Migrate setup-go-kpt action reference to kpt repo - #1164
Conversation
Signed-off-by: Aravindhan Ayyanathan <aravindhan.a@est.tech>
✅ Deploy Preview for kpt-porch ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
It should be merged only after the merge of kptdev/krm-functions-sdk#768 and kptdev/krm-functions-catalog#1295 |
|
There was a problem hiding this comment.
Pull request overview
This PR migrates the repository’s GitHub Actions workflows to use the setup-go-kpt composite action from the upstream kptdev/kpt repository, removing the previously vendored local action.
Changes:
- Updated workflow steps to use
kptdev/kpt/.github/actions/setup-go-kpt@maininstead of./.github/actions/setup-go-kpt. - Removed the now-unused local composite action definition at
.github/actions/setup-go-kpt/action.yml. - (Related finding) One workflow still references an invalid
actions/checkout@v7.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/sonar-ci-artifacts.yaml | Switch setup-go-kpt action reference to upstream repo. |
| .github/workflows/release.yaml | Switch setup-go-kpt action reference to upstream repo. |
| .github/workflows/porchctl-dev-release.yaml | Switch setup-go-kpt action reference to upstream repo. |
| .github/workflows/porch-e2e-nightly.yaml | Switch setup-go-kpt action reference to upstream repo (2 jobs). |
| .github/workflows/porch-e2e-ci-jobs.yaml | Switch setup-go-kpt action reference to upstream repo (2 jobs). |
| .github/workflows/image-build-push-release.yaml | Switch setup-go-kpt action reference to upstream repo. |
| .github/workflows/gosec-scan.yaml | Switch setup-go-kpt action reference to upstream repo. |
| .github/workflows/golangci-lint.yaml | Switch setup-go-kpt action reference to upstream repo. |
| .github/actions/setup-go-kpt/action.yml | Delete local composite action now replaced by upstream reference. |
Suppressed comments (2)
.github/workflows/porch-e2e-nightly.yaml:120
- Using
@mainfor a third-party action makes the workflow non-reproducible and increases supply-chain risk; pin to a specific commit SHA (or a version tag) instead.
uses: kptdev/kpt/.github/actions/setup-go-kpt@main
.github/workflows/porch-e2e-ci-jobs.yaml:148
- Using
@mainfor a third-party action makes the workflow non-reproducible and increases supply-chain risk; pin to a specific commit SHA (or a version tag) instead.
uses: kptdev/kpt/.github/actions/setup-go-kpt@main
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: Aravindhan Ayyanathan <aravindhan.a@est.tech>



Description
setup-go-kptaction references from local./.github/actions/setup-go-kpttokptdev/kpt/.github/actions/setup-go-kpt@main, and removed the now-unused local action directory.github/actions/setup-go-kpt/Type of Change
Checklist
AI Disclosure
If so, please describe how:
- Kiro to update the workflow references and prepare the PR.