[pull] master from GoogleCloudPlatform:master

.github/ISSUE_TEMPLATE/bug.yaml

@@ -0,0 +1,52 @@
+name: 'Bug report'
+description: 'File a bug report'
+labels: ['bug']
+body:
+- type: 'markdown'
+  attributes:
+    value: |-
+      Thank you for filing an bug. Please complete the form below so we can triage, reproduce, and fix your issue.
+
+- id: 'tldr'
+  type: 'textarea'
+  attributes:
+    label: 'TL;DR'
+    description: 'Describe the bug in 1-2 sentences.'
+  validations:
+    required: true
+
+- id: 'expected_behavior'
+  type: 'textarea'
+  attributes:
+    label: 'Expected behavior'
+    description: 'What did you expect to happen?'
+
+- id: 'observed_behavior'
+  type: 'textarea'
+  attributes:
+    label: 'Observed behavior'
+    description: 'What happened instead?'
+
+- id: 'tf_config'
+  type: 'textarea'
+  attributes:
+    label: 'Terraform Configuration'
+    description: 'Paste your reproducible Terraform configuration, removing any sensitive values.'
+    render: 'hcl'
+  validations:
+    required: true
+
+- id: 'tf_version'
+  type: 'textarea'
+  attributes:
+    label: 'Terraform Version'
+    description: 'Paste the output of `terraform version`, removing any sensitive values.'
+    render: 'sh'
+  validations:
+    required: true
+
+- id: 'additional'
+  type: 'textarea'
+  attributes:
+    label: 'Additional information'
+    description: 'Is there anything else you think we should know?'

.github/ISSUE_TEMPLATE/feature.yaml

@@ -0,0 +1,36 @@
+name: 'Feature request'
+description: 'File a feature request'
+labels: ['enhancement']
+body:
+- type: 'markdown'
+  attributes:
+    value: |-
+      Thank you for requesting a feature. Please complete the form below so we can triage and prioritize your feature.
+
+- id: 'component'
+  type: 'textarea'
+  attributes:
+    label: 'Component'
+    description: 'Which component is this FR for? Examples: CLI, Devtools, Linter, Test framework etc'
+    render: 'markdown'
+
+- id: 'tldr'
+  type: 'textarea'
+  attributes:
+    label: 'TL;DR'
+    description: 'Describe the feature in 1-2 sentences.'
+  validations:
+    required: true
+
+- id: 'detailed_design'
+  type: 'textarea'
+  attributes:
+    label: 'Detailed design'
+    description: 'Do you have more information about a detailed design? Are there specific considerations to take? Include sample configuration if possible.'
+    render: 'markdown'
+
+- id: 'additional'
+  type: 'textarea'
+  attributes:
+    label: 'Additional information'
+    description: 'Is there anything else you think we should know?'

.github/conventional-commit-lint.yaml

@@ -0,0 +1,2 @@
+enabled: true
+always_check_pr_title: true

.github/release-please.yml

@@ -0,0 +1,16 @@
+# Copyright 2022 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+handleGHRelease: true
+manifest: true

.github/renovate.json

@@ -0,0 +1,86 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "mergeConfidence:all-badges",
+    "config:recommended",
+    ":semanticCommits",
+    ":preserveSemverRanges",
+    "helpers:pinGitHubActionDigests"
+  ],
+  "minimumReleaseAge": "7 days",
+  "ignorePaths": ["tflint-ruleset-blueprint/rules/testdata/**"],
+  "labels": ["dependencies"],
+  "vulnerabilityAlerts": {
+    "labels": ["type:security"],
+    "minimumReleaseAge": null
+  },
+  "separateMajorMinor": false,
+  "additionalBranchPrefix": "{{parentDir}}-",
+  "constraints": {
+    "go": "1.23"
+  },
+  "packageRules": [
+    {
+      "matchFileNames": [".github/**"],
+      "extends": [":semanticCommitTypeAll(chore)", ":rebaseStalePrs"]
+    },
+    {
+      "matchManagers": ["terraform"],
+      "matchDepNames": ["google", "google-beta"],
+      "groupName": "terraform google provider",
+      "rangeStrategy": "widen"
+    },
+    {
+      "matchManagers": ["terraform"],
+      "matchDepTypes": ["module"],
+      "enabled": false
+    },
+    {
+      "matchDepTypes": ["require"],
+      "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"],
+      "groupName": "GO modules"
+    },
+    {
+      "matchPackageNames": ["go"],
+      "allowedVersions": "1.23",
+      "postUpdateOptions": ["gomodTidy", "gomodUpdateImportPaths"]
+    }
+  ],
+  "customManagers": [
+    {
+      "customType": "regex",
+      "fileMatch": ["(^|/)Makefile$"],
+      "matchStrings": ["ALPINE_VERSION := (?<currentValue>.*?)\\n"],
+      "datasourceTemplate": "docker",
+      "depNameTemplate": "alpine"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["(^|/)Makefile$"],
+      "matchStrings": [
+        "DOCKER_TAG_VERSION_DEVELOPER_TOOLS := (?<currentValue>.*?)\\n"
+      ],
+      "datasourceTemplate": "docker",
+      "registryUrlTemplate": "https://gcr.io/cloud-foundation-cicd",
+      "depNameTemplate": "cft/developer-tools"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["(^|/)build/(int|lint)\\.cloudbuild\\.yaml$"],
+      "matchStrings": [
+        "  _DOCKER_TAG_VERSION_DEVELOPER_TOOLS: '(?<currentValue>.*?)'\\n"
+      ],
+      "datasourceTemplate": "docker",
+      "registryUrlTemplate": "https://gcr.io/cloud-foundation-cicd",
+      "depNameTemplate": "cft/developer-tools"
+    },
+    {
+      "customType": "regex",
+      "fileMatch": ["(^|/)Makefile$"],
+      "matchStrings": ["GOLANGCI_VERSION := (?<currentValue>.*?)\\n"],
+      "datasourceTemplate": "docker",
+      "depNameTemplate": "golangci/golangci-lint",
+      "extractVersionTemplate": "^v?(?<version>.*)$"
+    }
+  ]
+}

.github/trusted-contribution.yml

@@ -0,0 +1,24 @@
+# Copyright 2023 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+annotations:
+  - type: comment
+    text: "/gcbrun"
+trustedContributors:
+  - release-please[bot]
+  - renovate[bot]
+  - forking-renovate[bot]
+  - renovate-bot
+  - dependabot[bot]
+  - cloud-foundation-bot

.github/workflows/build-push-cft-devtools.yml

@@ -13,21 +13,57 @@ jobs:
   build-push-dev-tools:
     name: Build and push new CFT dev tools image
     runs-on: ubuntu-latest
+    if: github.repository == 'GoogleCloudPlatform/cloud-foundation-toolkit'
+
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+      issues: 'write'
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - id: 'auth'
+        name: 'Authenticate to Google Cloud'
+        uses: 'google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f' # v2.1.7
+        with:
+          workload_identity_provider: '${{ secrets.GCP_WIF_PROVIDER }}'
+          service_account: '${{ secrets.GCP_WIF_SA_EMAIL }}'
 
-      - uses: google-github-actions/setup-gcloud@master
+      - name: Setup gcloud
+        uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2
         with:
-          version: "286.0.0"
-          service_account_key: ${{ secrets.GCP_SA_KEY }}
           project_id: ${{ env.PROJECT_ID }}
 
       - name: Build
         run: |-
           gcloud auth configure-docker -q
           cd infra/build && make build-image-developer-tools
 
-      - name: Push
+      - name: Filter paths for push
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        id: filter
+        with:
+          filters: |
+            src:
+              - "infra/build/**"
+
+      - if: steps.filter.outputs.src == 'true'
+        name: Push
+        env:
+          GITHUB_SHA: ${{ github.sha }}
         run: |-
           cd infra/build && make release-image-developer-tools
+
+      - name: Open issue if push failed
+        if: ${{ failure() && steps.filter.outputs.src == 'true' }}
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |-
+              github.rest.issues.create({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  title: 'build-push-dev-tools job failed',
+                  body: 'Logs: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}',
+                  assignees: ['bharathkkb','apeabody']
+                })