[CI] Merge self-upgrade-main into main

.github/workflows/govulncheck.yaml

@@ -28,7 +28,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

.github/workflows/make-self-upgrade.yaml

@@ -42,7 +42,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

klone.yaml

@@ -10,65 +10,65 @@ targets:
     - folder_name: boilerplate
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/boilerplate
     - folder_name: cert-manager
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/cert-manager
     - folder_name: controller-gen
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/controller-gen
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/generate-verify
     - folder_name: go
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/go
     - folder_name: helm
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/helm
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/help
     - folder_name: kind
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/kind
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/klone
     - folder_name: oci-build
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/oci-build
     - folder_name: oci-publish
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/oci-publish
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: fb47cf6181d34186cb7c7ddc083afc8516d44501
+      repo_hash: 4c928b49036b018acd01eabf3bdcd21be73201a5
       repo_path: modules/tools

make/_shared/go/base/.github/workflows/govulncheck.yaml

@@ -28,7 +28,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

make/_shared/helm/crds.mk

@@ -67,8 +67,8 @@ generate-crds: | $(NEEDS_CONTROLLER-GEN) $(NEEDS_YQ)
 	done
 
 	@if [ -n "$$(ls $(crds_gen_temp) 2>/dev/null)" ]; then \
-		cp -Tr $(crds_gen_temp) $(crds_dir); \
-		cp $(crds_dir_readme) $(crds_dir)/README.md; \
+		cp $(crds_gen_temp)/* $(crds_dir)/ ; \
+		cp $(crds_dir_readme) $(crds_dir)/README.md ; \
 	fi
 
 shared_generate_targets += generate-crds

make/_shared/oci-build/00_mod.mk

@@ -16,11 +16,11 @@ oci_platforms ?= linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
 
 # Use distroless as minimal base image to package the manager binary
 # To get latest SHA run "crane digest quay.io/jetstack/base-static:latest"
-base_image_static := quay.io/jetstack/base-static@sha256:feae5ef1171e639476e4134057228e0355837642993adfcb2b5c77fdc9c51d7d
+base_image_static := quay.io/jetstack/base-static@sha256:5cb085f952f80f3f065c7c8f6b9fcd754603c69a51c4c452a932f34a4fa83ee0
 
 # Use custom apko-built image as minimal base image to package the manager binary
 # To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest"
-base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:9e92ef3912568138f865b2268d3f13285736fb55856342cd32456ae2e284658b
+base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:c30595ad2eed4963dc28e5e0998720699f1ec41c4ff115bba86ecc873d12199f
 
 # Utility functions
 fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set))

make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml

@@ -42,7 +42,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
+      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

make/_shared/tools/00_mod.mk

@@ -161,7 +161,7 @@ ADDITIONAL_TOOLS ?=
 tools += $(ADDITIONAL_TOOLS)
 
 # https://go.dev/dl/
-VENDORED_GO_VERSION := 1.23.4
+VENDORED_GO_VERSION := 1.23.5
 
 # Print the go version which can be used in GH actions
 .PHONY: print-go-version
@@ -232,8 +232,6 @@ endef
 
 $(foreach tool,$(tools),$(eval $(call tool_defs,$(word 1,$(subst =, ,$(tool))),$(word 2,$(subst =, ,$(tool))))))
 
-tools_paths := $(tool_names:%=$(bin_dir)/tools/%)
-
 ######
 # Go #
 ######
@@ -365,7 +363,10 @@ $(call for_each_kv,go_tags_init,$(go_dependencies))
 go_tags_defs = go_tags_$1 += $2
 $(call for_each_kv,go_tags_defs,$(go_tags))
 
+go_tool_names :=
+
 define go_dependency
+go_tool_names += $1
 $$(DOWNLOAD_DIR)/tools/$1@$($(call uc,$1)_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $$(NEEDS_GO) $$(DOWNLOAD_DIR)/tools
 	@source $$(lock_script) $$@; \
 		mkdir -p $$(outfile).dir; \
@@ -379,10 +380,10 @@ $(call for_each_kv,go_dependency,$(go_dependencies))
 # File downloads #
 ##################
 
-go_linux_amd64_SHA256SUM=6924efde5de86fe277676e929dc9917d466efa02fb934197bc2eba35d5680971
-go_linux_arm64_SHA256SUM=16e5017863a7f6071363782b1b8042eb12c6ca4f4cd71528b2123f0a1275b13e
-go_darwin_amd64_SHA256SUM=6700067389a53a1607d30aa8d6e01d198230397029faa0b109e89bc871ab5a0e
-go_darwin_arm64_SHA256SUM=87d2bb0ad4fe24d2a0685a55df321e0efe4296419a9b3de03369dbe60b8acd3a
+go_linux_amd64_SHA256SUM=cbcad4a6482107c7c7926df1608106c189417163428200ce357695cc7e01d091
+go_linux_arm64_SHA256SUM=47c84d332123883653b70da2db7dd57d2a865921ba4724efcdf56b5da7021db0
+go_darwin_amd64_SHA256SUM=d8b310b0b6bd6a630307579165cfac8a37571483c7d6804a10dd73bbefb0827f
+go_darwin_arm64_SHA256SUM=047bfce4fbd0da6426bd30cd19716b35a466b1c15a45525ce65b9824acb33285
 
 .PRECIOUS: $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz
 $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz: | $(DOWNLOAD_DIR)/tools
@@ -642,7 +643,22 @@ ifneq ($(missing),)
 $(error Missing required tools: $(missing))
 endif
 
+non_go_tool_names := $(filter-out $(go_tool_names),$(tool_names))
+
+.PHONY: non-go-tools
+## Download and setup all Go tools
+## @category [shared] Tools
+non-go-tools: $(non_go_tool_names:%=$(bin_dir)/tools/%)
+
+.PHONY: go-tools
+## Download and setup all Non-Go tools
+## NOTE: this target is also used to learn the shas of
+## these tools (see scripts/learn_tools_shas.sh in the
+## Makefile modules repo)
+## @category [shared] Tools
+go-tools: $(go_tool_names:%=$(bin_dir)/tools/%)
+
 .PHONY: tools
 ## Download and setup all tools
 ## @category [shared] Tools
-tools: $(tools_paths)
+tools: non-go-tools go-tools