Update the release-next branch with latest changes in master

.eslintrc.json

@@ -13,8 +13,7 @@
     "eslint:recommended",
     "plugin:@next/next/recommended",
     "plugin:react/recommended",
-    "plugin:mdx/recommended",
-    "plugin:markdown/recommended"
+    "plugin:mdx/recommended"
   ],
   "parserOptions": {
     "ecmaFeatures": {

.github/workflows/check.yaml

@@ -11,7 +11,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 16
+          node-version: 20
           cache: npm
       - run: npm ci
       - run: npm run check

.github/workflows/make-self-upgrade.yaml

@@ -8,6 +8,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   self_upgrade:
     runs-on: ubuntu-latest
@@ -27,13 +30,13 @@ jobs:
           echo "This workflow should not be run on a non-branch-head."
           exit 1
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - id: go-version
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 
@@ -64,7 +67,7 @@ jobs:
           git push -f origin "$SELF_UPGRADE_BRANCH"
 
       - if: ${{ steps.is-up-to-date.outputs.result != 'true' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { repo, owner } = context.repo;
@@ -77,7 +80,7 @@ jobs:
             });
 
             if (pulls.data.length < 1) {
-              await github.rest.pulls.create({
+              const result = await github.rest.pulls.create({
                 title: '[CI] Merge ' + process.env.SELF_UPGRADE_BRANCH + ' into ' + process.env.SOURCE_BRANCH,
                 owner: owner,
                 repo: repo,
@@ -87,4 +90,10 @@ jobs:
                   'This PR is auto-generated to bump the Makefile modules.',
                 ].join('\n'),
               });
+              await github.rest.issues.addLabels({
+                owner,
+                repo,
+                issue_number: result.data.number,
+                labels: ['skip-review']
+              });
             }

Makefile

@@ -48,6 +48,10 @@ FORCE:
 
 noop: # do nothing
 
+# Set empty value for MAKECMDGOALS to prevent the "warning: undefined variable 'MAKECMDGOALS'"
+# warning from happening when running make without arguments
+MAKECMDGOALS ?=
+
 ##################################
 # Host OS and architecture setup #
 ##################################
@@ -56,8 +60,10 @@ noop: # do nothing
 # binary may not be available in the PATH yet when the Makefiles are
 # evaluated. HOST_OS and HOST_ARCH only support Linux, *BSD and macOS (M1
 # and Intel).
-HOST_OS ?= $(shell uname -s | tr A-Z a-z)
-HOST_ARCH ?= $(shell uname -m)
+host_os := $(shell uname -s | tr A-Z a-z)
+host_arch := $(shell uname -m)
+HOST_OS ?= $(host_os)
+HOST_ARCH ?= $(host_arch)
 
 ifeq (x86_64, $(HOST_ARCH))
 	HOST_ARCH = amd64
@@ -70,7 +76,8 @@ endif
 # Git and versioning information #
 ##################################
 
-VERSION ?= $(shell git describe --tags --always --match='v*' --abbrev=14 --dirty)
+git_version := $(shell git describe --tags --always --match='v*' --abbrev=14 --dirty)
+VERSION ?= $(git_version)
 IS_PRERELEASE := $(shell git describe --tags --always --match='v*' --abbrev=0 | grep -q '-' && echo true || echo false)
 GITCOMMIT := $(shell git rev-parse HEAD)
 GITEPOCH := $(shell git show -s --format=%ct HEAD)

OWNERS

@@ -1,13 +1,6 @@
 approvers:
-- munnerz
-- JoshVanL
-- jakexks
-- irbekrm
-- maelvls
-- SgtCoDFish
-- wallrj
-- inteon
+- cm-maintainers
 reviewers:
+- cm-maintainers
 - hawksight
-- erikgb
-- thatsmrtalbot
+- erikgb

OWNERS_ALIASES

@@ -11,3 +11,4 @@ aliases:
     - irbekrm
     - sgtcodfish
     - inteon
+    - thatsmrtalbot

components/docs/CodeBlock.jsx

@@ -3,10 +3,14 @@
 // Zentered 2022, licensed under the Apache 2.0 license.
 
 import React from 'react'
-import Highlight, { defaultProps } from 'prism-react-renderer'
+import { Highlight, Prism } from 'prism-react-renderer'
 import { CopyToClipboard } from 'react-copy-to-clipboard'
 import { useState } from 'react'
 
+// see https://github.com/FormidableLabs/prism-react-renderer?tab=readme-ov-file#custom-language-support
+(typeof global !== "undefined" ? global : window).Prism = Prism
+require('prismjs/components/prism-bash')
+
 const copyIcon = (
   <svg
     className="docs-codeblock-copy-icon"
@@ -43,7 +47,6 @@ export default function CodeBlock({ children, theme = 'github' }) {
   return (
     <div className="relative">
       <Highlight
-        {...defaultProps}
         theme={theme}
         code={code}
         language={language}
@@ -53,11 +56,11 @@ export default function CodeBlock({ children, theme = 'github' }) {
             <CopyToClipboard text={code} onCopy={() => setCopied(doneIcon)}>
               <button className="docs-codeblock-btn">{copied}</button>
             </CopyToClipboard>
-            <pre className={`${className}`} style={{ ...style }}>
+            <pre className={className} style={style}>
               {tokens.map((line, i) => (
-                <div key={i} {...getLineProps({ line, key: i })}>
+                <div key={i} {...getLineProps({ line })}>
                   {line.map((token, key) => (
-                    <span key={key} {...getTokenProps({ token, key })} />
+                    <span key={key} {...getTokenProps({ token })} />
                   ))}
                 </div>
               ))}

content/docs/contributing/contributing-flow.md

@@ -14,7 +14,7 @@ Any issues towards the documentation should also be filed there.
 
 We use [Prow](https://github.com/k8s-ci-robot/test-infra/tree/master/prow) on all our repositories.
 If you've ever looked at a Kubernetes repo, you will probably already have met Prow. Prow will be able to help you in GitHub using its commands.
-You can find then all [on the command help page](https://prow.build-infra.jetstack.net/command-help).
+You can find then all [on the command help page](https://prow.infra.cert-manager.io/command-help).
 Prow will also run all tests and assign certain labels on PRs.
 
 ## Bugs
@@ -159,7 +159,7 @@ Sometimes `/triage` is also added which helps us when following up Issues.
 ### Assignees meaning in PRs and issues
 
 Sometimes, you might see someone commenting with the
-[`/assign` prow command](https://prow.build-infra.jetstack.net/command-help#assign):
+[`/assign` prow command](https://prow.infra.cert-manager.io/command-help#assign):
 
 ```plain
 /assign @meyskens

content/docs/releases/release-notes/release-notes-1.15.md

@@ -33,7 +33,18 @@ Thanks also to the CNCF, which provides resources and support, and to the AWS op
 
 In addition, massive thanks to Venafi for contributing developer time and resources towards the continued maintenance of cert-manager projects.
 
-## Changes by Kind
+## `v1.15.1`
+
+### Bug or Regression
+
+- BUGFIX: fix issue that caused Vault issuer to not retry signing when an error was encountered. ([#7111](https://github.com/cert-manager/cert-manager/pull/7111), [@inteon](https://github.com/inteon))
+
+### Other (Cleanup or Flake)
+
+- Update `github.com/Azure/azure-sdk-for-go/sdk/azidentity` to address `CVE-2024-35255` ([#7092](https://github.com/cert-manager/cert-manager/pull/7092), [@ThatsMrTalbot](https://github.com/ThatsMrTalbot))
+- Bump the `go-retryablehttp` dependency to fix `CVE-2024-6104` ([#7130](https://github.com/cert-manager/cert-manager/pull/7130), [@SgtCoDFish](https://github.com/SgtCoDFish))
+
+## `v1.15.0`
 
 ### Feature
 

content/docs/variables.json

@@ -1,3 +1,3 @@
 {
-    "cert_manager_latest_version": "v1.15.0"
+    "cert_manager_latest_version": "v1.15.1"
 }

klone.yaml

@@ -10,30 +10,30 @@ targets:
     - folder_name: boilerplate
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: e9363accaaee20a995bbf8f1c9cba2ea77da8935
+      repo_hash: 7200a66ad8f9488094e3ca72b06b9c0768323286
       repo_path: modules/boilerplate
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: e9363accaaee20a995bbf8f1c9cba2ea77da8935
+      repo_hash: 7200a66ad8f9488094e3ca72b06b9c0768323286
       repo_path: modules/generate-verify
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: e9363accaaee20a995bbf8f1c9cba2ea77da8935
+      repo_hash: 7200a66ad8f9488094e3ca72b06b9c0768323286
       repo_path: modules/help
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: e9363accaaee20a995bbf8f1c9cba2ea77da8935
+      repo_hash: 7200a66ad8f9488094e3ca72b06b9c0768323286
       repo_path: modules/klone
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: e9363accaaee20a995bbf8f1c9cba2ea77da8935
+      repo_hash: 7200a66ad8f9488094e3ca72b06b9c0768323286
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: e9363accaaee20a995bbf8f1c9cba2ea77da8935
+      repo_hash: 7200a66ad8f9488094e3ca72b06b9c0768323286
       repo_path: modules/tools

lib/remark-plugins/variable/index.js

@@ -35,5 +35,5 @@ export default function plugin(options) {
                     break;
             }
         });
-    }
+    };
 }

make/_shared/generate-verify/00_mod.mk

@@ -13,5 +13,6 @@
 # limitations under the License.
 
 shared_generate_targets ?=
+shared_generate_targets_dirty ?=
 shared_verify_targets ?=
 shared_verify_targets_dirty ?=

make/_shared/generate-verify/02_mod.mk

@@ -16,18 +16,24 @@
 ## Generate all generate targets.
 ## @category [shared] Generate/ Verify
 generate: $$(shared_generate_targets)
+	@echo "The following targets cannot be run simultaniously with each other or other generate scripts:"
+	$(foreach TARGET,$(shared_generate_targets_dirty), $(MAKE) $(TARGET))
 
 verify_script := $(dir $(lastword $(MAKEFILE_LIST)))/util/verify.sh
 
 # Run the supplied make target argument in a temporary workspace and diff the results.
 verify-%: FORCE
-	$(verify_script) $(MAKE) -s $*
+	+$(verify_script) $(MAKE) $*
 
 verify_generated_targets = $(shared_generate_targets:%=verify-%)
+verify_generated_targets_dirty = $(shared_generate_targets_dirty:%=verify-%)
+
+verify_targets = $(sort $(verify_generated_targets) $(shared_verify_targets))
+verify_targets_dirty = $(sort $(verify_generated_targets_dirty) $(shared_verify_targets_dirty))
 
 .PHONY: verify
 ## Verify code and generate targets.
 ## @category [shared] Generate/ Verify
-verify: $$(verify_generated_targets) $$(shared_verify_targets)
+verify: $$(verify_targets)
 	@echo "The following targets create temporary files in the current directory, that is why they have to be run last:"
-	$(MAKE) noop $(shared_verify_targets_dirty)
+	$(foreach TARGET,$(verify_targets_dirty), $(MAKE) $(TARGET))

make/_shared/generate-verify/util/verify.sh

@@ -44,7 +44,7 @@ cleanup() {
 }
 trap "cleanup" EXIT SIGINT
 
-cp -a "${projectdir}/." "${tmp}"
+rsync -aEq "${projectdir}/." "${tmp}" --exclude "_bin/"
 pushd "${tmp}" >/dev/null
 
 "$@"