chore: backport kubefleet/main to Azure/fleet

.github/.copilot/breadcrumbs/2025-01-06-2200-workgenerator-controller-interface-refactor.md

@@ -189,7 +189,7 @@ The resource snapshot resolver is now fully aligned with the interface refactori
 ### What Was Done
 1. **Fixed Missing Imports**: Added required imports to `binding_resolver.go`
    - Added `"fmt"` import for error formatting
-   - Added `"github.com/kubefleet-dev/kubefleet/pkg/scheduler/queue"` import for `queue.PlacementKey` type
+   - Added `"go.goms.io/fleet/pkg/scheduler/queue"` import for `queue.PlacementKey` type
 
 2. **Compilation Success**: Fixed all compilation errors
    - No more "undefined: queue" errors
@@ -204,7 +204,7 @@ The resource snapshot resolver is now fully aligned with the interface refactori
 ### File Changes Made
 - `/Users/ryanzhang/Workspace/github/kubefleet/pkg/utils/controller/binding_resolver.go`
   - Added missing `"fmt"` import
-  - Added missing `"github.com/kubefleet-dev/kubefleet/pkg/scheduler/queue"` import
+  - Added missing `"go.goms.io/fleet/pkg/scheduler/queue"` import
 
 ### Status
 ✅ **ALL CONTROLLER UTILITY TESTS PASSING**: No test failures found

.github/actionlint.yaml

@@ -0,0 +1,5 @@
+self-hosted-runner:
+  labels:
+    - oracle-vm-16cpu-64gb-x86-64
+    - 1ES.Pool=1es-aks-fleet-pool-ubuntu
+    - 1ES.Pool=1es-aks-fleet-pool-ubuntu-arm64

.github/workflows/build-publish-mcr.yml

@@ -37,20 +37,20 @@ jobs:
           # set the image version
           RELEASE_TAG=${{ inputs.releaseTag }}
           if [ -z "$RELEASE_TAG" ]; then
-            RELEASE_TAG=`git describe --tags $(git rev-list --tags --max-count=1)`
+            RELEASE_TAG=$(git describe --tags "$(git rev-list --tags --max-count=1)")
             echo "The user input release tag is empty, will use the latest tag $RELEASE_TAG."
           fi
-          echo "release_tag=$RELEASE_TAG" >> $GITHUB_OUTPUT
+          echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
 
           # Strip 'v' prefix from RELEASE_TAG for helm chart version
           ARC_HELMCHART_VERSION="${RELEASE_TAG#v}"
-          echo "arc_helmchart_version=$ARC_HELMCHART_VERSION" >> $GITHUB_OUTPUT
+          echo "arc_helmchart_version=$ARC_HELMCHART_VERSION" >> "$GITHUB_OUTPUT"
           echo "Using Arc Helm Chart version: $ARC_HELMCHART_VERSION"
 
           # Fetch the latest fleet-networking version
           # NOTE: The fleet-networking image must be cut and pushed to MCR first before retrieving this version
           FLEET_NETWORKING_VERSION="${FLEET_NETWORKING_VERSION:-$(curl "https://api.github.com/repos/Azure/fleet-networking/tags" | jq -r '.[0].name')}"
-          echo "fleet_networking_version=$FLEET_NETWORKING_VERSION" >> $GITHUB_OUTPUT
+          echo "fleet_networking_version=$FLEET_NETWORKING_VERSION" >> "$GITHUB_OUTPUT"
           echo "Using Fleet Networking version: $FLEET_NETWORKING_VERSION"
 
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
@@ -150,9 +150,9 @@ jobs:
         run: |
           sudo groupadd docker || true
           echo "Adding $USER to the docker group"
-          sudo usermod -aG docker $USER
+          sudo usermod -aG docker "$USER"
           newgrp docker
-          sudo setfacl --modify user:$USER:rw /var/run/docker.sock
+          sudo setfacl --modify "user:$USER:rw" /var/run/docker.sock
       - name: 'Login the ACR'
         # Note (chenyu1): must not use root privileges; the system seems to have some trouble
         # retrieving credentials when sudo is used.

.github/workflows/chart.yml

@@ -39,7 +39,7 @@ jobs:
       group: helm-chart-publish-gh-pages
       cancel-in-progress: false
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
           fetch-depth: 0
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0

.github/workflows/ci.yml

@@ -41,17 +41,17 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Ginkgo CLI
         run: |
           go install github.com/onsi/ginkgo/v2/ginkgo@v2.23.4
 
       - name: Prepare necessary environment variables
         run: |
-          echo "CGO_ENABLED=1" >> $GITHUB_ENV
+          echo "CGO_ENABLED=1" >> "$GITHUB_ENV"
           KUBEBUILDER_ASSETS=$(make --silent kubebuilder-assets-path)
-          echo "KUBEBUILDER_ASSETS="$KUBEBUILDER_ASSETS"" >> $GITHUB_ENV
+          echo "KUBEBUILDER_ASSETS=$KUBEBUILDER_ASSETS" >> "$GITHUB_ENV"
 
       # Certain tests that require special setup (e.g., those that should be run with Ginkgo CLI only) will
       # be skipped in this step.
@@ -116,7 +116,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Move Docker data directory to /mnt
         # The default storage device on GitHub-hosted runners is running low during e2e tests.

.github/workflows/code-lint.yml

@@ -42,7 +42,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: true
 
@@ -63,7 +63,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: golangci-lint
         run: make lint
@@ -76,7 +76,7 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5

.github/workflows/codeql-analysis.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/codespell.yml

@@ -16,7 +16,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4.1.7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4.1.7
       - uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # master
         with:
           check_filenames: true

.github/workflows/markdown-lint.yml

@@ -10,7 +10,7 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - uses: tcort/github-action-markdown-link-check@e7c7a18363c842693fadde5d41a3bd3573a7a225 # v1
       with:
         # this will only show errors in the output

.github/workflows/publish-image.yml

@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - main
-  create:
-     # Publish semver tags as releases.
     tags: [ 'v*.*.*' ]
 
 permissions:
@@ -23,19 +21,19 @@ env:
 
 jobs:
   export-registry:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     outputs:
       registry: ${{ steps.export.outputs.registry }}
     steps:
       - id: export
         run: |
           # registry must be in lowercase
-          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])" >> $GITHUB_OUTPUT
+          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
   publish-images:
     needs: export-registry
     env:
       REGISTRY: ${{ needs.export-registry.outputs.registry }}
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
         with:
@@ -44,9 +42,11 @@ jobs:
       - name: Set image version for a new release
         if: startsWith(github.ref, 'refs/tags/')
         run: |
-          echo "HUB_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          echo "MEMBER_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
-          echo "REFRESH_TOKEN_IMAGE_VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          {
+            echo "HUB_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}"
+            echo "MEMBER_AGENT_IMAGE_VERSION=${GITHUB_REF#refs/tags/}"
+            echo "REFRESH_TOKEN_IMAGE_VERSION=${GITHUB_REF#refs/tags/}"
+          } >> "$GITHUB_ENV"
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
         with:

.github/workflows/release.yml

@@ -49,7 +49,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ needs.export-registry.outputs.tag }}
 
@@ -90,7 +90,7 @@ jobs:
           echo "✅ Published images:"
           for IMAGE in ${{ env.HUB_AGENT_IMAGE_NAME }} ${{ env.MEMBER_AGENT_IMAGE_NAME }} ${{ env.REFRESH_TOKEN_IMAGE_NAME }}; do
             echo "  - ${{ env.REGISTRY }}/${IMAGE}:${{ env.TAG }}"
-            if [[ "${{ env.TAG }}" != *-rc.* ]]; then
+            if [[ "${TAG}" != *-rc.* ]]; then
               echo "  - ${{ env.REGISTRY }}/${IMAGE}:${VERSION}"
             fi
           done

.github/workflows/setup-release.yml

@@ -38,7 +38,9 @@ jobs:
                   fi
 
                   # registry must be in lowercase
-                  echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-                  echo "tag=${TAG}" >> $GITHUB_OUTPUT
-                  echo "version=${TAG#v}" >> $GITHUB_OUTPUT
+                  {
+                    echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')"
+                    echo "tag=${TAG}"
+                    echo "version=${TAG#v}"
+                  } >> "$GITHUB_OUTPUT"
                   echo "Release tag: ${TAG}, version: ${TAG#v}"

.github/workflows/squad-ci.yml

@@ -15,7 +15,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build and test
         run: |

.github/workflows/squad-docs.yml

@@ -18,7 +18,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build docs
         run: |

.github/workflows/squad-heartbeat.yml

@@ -25,15 +25,15 @@ jobs:
   heartbeat:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Check triage script
         id: check-script
         run: |
           if [ -f ".squad/templates/ralph-triage.js" ]; then
-            echo "has_script=true" >> $GITHUB_OUTPUT
+            echo "has_script=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_script=false" >> $GITHUB_OUTPUT
+            echo "has_script=false" >> "$GITHUB_OUTPUT"
             echo "⚠️ ralph-triage.js not found — run 'squad upgrade' to install"
           fi
 

.github/workflows/squad-insider-release.yml

@@ -12,7 +12,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/squad-issue-assign.yml

@@ -14,7 +14,7 @@ jobs:
     if: startsWith(github.event.label.name, 'squad:')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Identify assigned member and trigger work
         uses: actions/github-script@v7

.github/workflows/squad-label-enforce.yml

@@ -12,7 +12,7 @@ jobs:
   enforce:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Enforce mutual exclusivity
         uses: actions/github-script@v7

.github/workflows/squad-preview.yml

@@ -12,7 +12,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Build and test
         run: |

.github/workflows/squad-promote.yml

@@ -18,7 +18,7 @@ jobs:
     name: Promote dev → preview
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -70,7 +70,7 @@ jobs:
     needs: dev-to-preview
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/squad-release.yml

@@ -12,7 +12,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/squad-triage.yml

@@ -13,7 +13,7 @@ jobs:
     if: github.event.label.name == 'squad'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Triage issue via Lead agent
         uses: actions/github-script@v7

.github/workflows/sync-squad-labels.yml

@@ -15,7 +15,7 @@ jobs:
   sync-labels:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Parse roster and sync labels
         uses: actions/github-script@v7

.github/workflows/trivy.yml

@@ -3,9 +3,9 @@ on:
   push:
     branches:
       - main
-  create:
     # Publish semver tags as releases.
-    tags: [ 'v*.*.*' ]
+    tags:
+      - 'v*.*.*'
   workflow_dispatch: {}
 
 permissions:
@@ -31,7 +31,7 @@ jobs:
           # registry must be in lowercase
           # store the images under dev
           # TODO: need to cleanup dev images periodically 
-          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr [:upper:] [:lower:])"  >> $GITHUB_OUTPUT
+          echo "registry=$(echo "${{ env.REGISTRY }}/${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
   scan-images:
     needs: export-registry
     env:
@@ -44,7 +44,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
 
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Login to ${{ env.REGISTRY }}
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
@@ -54,7 +54,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: generate image version
-        run: echo IMAGE_VERSION=$(git rev-parse --short=7 HEAD) >> $GITHUB_ENV
+        run: echo "IMAGE_VERSION=$(git rev-parse --short=7 HEAD)" >> "$GITHUB_ENV"
 
       - name: Build and push images to registry with tag ${{ env.IMAGE_VERSION }}
         run: |