Merge branch 'CrunchyData:main' into main

Author: nasenov

.github/actions/trivy/action.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 - 2025 Crunchy Data Solutions, Inc.
+# Copyright 2024 - 2026 Crunchy Data Solutions, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -84,15 +84,15 @@ runs:
     # Install Trivy as requested.
     # NOTE: `setup-trivy` can download a "latest" version but cannot cache it.
     - if: ${{ ! contains(fromJSON(steps.parsed.outputs.setup), 'none') }}
-      uses: aquasecurity/setup-trivy@v0.2.4
+      uses: aquasecurity/setup-trivy@v0.2.5
       with:
         cache: ${{ contains(fromJSON(steps.parsed.outputs.setup), 'cache') }}
         version: ${{ steps.parsed.outputs.version }}
 
     # Restore a recent cache beginning with the prefix.
     - id: restore
       if: ${{ contains(fromJSON(steps.parsed.outputs.cache), 'restore') }}
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ${{ inputs.cache-directory }}
         key: ${{ inputs.cache-prefix }}-
@@ -132,7 +132,7 @@ runs:
             (contains(fromJSON(steps.parsed.outputs.cache), 'success') && success())
           )
         }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         key: ${{ steps.trivy.outputs.cache-key }}
         path: ${{ inputs.cache-directory }}

.github/dependabot.yml

@@ -1,4 +1,4 @@
-# Copyright 2024 - 2025 Crunchy Data Solutions, Inc.
+# Copyright 2024 - 2026 Crunchy Data Solutions, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 #
@@ -35,6 +35,7 @@ updates:
       github-actions:
         applies-to: version-updates
         patterns: ['*']
+    target-branch: "main"
 
   - package-ecosystem: gomod
     directory: '/'
@@ -61,3 +62,54 @@ updates:
           - 'k8s.io/*'
           - 'sigs.k8s.io/*'
           - 'go.opentelemetry.io/*'
+    target-branch: "main"
+
+  - package-ecosystem: github-actions
+    directories:
+      # "/" is a special case that includes ".github/workflows/*"
+      - '/'
+      - '.github/actions/*'
+    registries: '*'
+    schedule:
+      interval: weekly
+      day: tuesday
+    labels:
+      - dependencies
+    groups:
+      # Group security updates into one pull request
+      action-vulnerabilities:
+        applies-to: security-updates
+        patterns: ['*']
+
+      # Group version updates into one pull request
+      github-actions:
+        applies-to: version-updates
+        patterns: ['*']
+    target-branch: "REL_5_8"
+
+  - package-ecosystem: gomod
+    directory: '/'
+    registries: '*'
+    schedule:
+      interval: weekly
+      day: wednesday
+    labels:
+      - dependencies
+    groups:
+      # Group security updates into one pull request
+      go-vulnerabilities:
+        applies-to: security-updates
+        patterns: ['*']
+
+      # Group Kubernetes and OpenTelemetry version updates into separate pull requests
+      kubernetes:
+        patterns: ['k8s.io/*', 'sigs.k8s.io/*']
+      opentelemetry:
+        patterns: ['go.opentelemetry.io/*']
+      go-dependencies:
+        patterns: ['*']
+        exclude-patterns:
+          - 'k8s.io/*'
+          - 'sigs.k8s.io/*'
+          - 'go.opentelemetry.io/*'
+    target-branch: "REL_5_8"

.github/workflows/test.yaml

@@ -40,7 +40,7 @@ jobs:
 
       # Upload coverage to GitHub
       - run: gzip envtest.coverage
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: "~coverage~kubernetes-api=${{ matrix.kubernetes }}"
           path: envtest.coverage.gz
@@ -75,7 +75,7 @@ jobs:
 
       # Upload coverage to GitHub
       - run: gzip envtest-existing.coverage
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: "~coverage~kubernetes-k3d=${{ matrix.kubernetes }}"
           path: envtest-existing.coverage.gz
@@ -91,7 +91,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
-        with: { go-version: stable }
+        with: { go-version: '1.25.x' } # TODO: revert to stable when chainsaw supports Go 1.26 (missing testDeps.ModulePath)
 
       - name: Start k3s
         uses: ./.github/actions/k3d
@@ -124,7 +124,7 @@ jobs:
             --name 'postgres-operator' localhost/postgres-operator
 
       - run: |
-          make check-chainsaw && exit
+          make check-chainsaw CHAINSAW_EXTRA_ARGS='--exclude-test-regex chainsaw/.*autogrow.*' && exit
           failed=$?
           echo '::group::PGO logs'; docker logs 'postgres-operator'; echo '::endgroup::'
           exit $failed
@@ -142,7 +142,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
-        with: { go-version: stable }
+        with: { go-version: '1.25.x' } # TODO: revert to stable when kuttl supports Go 1.26 (missing testDeps.ModulePath)
 
       - name: Start k3s
         uses: ./.github/actions/k3d
@@ -215,7 +215,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-go@v6
         with: { go-version: stable }
-      - uses: actions/download-artifact@v6
+      - uses: actions/download-artifact@v8
         with: { path: download }
 
       # Combine the coverage profiles by taking the mode line from any one file
@@ -239,7 +239,7 @@ jobs:
 
       # Upload coverage to GitHub
       - run: gzip total-coverage.html
-      - uses: actions/upload-artifact@v5
+      - uses: actions/upload-artifact@v7
         with:
           name: coverage-report=html
           path: total-coverage.html.gz

.golangci.yaml

@@ -113,7 +113,7 @@ linters:
         SPDX-License-Identifier: Apache-2.0
       values:
         regexp:
-          DATES: ((201[7-9]|202[0-4]) - 2025|2025)
+          DATES: ((201[7-9]|202[0-5]) - 2026|2026)
 
     gomodguard:
       blocked:
@@ -179,6 +179,16 @@ linters:
         text: >-
           deprecated: Use `RequeueAfter` instead
 
+      - linters: [staticcheck]
+        path: internal/controller/runtime
+        text: >-
+          client.Apply is deprecated
+
+      - linters: [staticcheck]
+        path: internal/controller/(postgrescluster|pgupgrade|standalone_pgadmin)
+        text: >-
+           GetEventRecorderFor is deprecated
+
 # https://golangci-lint.run/usage/formatters
 formatters:
   enable:

.trivyignore.yaml

@@ -1,4 +1,4 @@
-# Copyright 2024 - 2025 Crunchy Data Solutions, Inc.
+# Copyright 2024 - 2026 Crunchy Data Solutions, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 #

Dockerfile

@@ -1,4 +1,4 @@
-# Copyright 2017 - 2025 Crunchy Data Solutions, Inc.
+# Copyright 2017 - 2026 Crunchy Data Solutions, Inc.
 #
 # SPDX-License-Identifier: Apache-2.0
 

LICENSE.md

@@ -176,7 +176,7 @@
 
    END OF TERMS AND CONDITIONS
 
-   Copyright 2017 - 2025 Crunchy Data Solutions, Inc.
+   Copyright 2017 - 2026 Crunchy Data Solutions, Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

Makefile

@@ -185,9 +185,14 @@ check-envtest-existing: createnamespaces
 #
 # https://kyverno.github.io/chainsaw/latest/operations/script#kubeconfig
 #
+# NOTE: The autogrow volume tests require a storage provider that supports real
+# volume expansion (e.g., GKE, EKS, AKS). They will fail on k3d/kind with the
+# default local-path provisioner. Use CHAINSAW_EXTRA_ARGS to skip them when needed:
+#   make check-chainsaw CHAINSAW_EXTRA_ARGS='--exclude-test-regex chainsaw/.*autogrow.*'
+#
 .PHONY: check-chainsaw
 check-chainsaw:
-	$(CHAINSAW_TEST) --config testing/chainsaw/e2e/config.yaml --values testing/chainsaw/e2e/values.yaml testing/chainsaw/e2e
+	$(CHAINSAW_TEST) --config testing/chainsaw/e2e/config.yaml --values testing/chainsaw/e2e/values.yaml $(CHAINSAW_EXTRA_ARGS) testing/chainsaw/e2e
 
 # Expects operator to be running
 #
@@ -233,8 +238,7 @@ generate-kuttl: ## Generate kuttl tests
 .PHONY: check-generate
 check-generate: ## Check everything generated is also committed
 check-generate: generate
-	git diff --exit-code -- config/crd
-	git diff --exit-code -- config/rbac
+	git diff --exit-code -- config/dev
 	git diff --exit-code -- internal/collector
 	git diff --exit-code -- pkg/apis
 
@@ -249,7 +253,7 @@ generate: generate-rbac
 generate-crd: ## Generate Custom Resource Definitions (CRDs)
 	$(CONTROLLER) $(\
 		) crd paths='./pkg/apis/...' $(\
-		) output:dir='config/crd/bases' # {directory}/{group}_{plural}.yaml
+		) output:dir='config/dev/crd/bases' # {directory}/{group}_{plural}.yaml
 	$(GO) generate ./internal/crd
 
 .PHONY: generate-collector
@@ -267,7 +271,7 @@ generate-rbac: ## Generate RBAC
 	$(CONTROLLER) $(\
 		) rbac:roleName='postgres-operator' $(\
 		) paths='./cmd/...' paths='./internal/...' $(\
-		) output:dir='config/rbac' # {directory}/role.yaml
+		) output:dir='config/dev/rbac/cluster' # {directory}/role.yaml
 
 # https://www.gnu.org/software/make/manual/make.html#Multi_002dLine
 define newline

cmd/pgbackrest/main.go

@@ -1,4 +1,4 @@
-// Copyright 2018 - 2025 Crunchy Data Solutions, Inc.
+// Copyright 2018 - 2026 Crunchy Data Solutions, Inc.
 //
 // SPDX-License-Identifier: Apache-2.0
 

cmd/postgres-operator/main.go

@@ -1,4 +1,4 @@
-// Copyright 2017 - 2025 Crunchy Data Solutions, Inc.
+// Copyright 2017 - 2026 Crunchy Data Solutions, Inc.
 //
 // SPDX-License-Identifier: Apache-2.0