Merge branch 'main' of github.com:heldertsantos/mimir-analyze-tls-ski…

…p into Add_tls_insecure-skip_analyze

.github/pull_request_template.md

@@ -15,4 +15,4 @@ Fixes #<issue number>
 - [ ] Tests updated.
 - [ ] Documentation added.
 - [ ] `CHANGELOG.md` updated - the order of entries should be `[CHANGE]`, `[FEATURE]`, `[ENHANCEMENT]`, `[BUGFIX]`.
-- [ ] [`about-versioning.md`](/docs/sources/mimir/configure/about-versioning.md) updated with experimental features.
+- [ ] [`about-versioning.md`](https://github.com/grafana/mimir/blob/main/docs/sources/mimir/configure/about-versioning.md) updated with experimental features.

.github/workflows/add-to-docs-project.yml

@@ -0,0 +1,15 @@
+name: Add to docs project
+on:
+  issues:
+    types: [labeled]
+  pull_request:
+    types: [labeled]
+jobs:
+  main:
+    if: ${{ github.event.label.name == 'type/docs' }}
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: grafana/writers-toolkit/add-to-docs-project@add-to-docs-project/v1

.github/workflows/compare-helm-with-jsonnet.yml

@@ -42,28 +42,28 @@ jobs:
     needs: goversion
     steps:
     - uses: actions/checkout@v4
-    - uses: actions/setup-go@v4
+    - uses: actions/setup-go@v5
       with:
         go-version: ${{ needs.goversion.outputs.version }}
-    - uses: helm/kind-action@v1.8.0
+    - uses: helm/kind-action@v1.10.0
     - name: Download yq
-      uses: dsaltares/[email protected].1
+      uses: dsaltares/[email protected].2
       with:
         repo: 'mikefarah/yq'
         version: 'tags/v4.30.6'
         file: 'yq_linux_amd64'
         target: 'bin/yq'
         token: ${{ secrets.GITHUB_TOKEN }}
     - name: Download tk
-      uses: dsaltares/[email protected].1
+      uses: dsaltares/[email protected].2
       with:
         repo: 'grafana/tanka'
         version: 'tags/v0.22.1'
         file: 'tk-linux-amd64'
         target: 'bin/tk'
         token: ${{ secrets.GITHUB_TOKEN }}
     - name: Download jb
-      uses: dsaltares/[email protected].1
+      uses: dsaltares/[email protected].2
       with:
         repo: 'jsonnet-bundler/jsonnet-bundler'
         version: 'tags/v0.5.1'

.github/workflows/dependabot_reviewer.yml

@@ -20,7 +20,7 @@ jobs:
 
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.6.0
+        uses: dependabot/fetch-metadata@v1.7.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 

.github/workflows/helm-weekly-release-pr.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: imjasonh/setup-crane@v0.3
+      - uses: imjasonh/setup-crane@v0.4
 
       - name: Update/regenerate files
         id: update

.github/workflows/publish-technical-documentation-next.yml

@@ -1,57 +1,31 @@
-name: "publish-technical-documentation-next"
+name: publish-technical-documentation-next
 
 on:
   push:
     branches:
-    - "main"
+      - main
     paths:
-    - "docs/sources/helm-charts/**"
-    - "docs/sources/mimir/**"
+      - "docs/sources/helm-charts/**"
+      - "docs/sources/mimir/**"
   workflow_dispatch:
 jobs:
   test:
     uses: ./.github/workflows/test-docs.yml
 
   sync:
-    runs-on: "ubuntu-latest"
-    needs: "test"
+    if: github.repository == 'grafana/mimir'
+    needs: test
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
     steps:
-    - name: "Check out code"
-      uses: "actions/checkout@v4"
-
-    - name: "Clone website-sync Action"
-      # WEBSITE_SYNC_TOKEN is a fine-grained GitHub Personal Access Token that expires.
-      # It must be regenerated in the grafanabot GitHub account and requires a Grafana organization
-      # GitHub administrator to update the organization secret.
-      # The IT helpdesk can update the organization secret.
-      run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
-
-    - name: "Publish to website repository mimir (next)"
-      uses: "./.github/actions/website-sync"
-      id: "publish-next-mimir"
-      with:
-        repository: "grafana/website"
-        branch: "master"
-        host: "github.com"
-        # PUBLISH_TO_WEBSITE_TOKEN is a fine-grained GitHub Personal Access Token that expires.
-        # It must be regenerated in the grafanabot GitHub account and requires a Grafana organization
-        # GitHub administrator to update the organization secret.
-        # The IT helpdesk can update the organization secret.
-        github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_TOKEN }}"
-        source_folder: "docs/sources/mimir"
-        target_folder: "content/docs/mimir/next"
-        allow_no_changes: true
-
-    - name: "Publish to website repository helm-charts/mimir-distributed (next)"
-      uses: "./.github/actions/website-sync"
-      id: "publish-next-mimir-distributed"
-      with:
-        repository: "grafana/website"
-        branch: "master"
-        host: "github.com"
-        # PUBLISH_TO_WEBSITE_MIMIR is a fine-grained GitHub Personal Access Token that expires.
-        # It must be updated in the grafanabot GitHub account.
-        github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_TOKEN }}"
-        source_folder: "docs/sources/helm-charts/mimir-distributed"
-        target_folder: "content/docs/helm-charts/mimir-distributed/next"
-        allow_no_changes: true
+      - uses: actions/checkout@v4
+      - uses: grafana/writers-toolkit/publish-technical-documentation@publish-technical-documentation/v1
+        with:
+          source_directory: docs/sources/mimir
+          website_directory: content/docs/mimir/next
+      - uses: grafana/writers-toolkit/publish-technical-documentation@publish-technical-documentation/v1
+        with:
+          source_directory: docs/sources/helm-charts/mimir-distributed
+          website_directory: content/docs/helm-charts/mimir-distributed/next

.github/workflows/publish-technical-documentation-release-helm-charts.yml

@@ -1,76 +1,35 @@
-name: "publish-technical-documentation-release-helm-charts"
+name: publish-technical-documentation-release-helm-charts
 
 on:
   push:
     tags:  # this excludes pre-releases, e.g. mimir-distributed-2.2.0-weekly.192
-    - "mimir-distributed-[0-9]+.[0-9]+.[0-9]+"
+      - "mimir-distributed-[0-9]+.[0-9]+.[0-9]+"
     branches: # this excludes pre-releases, e.g. mimir-distributed-2.2.0-weekly.192
-    - "mimir-distributed-release-[0-9]+.[0-9]+"
+      - "mimir-distributed-release-[0-9]+.[0-9]+"
     paths:
-    - "docs/sources/helm-charts/**"
-    - "operations/helm/charts/mimir-distributed/Chart.yaml"
-
-  workflow_dispatch: # for manual testing
-
+      - "docs/sources/helm-charts/**"
+      - "operations/helm/charts/mimir-distributed/Chart.yaml"
+  workflow_dispatch:
 jobs:
   test:
     uses: ./.github/workflows/test-docs.yml
-
   sync:
-    runs-on: "ubuntu-latest"
-    needs: "test"
+    if: github.repository == 'grafana/mimir'
+    needs: test
+    # The following permissions are required to to assume roles from GitHub's OIDC which is used to fetch secrets from Vault.
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
     steps:
-
-    - name: "Checkout Mimir repo"
-      uses: "actions/checkout@v4"
-      with:
-        fetch-depth: 0
-
-    - name: "Checkout Actions library"
-      uses: "actions/checkout@v4"
-      with:
-        repository: "grafana/grafana-github-actions"
-        path: "./actions"
-
-    - name: "Install Actions from library"
-      run: "npm install --production --prefix ./actions"
-
-    - name: "Determine if there is a matching release tag"
-      id: "has-matching-release-tag"
-      uses: "./actions/has-matching-release-tag"
-      with:
-        ref_name: "${{ github.ref_name }}"
-        release_tag_regexp: "^mimir-distributed-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
-        release_branch_regexp: "^mimir-distributed-release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
-
-    - name: "Determine technical documentation version"
-      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-      uses: "./actions/docs-target"
-      id: "target"
-      with:
-        ref_name: "${{ github.ref_name }}"
-
-    - name: "Clone website-sync Action"
-      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-      # WEBSITE_SYNC_TOKEN is a fine-grained GitHub Personal Access Token that expires.
-      # It must be regenerated in the grafanabot GitHub account and requires a Grafana organization
-      # GitHub administrator to update the organization secret.
-      # The IT helpdesk can update the organization secret.
-      run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
-
-    - name: "Publish to website repository (release)"
-      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-      uses: "./.github/actions/website-sync"
-      id: "publish-release"
-      with:
-        repository: "grafana/website"
-        branch: "master"
-        host: "github.com"
-        # PUBLISH_TO_WEBSITE_TOKEN is a fine-grained GitHub Personal Access Token that expires.
-        # It must be regenerated in the grafanabot GitHub account and requires a Grafana organization
-        # GitHub administrator to update the organization secret.
-        # The IT helpdesk can update the organization secret.
-        github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_TOKEN }}"
-        source_folder: "docs/sources/helm-charts/mimir-distributed"
-        # Append ".x" to target to produce a v<major>.<minor>.x directory.
-        target_folder: "content/docs/helm-charts/mimir-distributed/${{ steps.target.outputs.target }}.x"
+      - uses: actions/checkout@v4
+        with:
+          # Full fetch depth is required to fetch tags. The publishing workflow uses tags to prevent publishing a release branch before it has been formally released, as determined by the presence of a matching tag for the release branch.
+          fetch-depth: 0
+      - uses: grafana/writers-toolkit/publish-technical-documentation-release@publish-technical-documentation-release/v1
+        with:
+          release_tag_regexp: "^mimir-distributed-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+          release_branch_regexp: "^mimir-distributed-release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+          release_branch_with_patch_regexp: "^mimir-distributed-release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+          source_directory: docs/sources/helm-charts/mimir-distributed
+          website_directory: content/docs/helm-charts/mimir-distributed

.github/workflows/publish-technical-documentation-release-mimir.yml

@@ -1,77 +1,34 @@
-name: "publish-technical-documentation-release-mimir"
+name: publish-technical-documentation-release-mimir
 
 on:
   push:
     branches:
-    - "release-*"
+      - "release-*"
     tags:
-    - "mimir-[0-9]+.[0-9]+.[0-9]+"
+      - "mimir-[0-9]+.[0-9]+.[0-9]+"
     paths:
-    - "docs/sources/mimir/**"
-
-  workflow_dispatch: # for manual testing
-
+      - "docs/sources/mimir/**"
+  workflow_dispatch:
 jobs:
   test:
     uses: ./.github/workflows/test-docs.yml
-
   sync:
-    runs-on: "ubuntu-latest"
-    needs: "test"
+    if: github.repository == 'grafana/mimir'
+    needs: test
+    # The following permissions are required to to assume roles from GitHub's OIDC which is used to fetch secrets from Vault.
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
     steps:
-
-    - name: "Checkout Mimir repo"
-      uses: "actions/checkout@v4"
-      with:
-        fetch-depth: 0
-
-    - name: "Checkout Actions library"
-      uses: "actions/checkout@v4"
-      with:
-        repository: "grafana/grafana-github-actions"
-        path: "./actions"
-
-    - name: "Install Actions from library"
-      run: "npm install --production --prefix ./actions"
-
-    - name: "Determine if there is a matching release tag"
-      id: "has-matching-release-tag"
-      uses: "./actions/has-matching-release-tag"
-      with:
-        ref_name: "${{ github.ref_name }}"
-        release_tag_regexp: "^mimir-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
-        release_branch_regexp: "^release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
-
-    - name: "Determine technical documentation version"
-      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-      uses: "./actions/docs-target"
-      id: "target"
-      with:
-        ref_name: "${{ github.ref_name }}"
-
-    - name: "Clone website-sync Action"
-      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-      # WEBSITE_SYNC_TOKEN is a fine-grained GitHub Personal Access Token that expires.
-      # It must be regenerated in the grafanabot GitHub account and requires a Grafana organization
-      # GitHub administrator to update the organization secret.
-      # The IT helpdesk can update the organization secret.
-      run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.WEBSITE_SYNC_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
-
-    - name: "Publish to website repository (release)"
-      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
-      uses: "./.github/actions/website-sync"
-      id: "publish-release"
-      with:
-        repository: "grafana/website"
-        branch: "master"
-        host: "github.com"
-        # PUBLISH_TO_WEBSITE_TOKEN is a fine-grained GitHub Personal Access Token that expires.
-        # It must be regenerated in the grafanabot GitHub account and requires a Grafana organization
-        # GitHub administrator to update the organization secret.
-        # The IT helpdesk can update the organization secret.
-        github_pat: "grafanabot:${{ secrets.PUBLISH_TO_WEBSITE_TOKEN }}"
-        source_folder: "docs/sources/mimir"
-        # Append ".x" to target to produce a v<major>.<minor>.x directory.
-        target_folder: "content/docs/mimir/${{ steps.target.outputs.target }}.x"
-        # Patch releases may not have any new technical documentation.
-        allow_no_changes: true
+      - uses: actions/checkout@v4
+        with:
+          # Full fetch depth is required to fetch tags. The publishing workflow uses tags to prevent publishing a release branch before it has been formally released, as determined by the presence of a matching tag for the release branch.
+          fetch-depth: 0
+      - uses: grafana/writers-toolkit/publish-technical-documentation-release@publish-technical-documentation-release/v1
+        with:
+          release_tag_regexp: "^mimir-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+          release_branch_regexp: "^release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+          release_branch_with_patch_regexp: "^release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+          source_directory: docs/sources/mimir
+          website_directory: content/docs/mimir