copilot) made their first contribution in [#5288](external-secrets/external-secrets#5288) - [@cloudsmith-iduffy](https://github.com/cloudsmith-iduffy) made their first contribution in [#5267](external-secrets/external-secrets#5267) - [@kevinyancn](https://github.com/kevinyancn) made their first contribution in [#5306](external-secrets/external-secrets#5306) - [@s1nyx](https://github.com/s1nyx) made their first contribution in [#5300](external-secrets/external-secrets#5300) **Full Changelog**: <external-secrets/external-secrets@v0.19.2...v0.20.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1555 Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net> Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

github-project-automation bot added this to External Secrets Sep 3, 2025

github-actions bot added kind/feature Categorizes issue or PR as related to a new feature. component/github-actions size/m labels Sep 3, 2025

webstradev marked this pull request as draft September 3, 2025 17:51

Skarlso moved this to In Review in External Secrets Sep 3, 2025

Skarlso moved this from In Review to In Progress in External Secrets Sep 3, 2025

webstradev force-pushed the review-automation branch from 5c050e2 to 58a5eb2 Compare September 3, 2025 18:57

webstradev force-pushed the review-automation branch from e734008 to af0952c Compare September 15, 2025 21:34

webstradev force-pushed the review-automation branch from af0952c to 55d1a9a Compare September 15, 2025 21:52

webstradev marked this pull request as ready for review September 16, 2025 07:16

webstradev force-pushed the review-automation branch from 55d1a9a to 23e9335 Compare September 16, 2025 07:21

Skarlso reviewed Sep 16, 2025

View reviewed changes

.github/workflows/lgtm.yml Outdated Show resolved Hide resolved

.github/workflows/lgtm.yml Show resolved Hide resolved

.github/workflows/lgtm.yml Show resolved Hide resolved

webstradev added 2 commits September 17, 2025 09:26

feat(ci): Add lgtm approval workflows.

1956738

Signed-off-by: Erik Westra <e.s.westra.95@gmail.com>

standardise name (inline with other pull request maintenance workflows)

be19080

Signed-off-by: Erik Westra <e.s.westra.95@gmail.com>

webstradev force-pushed the review-automation branch from 2be5a2a to be19080 Compare September 17, 2025 07:26

Skarlso reviewed Sep 17, 2025

View reviewed changes

webstradev added 2 commits September 17, 2025 09:30

(peer-review) remove lgtm label and make label name a constant.

4179e99

Signed-off-by: Erik Westra <e.s.westra.95@gmail.com>

(peer-review) remove review question and clarify permission usage.

4f29042

Signed-off-by: Erik Westra <e.s.westra.95@gmail.com>

Skarlso approved these changes Sep 17, 2025

View reviewed changes

Skarlso merged commit 7b0d9f3 into external-secrets:main Sep 17, 2025
20 checks passed

github-project-automation bot moved this from In Progress to Done in External Secrets Sep 17, 2025

vshn-renovate mentioned this pull request Nov 15, 2025

Update Helm release external-secrets to v0.20.4 projectsyn/component-external-secrets-operator#4

Open

1 task

skwig mentioned this pull request Dec 19, 2025

chore(deps): update helm release external-secrets to v0.20.4 skwig/homelab#44

Open

1 task

Uh oh!

Conversation

webstradev commented Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement

Related Issue

Proposed Changes

Checklist

Uh oh!

Skarlso commented Sep 6, 2025

Uh oh!

Skarlso commented Sep 6, 2025

Uh oh!

webstradev commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webstradev commented Sep 7, 2025

Uh oh!

webstradev commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

webstradev commented Sep 14, 2025

Uh oh!

Skarlso commented Sep 14, 2025

Uh oh!

webstradev commented Sep 14, 2025

Uh oh!

Skarlso commented Sep 14, 2025

Uh oh!

webstradev commented Sep 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Sep 14, 2025

Uh oh!

webstradev commented Sep 15, 2025

Uh oh!

Skarlso commented Sep 16, 2025

Uh oh!

webstradev commented Sep 16, 2025

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

webstradev commented Sep 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Sep 17, 2025

Uh oh!

Skarlso commented Sep 17, 2025

Uh oh!

webstradev commented Sep 17, 2025

Uh oh!

Skarlso commented Sep 17, 2025

Uh oh!

webstradev commented Sep 17, 2025

Uh oh!

Skarlso Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

webstradev Sep 17, 2025

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Sep 17, 2025

Quality Gate passed

Uh oh!

Uh oh!

Skarlso commented Sep 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

webstradev commented Sep 3, 2025 •

edited

Loading

webstradev commented Sep 7, 2025 •

edited

Loading

webstradev commented Sep 7, 2025 •

edited

Loading

Skarlso commented Sep 7, 2025 •

edited

Loading

webstradev commented Sep 14, 2025 •

edited

Loading

webstradev commented Sep 16, 2025 •

edited

Loading