chore: bump upstream version to 0.13.0

.github/actions/generate-and-publish-allure-report/action.yml

@@ -35,23 +35,24 @@
   using: "composite"
   steps:
     - name: Download Allure results
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         pattern: ${{ inputs.allure_results }}-*
         merge-multiple: true
         path: allure-results
 
     - name: Build Allure test report
-      uses: simple-elf/allure-report-action@v1.13
-      with:
-        gh_pages: gh-pages
-        allure_results: allure-results
-        allure_report: ${{ inputs.version }}
+      shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
+      run: |
+        npm install -g allure-commandline
+        allure generate allure-results --clean -o "$VERSION"
 
     - name: Publish Allure test report to gh-pages
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
       with:
         github_token: ${{ inputs.token }}
         publish_dir: ./${{ inputs.version }}
         destination_dir: allure-reports/${{ inputs.version }}
-        keep_files: false
+        keep_files: false

.github/actions/import-gpg-key/action.yml

@@ -37,10 +37,12 @@ runs:
 
     - name: Import GPG Private Key
       shell: bash
+      env:
+        GPG_PRIVATE_KEY: ${{ inputs.gpg-private-key }}
       run: |
         echo "use-agent" >> ~/.gnupg/gpg.conf
         echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
-        echo -e "${{ inputs.gpg-private-key }}" | gpg --import --batch
+        echo -e "$GPG_PRIVATE_KEY" | gpg --import --batch
         for fpr in $(gpg --list-keys --with-colons | awk -F: '/fpr:/ {print $10}' | sort -u);
         do
           echo -e "5\\ny\\n" |  gpg --batch --command-fd 0 --expert --edit-key $fpr trust;

.github/actions/publish-docker-image/action.yml

@@ -46,25 +46,27 @@
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     ###############################################
     # Enable emulation for cross-arch builds
     ###############################################
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v4
+      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
     ###############################################
     # Use Docker Buildx (required for multi-arch)
     ###############################################
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
     #####################
     # Login to DockerHub
     #####################
     - name: DockerHub login
-      uses: docker/login-action@v4
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
       with:
         username: ${{ inputs.docker_user }}
         password: ${{ inputs.docker_token }}
@@ -75,16 +77,18 @@
     - uses: ./.github/actions/setup-java
     - name: Build Controlplane
       shell: bash
+      env:
+        ROOT_DIR: ${{ inputs.rootDir }}
       run: |-
-        ./gradlew -p ${{ inputs.rootDir }} shadowJar
+        ./gradlew -p "$ROOT_DIR" shadowJar
 
     ###############################
     # Set metadata of docker image
     ###############################
     # Create SemVer or ref tags dependent of trigger event
     - name: Docker meta
       id: meta
-      uses: docker/metadata-action@v6
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
       with:
         images: |
           ${{ inputs.namespace }}/${{ inputs.imagename }}
@@ -101,12 +105,15 @@
     # Build and push the image
     ###############################
     - name: Build and push
-      uses: docker/build-push-action@v7
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      env:
+        ROOT_DIR: ${{ inputs.rootDir }}
+        IMAGE_NAME: ${{ inputs.imagename }}
       with:
-        context: ${{ inputs.rootDir }}
-        file: ${{ inputs.rootDir }}/build/resources/docker/Dockerfile
+        context: ${{ env.ROOT_DIR }}
+        file: ${{ env.ROOT_DIR }}/build/resources/docker/Dockerfile
         build-args: |
-          JAR=build/libs/${{ inputs.imagename }}.jar
+          JAR=build/libs/${{ env.IMAGE_NAME }}.jar
           OTEL_JAR=build/resources/otel/opentelemetry-javaagent.jar
           ADDITIONAL_FILES=build/legal/*
         push: true
@@ -119,7 +126,7 @@
     # https://github.com/peter-evans/dockerhub-description
     ###############################
     - name: Update Docker Hub description
-      uses: peter-evans/dockerhub-description@v5
+      uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
       with:
         readme-filepath: ${{ inputs.rootDir }}/notice.md
         username: ${{ inputs.docker_user }}

.github/actions/publish-latest-versioned-snapshot/action.yml

@@ -29,12 +29,14 @@
   steps:
     - name: Write version to latest-versioned-snapshot file
       shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
       run: |
         mkdir -p lvs
-        echo "${{ inputs.version }}" > lvs/latest-versioned-snapshot.txt
+        echo "$VERSION" > lvs/latest-versioned-snapshot.txt
 
     - name: Deploy to GitHub Pages
-      uses: peaceiris/actions-gh-pages@v4
+      uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
       with:
         github_token: ${{ env.GITHUB_TOKEN }}
         publish_dir: ./lvs

.github/actions/publish-maven-artifacts/action.yml

@@ -0,0 +1,53 @@
+#################################################################################
+#  Copyright (c) 2026 Cofinity-X GmbH
+#
+#  See the NOTICE file(s) distributed with this work for additional
+#  information regarding copyright ownership.
+#
+#  This program and the accompanying materials are made available under the
+#  terms of the Apache License, Version 2.0 which is available at
+#  https://www.apache.org/licenses/LICENSE-2.0.
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+#
+#  SPDX-License-Identifier: Apache-2.0
+#################################################################################
+
+
+name: "Publish Maven Artifacts"
+description: "Publish maven artifacts to central repository"
+
+inputs:
+  gpg-private-key:
+    description: the gpg private key used to publish
+    required: true
+  gpg-passphrase:
+    description: the gpg passphrase used to publish
+    required: true
+  username:
+    description: the username
+    required: true
+  password:
+    description: the password
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+
+    - uses: ./.github/actions/import-gpg-key
+      with:
+        gpg-private-key: ${{ inputs.gpg-private-key }}
+
+    - name: Publish to maven central
+      shell: bash
+      env:
+        ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ inputs.username }}
+        ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ inputs.password }}
+        ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ inputs.gpg-private-key }}
+        ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ inputs.gpg-passphrase }}
+      run: ./gradlew publishToMavenCentral -Psigning.gnupg.executable=gpg -Psigning.gnupg.passphrase="$ORG_GRADLE_PROJECT_signingInMemoryKeyPassword"

.github/actions/run-deployment-test/action.yml

@@ -44,36 +44,48 @@
   k8sversion:
     required: false
     description: "Version of Kubernetes to use"
-    default: "v1.34.3"
+    default: "v1.36.1"
 
 runs:
   using: "composite"
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - uses: ./.github/actions/setup-java
 
     - uses: ./.github/actions/setup-helm
     - uses: ./.github/actions/setup-kubectl
 
     - name: Create k8s Kind Cluster
-      uses: helm/kind-action@v1.14.0
+      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
       with:
+        # kind >= v0.32.0 is required for the current node images (containerd config v4);
+        # the kind-action default (v0.31.0) fails "kind load" with:
+        #   "unknown containerd config version: 4 (supported versions: 2 and 3)".
+        # Drop this pin once helm/kind-action's default kind version is >= v0.32.0.
+        version: v0.32.0
         node_image: kindest/node:${{ inputs.k8sversion }}
 
     - name: Build docker images
       shell: bash
+      env:
+        ROOT_DIR: ${{ inputs.rootDir }}
       run: |-
-        modules=(${{ inputs.rootDir }})
+        read -ra modules <<< "$ROOT_DIR"
         for module in "${modules[@]}"
         do
-          ./gradlew -p $module dockerize
+          ./gradlew -p "$module" dockerize
         done
 
     - name: Load images into KinD
       shell: bash
+      env:
+        IMAGE_NAME: ${{ inputs.imagename }}
+        IMAGE_TAG: ${{ inputs.image_tag }}
       run: |
-        images=(${{ inputs.imagename }})
-        versioned=( "${images[@]/%/:${{ inputs.image_tag }}}" )
+        read -ra images <<< "$IMAGE_NAME"
+        versioned=( "${images[@]/%/:$IMAGE_TAG}" )
         versioned_images=$(IFS=' ' ; echo "${versioned[*]}")
         kind get clusters | xargs -n1 kind load docker-image $versioned_images --name
 
@@ -83,7 +95,9 @@
 
     - name: Install Runtime
       shell: bash
-      run: ${{ inputs.helm_command }}
+      env:
+        HELM_COMMAND: ${{ inputs.helm_command }}
+      run: eval "$HELM_COMMAND"
 
     - name: Print logs
       if: failure()

.github/actions/setup-helm/action.yml

@@ -24,6 +24,6 @@ description: "Setup Helm"
 runs:
   using: "composite"
   steps:
-    - uses: azure/setup-helm@v4
+    - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
       with:
         version: v3.16.1

.github/actions/setup-java/action.yml

@@ -26,9 +26,9 @@ runs:
   using: "composite"
   steps:
     - name: Setup JDK 21
-      uses: actions/setup-java@v5.2.0
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         java-version: '21'
         distribution: 'temurin'
     - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v5
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0

.github/actions/setup-kubectl/action.yml

@@ -24,6 +24,6 @@ description: "Setup Kubectl"
 runs:
   using: "composite"
   steps:
-    - uses: azure/setup-kubectl@v4
+    - uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
       with:
         version: v1.31.1

.github/actions/update-version-and-charts/action.yml

@@ -33,36 +33,46 @@
     - name: Resolve version
       id: resolver
       shell: bash
+      env:
+        BUMP_VERSION: ${{ inputs.bump_version }}
+        INPUT_VERSION: ${{ inputs.version }}
       run: |
-        if [[ "${{ inputs.bump_version }}" == "true" ]] then
-          IFS=.- read -r MAJOR MINOR PATCH SNAPSHOT<<<"${{ inputs.version }}"  
+        if [[ "$BUMP_VERSION" == "true" ]] then
+          IFS=.- read -r MAJOR MINOR PATCH SNAPSHOT<<<"$INPUT_VERSION"
           VERSION="$MAJOR.$((MINOR+1)).0-SNAPSHOT"
         else
-          VERSION=${{ inputs.version }}
+          VERSION="$INPUT_VERSION"
         fi
         echo "version=$VERSION" >> "$GITHUB_OUTPUT"
     - name: Bump version in /charts
-      uses: mikefarah/yq@v4.52.4
+      uses: mikefarah/yq@1b9b4ac5187171d2e5e3129be0cfa827c7f9d53d # v4.53.3
+      env:
+        RESOLVED_VERSION: ${{ steps.resolver.outputs.version }}
       with:
         cmd: |
-          find charts -name Chart.yaml -maxdepth 3 | xargs -n1 yq -i '.appVersion = "${{ steps.resolver.outputs.version }}" 
-            | .version = "${{ steps.resolver.outputs.version }}"'
+          find charts -name Chart.yaml -maxdepth 3 | xargs -n1 yq -i '.appVersion = env(RESOLVED_VERSION) | .version = env(RESOLVED_VERSION)'
     - name: Update Chart READMEs
       shell: bash
       run: |
-          docker run -v ${{ github.workspace }}/charts:/helm-docs jnorwood/helm-docs helm-docs
+        docker run -v "${GITHUB_WORKSPACE}/charts:/helm-docs" jnorwood/helm-docs helm-docs
     - name: Update version in gradle.properties
       shell: bash
+      env:
+        RESOLVED_VERSION: ${{ steps.resolver.outputs.version }}
       run: |-
-        sed -i  's/version=.*/version=${{ steps.resolver.outputs.version }}/g' gradle.properties
+        sed -i 's/version=.*/version='"$RESOLVED_VERSION"'/g' gradle.properties
     - name: Commit changes
       id: make-commit
       shell: bash
+      env:
+        BUMP_VERSION: ${{ inputs.bump_version }}
+        INPUT_VERSION: ${{ inputs.version }}
+        RESOLVED_VERSION: ${{ steps.resolver.outputs.version }}
       run: |
-        if [[ "${{ inputs.bump_version }}" == "true" ]] then
-          MESSAGE="Bump to version ${{ steps.resolver.outputs.version }}"
+        if [[ "$BUMP_VERSION" == "true" ]] then
+          MESSAGE="Bump to version $RESOLVED_VERSION"
         else
-          MESSAGE="Prepare release ${{ inputs.version }}"
+          MESSAGE="Prepare release $INPUT_VERSION"
         fi
 
         git add .