sync/upstream + upgrade/security (#18)

.copywrite.hcl

@@ -0,0 +1,14 @@
+project {
+  license = "BUSL-1.1"
+  copyright_year = 2024
+  header_ignore = [
+    "*.hcl2spec.go", # generated code specs, since they'll be wiped out until we support adding the headers at generation-time
+    "hcl2template/testdata/**",
+    "test/**",
+    "**/test-fixtures/**",
+    "examples/**",
+    "hcl2template/fixtures/**",
+    "command/plugin.go",
+    "website/**" # candidates for copyright are coming from external sources, so we should not handle those in Packer
+  ]
+}

.github/CONTRIBUTING.md

@@ -70,7 +70,7 @@ runtime in order to build packer.
 
 1. This project always releases from the latest version of golang.
 [Install go](https://golang.org/doc/install#install) To properly build from
-source, you need to have golang >= v1.18
+source, you need to have golang >= v1.20
 
 ## Setting up Packer for dev
 
@@ -274,7 +274,7 @@ does not attempt to track the latest version for each dependency.
 Packer relies on `go generate` to generate a [peg parser for boot
 commands](https://github.com/hashicorp/packer/blob/master/packer-plugin-sdk/bootcommand/boot_command.go),
 [docs](https://github.com/hashicorp/packer/blob/master/website/pages/partials/builder/amazon/chroot/_Config-not-required.mdx)
-and HCL2's bridging code. Packer's testing suite will run `make check-generate`
+and HCL2's bridging code. Packer's testing suite will run `make generate-check`
 to check that all the generated files Packer needs are what they should be.
 `make generate` re-generates all these file and can take a while depending on
 your machine's performances. To make it faster it is recommended to run

.github/ISSUE_TEMPLATE/config.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
 blank_issues_enabled: false
 contact_links:
   - name: Packer Community Support

.github/ISSUE_TEMPLATE/plugin_integration.md

@@ -0,0 +1,21 @@
+---
+name: Plugin Integration Request
+about: Open request to add your plugin as a Packer integration (https://developer.hashicorp.com/packer/integrations)
+labels: integration-request
+---
+
+#### Description
+
+A written description of your plugin along with a link to the plugin repository. 
+
+#### Integration Tier
+<!--- By default all integrations are registered as community integrations.
+HashiCorp Technology partners https://www.hashicorp.com/partners/find-a-partner will be registered as a partner once verified. --->
+
+#### Checklist
+- [ ] Has valid [`metadata.hcl`](https://github.com/hashicorp/integration-template) file in plugin repository.
+- [ ] Has added integration scripts [packer-plugin-scaffolding](https://github.com/hashicorp/packer-plugin-scoffolding) to plugin repository.
+- [ ] Has added top-level integration README.md file to plugin `docs` directory.
+- [ ] All plugins components have one README.md describing their usage.
+- [ ] Has a fully synced `.web-docs` directory ready for publishing to the integrations portal.
+

.github/dependabot.yml

@@ -6,10 +6,4 @@ updates:
     interval: daily
   allow:
     - dependency-name: "github.com/hashicorp/packer-plugin-sdk"
-    - dependency-name: "github.com/hashicorp/hcl/v2"
-    - dependency-name: "github.com/zclconf/go-cty"
     - dependency-name: "github.com/hashicorp/hcp-sdk-go"
-- package-ecosystem: github-actions
-  directory: /
-  schedule:
-    interval: daily

.github/labeler-issue-triage.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
 bug:
   - 'panic:'
 crash:

.github/workflows/acceptance-test.yml

@@ -19,14 +19,14 @@ jobs:
     outputs:
       go-version: ${{ steps.get-go-version.outputs.go-version }}
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: 'Determine Go version'
         id: get-go-version
         # We use .go-version as our source of truth for current Go
         # version, because "goenv" can react to it automatically.
         run: |
           echo "Building with Go $(cat .go-version)"
-          echo "::set-output name=go-version::$(cat .go-version)"
+          echo "go-version=$(cat .go-version)" >> $GITHUB_OUTPUT
   acceptance-test:
     runs-on: ubuntu-latest
     name: Acceptance Test
@@ -37,13 +37,15 @@ jobs:
       AWS_ACCESS_KEY_ID: ${{ secrets.TESTACC_AWS_ACCESS_KEY_ID }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.TESTACC_AWS_SECRET_ACCESS_KEY }}
       AWS_REGION: ${{ secrets.TESTACC_AWS_REGION }}
+      # Packer GH Token for API Rate Limiting
+      PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version: ${{ needs.get-go-version.outputs.go-version }}
       - name: IAM Assume Role
-        uses: aws-actions/configure-aws-credentials@v1
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
           role-to-assume: ${{ env.AWS_ROLE_ARN }}
           aws-region: ${{ env.AWS_REGION }}
@@ -68,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send slack notification on failure
-        uses: slackapi/slack-github-action@v1.23.0
+        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
         with:
           payload: |
             {
@@ -90,4 +92,4 @@ jobs:
             }
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/auto-close-stale-issues.yml

@@ -14,7 +14,7 @@ jobs:
       pull-requests: write  # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v5.2.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-issue-stale: 23

.github/workflows/backport.yml

@@ -16,7 +16,7 @@ jobs:
       contents: none
     if: github.event.pull_request.merged
     runs-on: ubuntu-latest
-    container: hashicorpdev/backport-assistant:0.2.3
+    container: hashicorpdev/backport-assistant:0.3.4
     steps:
       - name: Backport changes to stable-website
         run: |